ORBITPrivacy Policy
This explains what Orbit Software LLC ("ORBIT", "we") collects, why, who else sees it, and what you can do about it.
THE SHORT VERSION
Most of your data never reaches us. ORBIT runs on your computer. Your charts, trades, journal, labels, settings and — importantly — your broker and market data credentials stay on your machine. We do not have a copy.
We never see your card. Payments go through Stripe. We receive confirmation that you paid and an identifier, never your card number.
We do not sell your personal information. Not to anyone, for anything.
We never receive your market data. No server of ours takes in, stores or relays quotes, bars or depth from your data provider.
1. WHAT WE COLLECT
Things you give us
| What | When | Why |
|---|---|---|
| Email address | Signup, waitlist | Your account, receipts, service notices |
| Username | Signup | Identifying your account |
| Password | Signup | Stored only as a salted hash — we cannot read it |
| Name, billing address | Checkout | Held by Stripe, not by us |
| Free-text answers | Waitlist form | Understanding what to build |
| Your consent, and which version of these terms you agreed to | Waitlist form, signup | Proving that consent was actually given, and to what wording |
| Support messages | When you write | Answering you |
Things collected automatically
| What | Why |
|---|---|
| Device identifier | Enforcing the two-device limit. It is a one-way hash of hardware characteristics — not a serial number, not your name, and it cannot be reversed into anything identifying |
| Device name and OS | So you can recognise your own machines in a device list |
| Subscription status and dates | Deciding whether your access is current |
| Last-seen timestamp per device | Showing you which device is which |
| Website analytics | Understanding traffic — see the section below, which explains exactly what this is |
Website analytics, in full
We measure our own website. We do it ourselves, on our own servers, and we do not use Google Analytics, advertising pixels, or any third-party tracking service. Specifically:
- We set no cookies on visitors. There is nothing to consent to, which is why this site has no cookie banner.
- We never store your IP address. To count visitors without identifying them, your IP address and browser user-agent are combined with a secret that changes every day and turned into a one-way hash. That is enough to say "412 people visited" and not enough to say who any of them were. Because the daily secret changes, yesterday's hashes cannot be matched against today's — we cannot follow the same person from one day to the next, by design.
- What is recorded: which pages were viewed, the referring site, any campaign tag in the link you clicked, how far down a page people scrolled, which links and buttons were clicked, roughly how long the page was open, your country (from Cloudflare, at country level only), and whether the browser was a phone, tablet or desktop.
- What is not: your name, your email (unless you type it into a form), your IP address, your precise location, anything about other sites you visit, and anything at all from inside the ORBIT application.
- We honour Do Not Track. If your browser sends that signal, the analytics script stops before it records anything.
Things we do NOT collect
- Your trading data. Positions, orders, P&L, journal entries, chart drawings and training labels are written to your own disk. We have no copy and no way to obtain one.
- Your broker or market data credentials. Entered on your machine, stored in your own local configuration.
- Your market data. It flows from your provider to your computer. It does not pass through us.
- Your card number. Stripe handles it; we never receive it.
2. WHY WE USE IT
- To provide the Service and keep your account working
- To take payment and send receipts
- To enforce the device limit and subscription status
- To send service messages — payment failures, security notices, significant changes. These are not marketing and you cannot opt out of them while you hold an account.
- To send product news, only if you asked for it. Unsubscribe any time.
- To answer support requests
- To detect and prevent fraud and abuse
- To comply with law
We do not use your information for automated decisions with legal effects.
3. WHO ELSE SEES IT
We use a small number of providers. Each sees only what it needs.
| Provider | What it gets | What it does |
|---|---|---|
| Stripe | Email, name, billing address, card details | Payments and subscriptions. Stripe is a PCI-compliant processor with its own privacy policy |
| Google Workspace | Email you send us | Our email |
| Cloudflare | IP address and request data for site visits | Hosting and protection for tradeonorbit.com |
| FormSubmit | Waitlist form submissions | Relays signup forms to us by email. Being replaced by our own endpoint; see section 9 |
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We may disclose information if legally required, to protect our rights or someone's safety, or as part of a merger or sale of the business — in which case you will be told before your information moves.
4. HOW LONG WE KEEP IT
- Account information: while your account exists, then up to 12 months, then deleted
- Payment records: as long as tax and accounting law requires, typically 7 years
- Waitlist entries: until you ask to be removed, or 24 months of no contact
- Support messages: 24 months
- Device records: until you release the device or close the account
5. YOUR RIGHTS
Wherever you live, you may ask us to:
- Tell you what we hold about you
- Correct anything wrong
- Delete it (subject to records we must keep by law)
- Send you a copy in a portable format
- Stop marketing — instantly, via any unsubscribe link
Email privacy@tradeonorbit.com. We respond within 30 days, and we will not treat you worse for asking.
If you are in California, you have these rights under the CCPA/CPRA, including the right to know what is collected and shared and the right to opt out of sale — we do not sell, so there is nothing to opt out of.
If you are in the EEA or UK, our lawful bases are: performing our contract with you (account and subscription), legitimate interests (security, fraud prevention, improving the product), consent (marketing), and legal obligation (tax records). You may object to processing based on legitimate interests, withdraw consent at any time, and complain to your data protection authority.
6. SECURITY
Passwords are stored as salted PBKDF2 hashes — we cannot read them, and neither can anyone who obtains the database. Sessions use short-lived signed tokens rather than storing your password. Traffic is encrypted in transit. Access to production systems is limited.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information we will tell you and the relevant authorities as the law requires.
The strongest protection here is structural: most of your sensitive data never leaves your computer, so most of it cannot be exposed by any breach of ours.
7. CHILDREN
The Service is for people 18 and over. We do not knowingly collect information from children. If we learn we have, we delete it.
8. INTERNATIONAL
We operate from the United States. If you use the Service from elsewhere, your information is processed in the US, which may have different data protection law than your country. Where required, we use appropriate safeguards for transfers.
9. CHANGES
We may update this policy. Material changes get 30 days' notice by email or in the app before taking effect, and the "last updated" date always reflects the current version.
Known upcoming change: waitlist signups currently reach us through FormSubmit, a third-party email relay. We are moving them to our own endpoint so that data no longer passes through a third party. This policy will be updated when that is complete.
10. CONTACT
Orbit Software LLC 281 W Lake Road, Hattiesburg, MS 39402, United States privacy@tradeonorbit.com