Orbities
Sign inJoin beta
Legal

Privacy policy

Orbities knows where your family is. That is an unusual amount of trust, so this page is specific: what we collect, how long each thing is kept, and who can see it — including where we have not finished the job yet.

Last updated 24 September 2026

Who we are

Orbities is operated by 180 Degrees IT Solutions Pty Ltd, in Queensland, Australia. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Your data is stored on servers in Brisbane, Queensland. Some service providers that help run Orbities are located overseas or run global networks. They are listed under “Who else touches it”, with what each one receives.

The short version

We do not sell your data, and there is no arrangement under which we could.
We have no advertising product, no data-broker relationship and no analytics partner with access to location. Our business model is subscriptions. Selling location data would require building something we have not built.
Orbities staff tools cannot read your family's location.
Staff accounts connect through a database role that has no permission on the location tables, so the query fails rather than relying on staff not looking. Direct access to the servers and backups is limited to the engineers who operate them, and is used only to keep the service running.
Everything that reads your location is written down, and you can read that log.
Every view of a position is recorded in an append-only, hash-chained audit log, including views by other members of your own circle. Privacy → Who has looked shows it to you.

What we collect

Only what a family safety product needs to work. Each item below exists because a feature would not function without it.

Account
Email address or username, display name, optional phone number, optional date of birth, time zone and language.
Date of birth is used for an age band, which changes what a minor can be asked to share. The date itself is not shown to other members.
Profile photo (optional)
If you choose one, it is resized on your phone and stored on our servers so your circle can see it. You can remove it at any time.
Location
Position, accuracy, altitude, speed and heading, whether you appear to be moving, and battery level, recorded in the foreground and in the background while sharing is on.
Accuracy and confidence are stored with every position because a location without them is a claim without evidence. From these positions the service also builds your trips, stops, daily summaries and place arrivals.
Places
Places your circle saves, such as Home or School, with their names and addresses.
Device health
Which permissions are granted, battery level and charging state, whether power saving or airplane mode is on, location accuracy, network type, the phone's manufacturer and its background-app setting, which app version and update is running, and the error message from the last time the app crashed.
This is what lets Orbities say why a phone stopped reporting instead of showing a stale dot.
Devices and sessions
Platform, model, OS version, app version, an installation identifier and a notification token.
So Sessions & devices can say “Pixel 9” rather than “a device”, so notifications reach the right phone, and so you can end a session you do not recognise.
Messages you send in Orbities
The text, and a position only if you choose to attach one. Messages stop being shown 30 days after they are sent. A note pinned to the circle board stays until the expiry its author set, or until the author removes it.
Safety features
SOS alerts, safety timers, check-ins, journeys and pickup requests you start, with the position they relate to.
Medical card (optional)
Blood type, allergies, conditions, medications and notes that you enter for use in an emergency. This is health information. We collect it only because you type it in, and you can clear it at any time. Everyone currently in a circle with you can read it.
The card has a “Show on my lock screen” setting. It is saved with the card, but Orbities does not currently put the card on your phone's lock screen.
Emergency contacts
Names and phone numbers or email addresses of the people you list. Please tell them you have added them. They are deleted when you remove them or close your account.
Driving
Trip start and end, speed, harsh events, crash detection and learner-driver logbook entries, when driving features are switched on.
Screen time (Android only, optional)
Per-app daily totals, meaning app names and minutes, never the content, when the phone's holder turns on Usage Access. A parent or guardian in the circle can see these totals only for members under 16. Adults' totals are visible only to themselves.
On iPhone, Orbities can apply app limits through Apple's Screen Time controls, but it does not receive any usage information.
Contact matching (optional, on your phone)
If you turn on contact photos, Orbities reads your phone's contacts on the phone to find the people in your circle and show the photo you already have for them. Contacts are not uploaded. To make the match, the server sends each circle member's phone number to your phone as a shortened one-way hash, never as the number itself.
Turning the setting off deletes the matched photos from the phone.
Security records
Sign-in attempts, with the IP address stored as a one-way hash rather than the address itself.
Server logs
Our servers keep technical logs of requests, including IP addresses and the address searches you make, to operate and secure the service.
We have not yet set a fixed period after which these logs are deleted.

What we do not collect: call content, your contacts, browsing content, or microphone or camera recordings. The camera is used only to read a set-up QR code. The image stays on your phone and only the code is used.

How long we keep it

Some kinds of data are deleted automatically by scheduled jobs. Others do not have an automatic deletion job yet, and rather than quote a window nothing enforces, we say what actually happens to them today. Signed-in members can see the windows we have set under Privacy → What we keep; where that screen and this page differ, this page describes what happens now.

400 days: raw positions
Every recorded position, with its accuracy and speed. After 400 days a scheduled database job deletes it.
120 days: who viewed a location
Hour-level records of who viewed a location, deleted by a scheduled job.
The detailed view caps at 90 days, and weekly summaries are kept, so older hour buckets answer no question the product asks.
90 days: device health reports and integration logs
Battery, permission and connection reports from your phone, and the log of what connected integrations read, each deleted by a scheduled job.
30 days after it ends: a signed-in session
Session records are deleted 30 days after the session expires.
Until you delete them or close your account
Trips, stops, coverage gaps and daily summaries built from your positions; drives, journeys and check-ins; SOS and safety-timer records; per-app screen-time totals; places you have visited before; your feedback on alerts; account-recovery attempts; messages sent to you; your medical card and emergency contacts.
These are not yet removed on a schedule. You can delete any date range of your location history yourself with Delete history, in the app or on the website, and closing your account erases them.
Messages you sent
Hidden from everyone 30 days after they are sent (board notes, when they expire), but not yet deleted from our database on a schedule.
Closing your account does not remove messages you sent to other members; see “Delete your account” below.
Not yet deleted automatically
Learner-driver logbook entries, records of who was together with whom, scans of a lost-item tag (with the finder's approximate suburb), and hourly and daily summaries of how well a phone reported (counts, accuracy, battery levels and top speed, no positions).
Closing your account does not currently remove these; they stop being linked to your name. Write to us to have them deleted. Logbook entries are kept deliberately: a logbook may be produced to a licensing authority long after the licence was granted, so we intend to keep them for at least seven years.

Who can see it

Within your circle, what each person can see is set per viewer and per subject — not per circle. A grandparent can be given a suburb where a parent sees an exact address, and the person being viewed can see that setting from their own side.

A minor's privacy screen is theirs. A parent cannot open it, by design: a product that lets a parent read a teenager's private settings has simply moved the surveillance one level up.

Location sharing outside the circle is always time-limited. A link to a babysitter or a friend's parent carries an expiry that cannot be removed, because temporary sharing that never expires is permanent tracking wearing a temporary name.

Who else touches it

These services receive the information described below to provide the requested feature.

Cloudflare (network and backups)
Every connection between the app or website and our servers passes through Cloudflare's network, which protects the service and routes traffic to Brisbane. Cloudflare processes that traffic, including location updates, while delivering it.
Nightly database backups are stored in Cloudflare R2, Cloudflare's storage service, which may hold them outside Australia.
Expo (app updates and notifications)
Orbities is built with Expo. When the app opens it checks Expo's servers for updates, which gives Expo your device's IP address and app version. Notifications are sent through Expo's push service to Apple or Google, who deliver them to your phone.
A notification contains what you see on screen: a person's name and, for place alerts, the name of a saved Place such as “School”. It never contains coordinates.
The map (Google)
Maps in the app and on the website are drawn by Google. Your device requests map images directly from Google, so Google receives your device's IP address and the area of the map being shown, under its own privacy policy. Family markers are drawn by your device and are not sent to Google as map requests.
Orbities stopped serving its own map tiles on 22 September 2026. We made the trade for one reason: our own aerial imagery could only resolve a building across NSW and the ACT.
Address search
Address and business searches use Google Places and Geocoding. When you view an unnamed live location, trip endpoint or history stop, Orbities may send that coordinate to Google to look up its address or a public venue. Saved family Place names take priority; we do not send every tracking update for an address lookup.
Lookups go through our server with the search text or coordinate, without your Orbities account identity or device IP address. Google processes this information under its own terms and privacy policy. If Google is unavailable or a usage limit is reached, the location pin and saved family Places remain available; we do not substitute another map-data provider. Venue response content is not stored in a shared database. Permitted place IDs and account-isolated address records may be retained with expiry.
Integrations you connect
If a circle admin connects another service, such as a home-automation system, through Orbities' API or webhooks, that service receives only what each member has individually agreed to share with it, by default “at a Place” rather than coordinates.
Every read through the API is logged, kept for 90 days, and shown to you.

Google Privacy Policy · Google Maps terms

Paid plans are not yet on sale. When they are, this section will name the payment provider before any payment is taken.

What you can do

Most of these work in the app and on the website without contacting us. The one that does not yet is an export of your data.

See what we hold
A plain-language summary of every category of data held about you.
Take it with you
Email [email protected] and we will send an export of your data in a machine-readable format within 30 days. A self-service export in the app is being built.
See who looked
Every view of your location, by whom and when, including views by your own family.
Correct it
Change anything wrong in your account or your places.
Delete history
Delete any date range of your location history — positions, trips, stops and daily summaries — without closing your account.

Delete your account

In the app: You → Delete my account. On the website: sign in, then Account → Delete my account. Both ask for your password (or an authenticator code) before anything happens. The steps, with or without the app, are also at orbities.com.au/delete-account.

Deleting stops all sharing, in both directions, and signs you out everywhere straight away. Your account is then held for 30 days in case you change your mind. Signing in during that time cancels the deletion; sharing you had stays off until you choose to share again.

When the 30 days are up, your name, email address, phone number and username are removed and you leave every circle. Within a few hours after that, we erase your positions, trips, stops, device reports, messages sent to you, medical card, emergency contacts, screen time, safety records and the other records marked “until you close your account” above.

Some records are kept, and we say so plainly:

  • The audit log is append-only and hash-chained, so it cannot be edited. Its entries stay, but are no longer linked to your name, and the positions in shared events are removed.
  • Messages you sent to other members stay in their conversation, shown as from “Deleted account”, with any position you attached.
  • An anonymised placeholder for the account is kept so shared history still makes sense. At present it still holds your date of birth and profile photo if you gave them. Remove the photo before deleting, or write to us and we will remove both.
  • The records listed under “Not yet deleted automatically” above.
  • Billing records, for the period Australian tax law requires.
  • Our nightly database backups. Erasure does not reach them, so erased data remains in a backup until that backup is deleted.

If you cannot sign in, email [email protected] from the address on the account.

Children

Orbities is built to be used by families including children, and a child's account is set up by a parent. Age changes what the product asks for: a minor is not offered features that would collect more than their age band allows, and the amount of autonomy grows as they get older rather than switching on at a birthday.

A parent or guardian sets up a child's place in the circle, and agrees to this policy on the child's behalf. Orbities uses the date of birth the parent enters to place the child in an age band (under 10, 10–12, 13–15, 16–17). The band decides what can be asked of them. For example, a guardian can see per-app screen time only for members under 16. If no date of birth is entered, no age band applies.

We collect the same kinds of information from a child as from an adult, as described above, and we do not use a child's information for advertising or share it with anyone for marketing. A child set up with a device code has no password of their own: a parent or circle administrator can remove them, which stops all sharing, and a parent can ask us to erase the child's data by writing to [email protected] from the parent's account email.

A child can always see what is being shared about them and who is looking. A tracker a child cannot inspect is something else.

If something goes wrong

If there is a data breach likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

To raise a privacy concern, write to [email protected]. If we have not resolved it to your satisfaction, you can complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints.

Changes to this policy

If we change what we collect or how long we keep it, we update this page and the date at the top. We intend to tell you in the app before such a change takes effect; that in-app notice is not built yet, so for now this page is where changes appear. A policy that changes quietly is not a policy.

24 September 2026: rewritten to describe what the service does today. Added how long positions are kept and which data has no automatic deletion yet; profile photos, messages, the medical card, emergency contacts, phone numbers and contact matching; Cloudflare, Expo and integrations as services that receive data; server logs; how account deletion works and what it keeps; and age bands for children. Removed browsing and call records, which the app does not collect, and the claim that exports need no email.