Privacy policy

As of 29 August 2026. This policy applies to the website orbit-graph.com and the Orbit desktop app.

1. Controller

Hannes Sauerbaum
Knoevenagelweg 11
30165 Hannover
Germany
Email: [email protected]

2. Legal bases

The legal basis depends on the purpose. The specific processing operations and retention periods are set out in the following sections. We rely in particular on:

  • Art. 6(1)(a) GDPR – consent (optional usage statistics in the desktop app, macOS waitlist)
  • Art. 6(1)(b) GDPR – contract or pre-contractual steps (e.g. Orbit Pro, Notion sign-in, transactional emails, support)
  • Art. 6(1)(c) GDPR – legal obligations (e.g. retention of invoices)
  • Art. 6(1)(f) GDPR – legitimate interest (e.g. secure operation of the website, including technically necessary cookies)

3. Website hosting

The website is provided via Cloudflare Pages.
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA

When you visit the site, technical data are processed, for example IP address, date and time, requested URL, browser type and version, and referrer URL. The purpose is to provide, secure and deliver the website.

Legal basis: Art. 6(1)(f) GDPR.
Retention: according to Cloudflare’s practices, generally only for a short time.
Third country: processing may take place in the USA. Cloudflare uses, among other safeguards, the EU Commission’s Standard Contractual Clauses.

Further information: Cloudflare Privacy Policy

4. Fonts and cookies

Fonts are loaded locally from our server. There is no connection to external font services such as Google Fonts. We do not use analytics or marketing cookies on the website. Technically necessary cookies of the hosting provider may be set to secure the website.

Legal basis: Art. 6(1)(f) GDPR.

5. Contact by email

If you write to us by email, we process the data you provide (at least email address and message content) in order to handle your request.

Legal basis: Art. 6(1)(b) GDPR and/or Art. 6(1)(f) GDPR.
Retention: as long as needed to handle the request, then deletion unless retention obligations apply.

6. macOS waitlist

On the website you can join a waitlist for Orbit for macOS with your email address. We store the address in our Cloudflare database (D1) to notify you when the Mac app is available, and we send you a confirmation email. We do not use the address for other marketing.

The confirmation email is sent via the same email service as our other transactional mail (currently ZeptoMail / Zoho). The provider is Zoho Corporation or affiliated companies.

Legal basis: your consent under Art. 6(1)(a) GDPR.
Retention: until we notify you of availability or until you withdraw consent, then deletion unless retention obligations apply.
Withdrawal: by message to [email protected].
Third country: processing may take place in third countries, in particular the USA or India. Cloudflare and Zoho provide appropriate safeguards (including Standard Contractual Clauses).
Further information: Zoho Privacy Policy

7. Notion sign-in and local data

Orbit connects to Notion at your request. Notion user identifiers and email addresses may be processed to the extent Notion provides them. Pages, databases and text from Notion are processed locally on your device for the graph view and are not transmitted to us. Locally, Orbit also stores credentials for the Notion connection (e.g. OAuth tokens), caches and app settings on your device. Use of Notion is additionally subject to the terms and privacy policy of Notion Labs, Inc.

Legal basis: Art. 6(1)(b) GDPR.
Further information: Notion Privacy

8. Usage statistics

Usage statistics are disabled by default in the desktop app. Nothing is sent unless you expressly consent. A prompt appears on first launch. You can accept or decline. Later you can change the setting at any time under Settings → Usage statistics, or withdraw consent previously given.

With your consent you agree to the transmission of the metrics described below to our endpoint. Ordinary connection data (such as the IP address) may arise briefly as a technical matter. These connection data are not stored in the usage statistics.

The content of the usage statistics consists of anonymous daily counters without an identifier. Orbit does not transmit a customer ID, session ID, name or email. Each send contains only the increase since the last successful send. On the server, values are added up for the respective calendar day (UTC). Individual installations cannot be recognized from this. Graph content, page titles, Notion data and file paths are not transmitted.

The data may include: calendar day, app version, operating system/platform, Free or Pro, and metrics on performance and stability (e.g. load times, success and error rates, sync timeouts, approximate node/edge counts, crashes) as well as counters for the use of certain buttons and features and the time spent in the 2D and 3D graph view (daily totals).

The purpose is error analysis, stability, performance and improving Orbit. Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. Withdrawal applies for the future and is as simple as giving consent (toggle in Settings or declining again).

The stored daily aggregates are anonymous under Recital 26 GDPR. Once there is no longer a link to a person, the GDPR does not apply to these stored counters. Transmission is via HTTPS to our endpoint at Cloudflare (processor). Processing may take place in third countries, in particular the USA. Cloudflare provides appropriate safeguards (including Standard Contractual Clauses). Retention of daily counters: at most 24 months, then deletion.

We cannot delete daily counters already sent on a personal basis because no identifier is stored. After withdrawal the app no longer sends new values.

9. Licensing and payment

When you purchase or manage Orbit Pro we process your email address (e.g. from Notion or Stripe Checkout), license and subscription status, a device or installation identifier for unlocking, and Stripe customer and subscription IDs including invoice and payment status. Unlocking, license checks and the customer portal run via our license service (Cloudflare Worker). Payment is processed by Stripe. Card data are processed by Stripe and not stored by us. The provider is Stripe Payments Europe, Limited or affiliated companies of Stripe, Inc.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention, e.g. invoices).
Retention: for the term of the contract and thereafter according to commercial and tax retention periods (generally up to 10 years for accounting records).
Third country: processing may take place in the USA (Stripe or affiliated companies). Stripe provides appropriate safeguards (including Standard Contractual Clauses). Further information: Stripe Privacy Policy.

10. Transactional emails

After conclusion of a contract or on relevant subscription events we send emails (e.g. contract confirmation, invoice notices, cancellation confirmation). We use an email delivery service for this (currently ZeptoMail / Zoho).

We process the recipient address, language preference and the contract/payment context needed for the respective email. Attachments may include invoice or receipt PDFs and contractual documents.

Legal basis: Art. 6(1)(b) and (c) GDPR.
Third country: processing may take place in third countries, in particular the USA or India. Zoho provides appropriate safeguards (including Standard Contractual Clauses).
Further information: Zoho Privacy Policy

11. App updates

The desktop app may check for available updates and download them. Update information and installer files are provided via our update service (Cloudflare Worker). Technical data such as app version, operating system/platform and architecture may be sent to this endpoint. The purpose is to provide current and secure software versions.

Legal basis: Art. 6(1)(b) GDPR and/or Art. 6(1)(f) GDPR.
Third country: processing may take place in the USA. Cloudflare provides appropriate safeguards (including Standard Contractual Clauses).

12. Your rights

You have the following rights, where the statutory conditions are met:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent (Art. 7(3) GDPR), in particular for usage statistics via Settings → Usage statistics and for the macOS waitlist by email
  • Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

To exercise your rights, an email to [email protected] is sufficient.

You may also lodge a complaint with a data protection supervisory authority.

13. Data security

We take appropriate technical and organizational measures to protect personal data, including encrypted transmission (HTTPS/TLS) between the app or website and our servers (e.g. license, waitlist and usage-statistics endpoints). Notion content for the graph view is processed locally on your device. Payment data are processed by the payment provider and not stored by us.

14. Changes

We update this policy when the website, the app or the services we use change. The current version is always available at this URL.