What ORBLINK does, and what it does not

Identity

An identity created on the device

The first time you open ORBLINK it generates a signing key inside the phone's secure hardware. The private half never leaves that hardware — not to our servers, not into a backup, not to us on request. Every signature requires a fresh biometric or passcode authentication. From the public half the app derives a stable identifier, so other people can recognise you across conversations and devices you have authorised.

Proving addresses you control

You can attach proofs to that identity, a step at a time: an email address, then a phone number confirmed by a code sent to it. Nothing is assumed from an address you have not proven. When the app needs to look you up in the shared directory it sends a SHA-256 hash of the address, not the address.

Being findable — only if you choose

A directory listing is opt-in. If you publish one, other people can find you by the name you chose to publish. If you do not, you are reachable only by invitation. You can remove a listing again.

An identity check, if you want one

For a stronger level of assurance you can run an identity check: you photograph an identity document and your face, and our verification provider performs the check. The images are handled by that provider for the purpose of the check — they are not sealed message content, and the Privacy Policy says so in those words. What comes back is a result, and your phone turns it into a credential you hold.

The point of doing it that way is what happens next. Afterwards you can prove a single fact — that you are over 18, that you are resident somewhere — and the party asking receives a yes or a no rather than a copy of your documents. The check is optional, it is a paid feature, and ORBLINK works without it.

Your Passport

The Passport is the on-device record of what you have proven about yourself. It is assembled on your phone from sealed parts. It is not a profile on a server and there is no version of it we can read.

Communication

Adding people

You connect by invitation: a link you can send over any channel, or a QR code the other phone scans. The invitation's secret rides in the fragment of the link — the part a browser never transmits — so it stays on the two devices even though the link points at a web address. Once paired, both phones can show a safety number you can read out loud to each other to confirm there is nobody in the middle.

Sealed messages

One-to-one messaging is end-to-end encrypted. Every conversation is its own cryptographic group under the Messaging Layer Security standard (RFC 9420), which is what gives it forward secrecy and clean key rotation. The relay stores a sequence number, a blob of ciphertext and an expiry time. It holds no key.

Attachments

Photos, files and voice notes are encrypted on the device before they are uploaded, and stored addressed by the hash of the ciphertext — so the storage layer never learns anything about the content, including whether two people sent the same file. Attachments are limited to roughly 25 MB each.

Disappearing by agreement

Retention is set per contact, and the shorter of the two settings wins. You cannot be opted into keeping a conversation longer than you chose.

Voice and video calls

Encrypted voice and video calls, one to one or in a group, with speaker and camera handled at the operating-system level.

Groups

Create a group for family, friends or work. Group chats, group voice calls and group video calls are sealed the same way as one-to-one conversations.

Recovery

A menu, not a ladder

An identity that exists only in one phone is lost with that phone, so ORBLINK ships a recovery vault rather than a single rescue trick: a recovery phrase you write down, a backup sealed under a passphrase you choose, and the option to split the secret so that no single holder of a share can use it alone.

There is no custodial fallback and that is a design decision rather than an omission. We hold no master key and no override, because a door we can open for you is a door we can be compelled to open against you. The consequence is real and you should know it before you rely on the app: if you lose every recovery route you chose, we cannot restore your identity for you.

Payments

Proof, not data

ORBLINK does not become your card. When you pay a merchant, your own wallet — Google Wallet or Samsung Wallet, for instance — and the merchant's own checkout handle the payment instrument. ORBLINK never sees or stores a card number.

What ORBLINK adds is the sealed proof that accompanies the payment: that the person authorising it is the verified person, and that they authorised exactly the amount shown on screen. A merchant who needs to know you qualify — old enough, resident in the right place, paid up — gets that answer without receiving the underlying data. One confirmation covers the proof and the payment, and nothing is sent until you confirm.

Subscriptions and the identity check are billed through the app store, which handles the payment; we never receive your card details. The app may remember a short label such as "Visa ••1234" on your device so you do not have to pick the same card twice. That label is text. It cannot be used to pay.

The footprint check

The footprint check shows you how much of your own information can be assembled from nothing but your phone number, by anyone, in seconds, for a few cents. It is there to make an abstract risk concrete — and then to offer the tools that reduce it.

It is not a people-search tool and the guard is structural rather than a policy we promise to follow: every request carries an attestation issued after you proved you own that address, and the service refuses the request if the attestation does not match the address being looked up. There is no code path that looks up an address the caller has not proven they own.

Everything else worth stating

• Twenty languages, including two written right-to-left.
• No analytics, crash-reporting or attribution SDK of any kind. No Sentry, no Firebase Analytics, no Crashlytics, no Amplitude, Mixpanel, Segment, PostHog, AppsFlyer, Adjust or Meta SDK. Every dependency in the build is functional.
• No advertising identifier and no ad network. There is nothing in the app that tracks you across other apps or sites.
• No contacts permission. Your address book is never uploaded.
• No location permission of any kind.
• Bundled fonts. The typefaces ship inside the app, so running it does not call out to a font service.
• Reporting. You can report abuse from inside the app.

Availability

Questions about any line on this page are welcome, and they are the kind we like — ask us.