Privacy Policy

Who we are

ORBLINK is published by ORBLINK Ltd. Liability Company, a limited liability company formed in the State of Wyoming, United States. We are the data controller for the processing described here. You can reach us about privacy at privacy@orbis.id or support@orbis.id.

What stays on your phone

Most of what ORBLINK knows about you never goes anywhere. Held on the device, in sealed storage, and not in any account we can read:

• Your identity's private key, which is generated inside the phone's secure hardware and cannot be exported from it.
• Your message history, your attachments and your call history.
• Your Passport — the record of what you have proven about yourself — and the credentials behind it.
• Your contacts within ORBLINK and your per-contact settings.
• Any recovery material you created, sealed under a phrase or passphrase only you hold.
• The short label of a card you chose, such as "Visa ••1234", if you asked the app to remember it.

Deleting the app removes all of it. We cannot recover it for you, because we never had it.

What leaves your phone, and where it goes

ORBLINK talks to two of our own services and nothing else: an identity service and a relay. This is the complete list of what travels.

Your phone number or email address — in the clear

Sent to our identity service when you ask to prove an address, because a verification code has to be delivered to it. A phone number is passed to our SMS provider, Twilio, for that delivery.

Directory lookups — hashed

When the app looks someone up, it sends a SHA-256 hash of the address, never the address itself.

Your published name — only if you publish one

A directory listing is optional. If you create one, the name you chose is held so other people can find you. You can delete the listing.

Identity document and face images — in the clear, only if you ask for a check

If you choose to run an identity check, the photographs of your document and your face are sent through our identity service to our verification provider, DIDIT, which performs the check and returns a result. These images are not end-to-end encrypted message content: the provider necessarily sees them in order to check them. This is the heaviest disclosure in the product and we would rather you read it here than discover it.

Message content, files, photos and voice notes — ciphertext only

Encrypted on your device before they are sent. The relay stores a sequence number, a blob of ciphertext and an expiry time, and blobs are addressed by the hash of the ciphertext. We hold no key and can read none of it.

Footprint lookups — your own proven address only

If you run the footprint check, the address being checked is sent to open-source intelligence services so the result can be assembled. Every request carries an attestation proving you own that address, and the service refuses anything else. There is no path through this feature to look up another person.

Network metadata — unavoidable

Like any internet service, our relay sees the IP address a connection came from, when it happened, and how large it was. It does not see what was said.

Identity verification, in more detail

If you choose to verify your identity, the check is performed by our verification provider, DIDIT. You photograph your identity document and your face, and those images are sent to DIDIT to perform the check. DIDIT returns a result, and your phone turns that result into a credential that you hold.

The purpose of this design is that afterwards you can prove a fact about yourself — that you are over 18, for example — without handing anyone your documents again. Services that ask receive a yes or a no, not your data.

Verification is optional. You can use ORBLINK without it. You can also ask us to delete the verification session at the provider; the app has a route that does this, and you can ask us to do it for you.

Payments

• ORBLINK never holds or sees your card. When you pay a merchant, your own wallet — such as Google Wallet or Samsung Wallet — and the merchant's own checkout page handle the card. ORBLINK carries only the proof that you authorised the amount you saw.
• Subscriptions and the identity check are billed by the app store. The store handles the payment and we never receive your card details.
• We may store a short label of the card you chose, such as "Visa ••1234", on your device only, so that you do not have to choose it again. That label is text. It is not a card number and cannot be used to pay.

What we do not do

• No analytics, crash-reporting or attribution SDK of any kind is present in the app. Every dependency in the build is functional.
• No advertising identifier, no ad network, no data broker, and no tracking across other apps or websites.
• No access to your address book. ORBLINK does not request the contacts permission and never uploads your contacts.
• No location collection. The app requests no location permission.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Permissions, and why

• Camera — to scan a payment QR code or an invitation code, and to photograph your document and face if you verify your identity.
• Microphone — for calls you place or answer, and for voice notes you record.
• Notifications — to tell you about an incoming call or message.
• Internet — to deliver encrypted messages and to reach the identity service.

How long things are kept

Encrypted messages on the relay carry an expiry and are deleted when it passes; retention is set per contact in the app, and where two people have chosen different periods the shorter one is applied. Proven addresses and any directory listing are kept while your identity exists and are removed when you delete it. Verification images are held by our verification provider for the period its own retention policy requires, and can be deleted on request.

Legal bases, if you are in the EEA or the UK

We process your address to perform the contract you entered when you asked us to verify it, and to provide the service. An identity check and a directory listing are processed on your consent, which you may withdraw. Identity documents and face images are special-category data where applicable, and we process them only on your explicit consent, for the single purpose of the check you asked for. We have a legitimate interest in keeping the service secure and in preventing abuse.

International transfers

We are a United States company and our service providers may process data in the United States and elsewhere. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's standard contractual clauses with those providers.

Children

ORBLINK is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the app, write to us and we will delete what we hold.

Your rights, and how to delete your account

Depending on where you live, you may have the right to ask what personal information we hold about you, to have it corrected or deleted, to receive a copy of it, and to object to certain processing. Because of how ORBLINK is built, most of your information is on your device and under your control — deleting the app removes it.

To delete your account and any server-side records — your proven addresses, any directory listing, any verification session — write to support@orbis.id from the address you proved, or use the deletion route inside the app. We will confirm when it is done. You do not need to keep the app installed to make the request.

If you are in the EEA or the UK and you are unhappy with our answer, you may complain to your local data protection authority.

Changes to this policy

If we change what the app does with your information, we will change this page and move the date at the top. Material changes will be announced in the app.

Contact

ORBLINK Ltd. Liability Company — privacy@orbis.id · support@orbis.id. Our company details are on the company page.