1. Controller and Contact
Orbitarium is operated by the project owner, who acts as controller for the processing described in this policy. Privacy and data protection requests may be sent to hello@orbitarium.io. Additional controller details will be provided where required by applicable law or a written commercial agreement.
2. Scope and Summary
This policy explains how Orbitarium handles personal data in the public landing page, browser App, shared Player links, authentication flow, local browser storage, infrastructure, and email contact. Orbitarium is designed to keep most scene data local to your browser unless you choose to share or publish a Scene Program link.
We do not maintain a general user-profile database. Some personal data may still be processed by authentication, hosting, infrastructure, email, and browser storage systems as described below.
3. Data We Process
| Category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Google Sign-In credential, activation token, and displayed profile data | Verify sign-in, issue activation, and show signed-in UI state | Contract or pre-contract steps; legitimate interests in account security | Token expires after 30 days; profile data is stored locally and cleared when you sign out or clear browser data |
| Google Analytics and Cloudflare Web Analytics measurements, including page hostname and path, referrer, browser and device information, approximate location, session activity, and page performance; Google Analytics also uses browser identifiers stored in analytics cookies | Measure usage, returning browsers, sessions, and performance across the Landing, App, and Player. Google page locations and referrers omit query strings and fragments. Scene Programs, scene names, account profile fields, and Engine state are not supplied as analytics event fields. Advertising storage, Google Signals, and ad personalization are disabled | Legitimate interests in understanding and improving the Service where permitted; another lawful basis where required by applicable law | According to the Google Analytics property and Cloudflare Web Analytics retention settings and any shorter period required by law |
| Local browser storage, including localStorage, sessionStorage, and browser cache, plus preferences, undo history, performance settings, and local scenes | Provide app functionality, restore settings, preserve local work, and improve performance | Contract or pre-contract steps; legitimate interests in operating the app | Until you clear browser data, use the cache-clear button, sign out, or the browser removes storage |
| Shared scene links, Player payloads, scene names, colors, settings, and URL data | Render shared scenes and allow others with the link to view or remix them | Your action to share the link; contract or legitimate interests in providing sharing features | The complete Scene Program payload is embedded in the URL and remains wherever that URL is copied, messaged, logged, bookmarked, or otherwise retained; Orbitarium does not upload or store it for the link |
| Security, hosting, CDN, and infrastructure logs such as IP address, user agent, timestamps, request metadata, and abuse signals | Operate, secure, debug, prevent abuse, investigate incidents, and protect users and infrastructure | Legitimate interests in security and service operation; legal obligation where applicable | According to hosting, CDN, security, and log-retention settings, or longer if needed for abuse investigation or legal claims |
| Email messages and contact details you send to us | Respond to questions, proposals, support, legal requests, and security reports | Pre-contract steps, contract, consent, legitimate interests, or legal obligation depending on the request | As long as needed to respond, manage the relationship, resolve disputes, comply with law, or protect legal rights |
4. Cookies and Local Storage
Orbitarium loads Google Analytics and Cloudflare Web Analytics on its production pages after readiness. Google Analytics uses analytics cookies to recognize a browser and its sessions across our product subdomains. Cloudflare Web Analytics does not use analytics cookies. Advertising features are disabled. The App also uses local browser storage for preferences, authentication state, local scenes, and cache management.
To disable both analytics providers for a visit, add noanalytics=1 to the page query string before opening it. Browser privacy settings and content blockers may also prevent analytics collection.
You can limit cookies and local storage through your browser settings, but some App features may stop working if storage is disabled.
5. Processors and Third-Party Services
Orbitarium may use service providers to host, protect, authenticate, measure, deliver, or communicate about the Service. Current categories include browser vendors, Cloudflare hosting/CDN and Web Analytics, Google Sign-In, browser Google Analytics measurement, email providers, custom-model hosts you explicitly select, and providers used for paid custom work if you request it.
These providers process data under their own terms and privacy policies. We do not sell personal data.
6. International Transfers
Service providers may process data in countries other than your own, including the United States and the European Economic Area. Where required, transfers should rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, provider data-processing terms, or other lawful transfer mechanisms.
7. Data Sharing
We do not sell or rent personal information. We may share or disclose data when needed to operate the Service, process authentication, provide support, investigate abuse or security incidents, comply with law, enforce our Terms, protect rights and safety, or complete a business transfer such as a merger, acquisition, or asset sale.
8. Your Rights
Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with a data protection authority.
Most Orbitarium data is stored locally in your browser. You can sign out, use the cache-clear button, clear browser storage, or request assistance at hello@orbitarium.io. We may need to verify your request before acting on it.
9. Children
Orbitarium is not intended for children under 13 and does not knowingly collect personal information from children. If you believe a child provided personal data, contact us so we can take appropriate action.
10. Security
We use reasonable technical and organizational measures designed to protect Orbitarium and the limited data described in this policy. No internet service, browser storage mechanism, or WebGPU application can be guaranteed to be completely secure.
If you believe you found a vulnerability, report it to hello@orbitarium.io. Do not include other people's personal data, secrets, tokens, or exploit payloads in the report unless they are necessary to understand the issue.
11. Third-Party Privacy Policies
- Google Sign-In - Google Privacy Policy
- Google Analytics - How Google uses information from partner sites
- Cloudflare hosting, CDN, and Web Analytics - Cloudflare Privacy Policy
12. Changes to This Policy
We may update this Privacy Policy as Orbitarium changes. If material changes affect how personal data is processed, we will update the effective date and provide notice or request consent where required by law.
13. Contact
For questions about this policy or your data, contact us at hello@orbitarium.io.