Orbit Family ("Orbit," "we," "us," or "our") operates orbitfamily.app — a reward and routine management system for families of children with autism spectrum disorder (ASD/TEA). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data and your children's data.
We built Orbit for families who need a trustworthy, privacy-respecting tool. That means: we collect only what we need, we never sell your data, and we give you full control over your household's information.
When you sign in using Google OAuth, we receive your name, email address, and Google profile picture URL. We use this to identify your account and send you service-related messages.
You create child profiles under your caregiver account. A child profile contains:
We do not collect a child's full legal name, date of birth, email address, phone number, photo, location, school, or any other personally identifying information.
We store tasks, task completions, rewards, and point balance entries associated with your household. This is the core function of the service.
Payment processing for Orbit Pro is handled entirely by Stripe. We never see or store your credit card number. We store only your Stripe customer ID and your current subscription plan status.
Our servers log standard technical data: IP addresses, browser type, referring URLs, and pages visited. We use this to maintain service reliability and diagnose errors. We do not use third-party advertising trackers or behavioral analytics tools.
Orbit is designed as a caregiver-facing tool. Caregiver accounts are held by adults. Children interact only with a supervised child dashboard that operates under a parent's account — they do not create accounts, sign in to Orbit, provide an email address, or communicate through Orbit.
We do not knowingly collect personal information directly from children under 13. The limited data we store about a child profile (a nickname or first name, a hashed PIN, an avatar emoji, and timezone) is provided by and controlled entirely by the adult caregiver.
Parental representation and consent. By creating a child profile, you represent and warrant that you are the parent or legal guardian of that child, that you have the authority to provide consent on the child's behalf, and that you provide verifiable parental consent under COPPA (15 U.S.C. § 6501 et seq.) for Orbit's collection and processing of the limited child profile data described above. Orbit relies on this representation and does not independently verify guardianship, custody, or parental rights.
Parental rights under COPPA. As the caregiver account holder, you may at any time:
If you believe a child profile has been created in Orbit without the consent of the child's parent or legal guardian, please contact hello@orbitfamily.app immediately and we will investigate and, where appropriate, delete the profile.
We do not sell, rent, or trade your personal information to third parties. We share data only with the following service providers who help us operate Orbit:
We may disclose information if required by law, court order, or to protect the rights and safety of our users.
Active accounts: Your data is retained for as long as your account is active.
Account deletion: When you request deletion of your account, we permanently delete all associated caregiver data, child profiles, tasks, rewards, and point entries within 30 days. Stripe may retain billing records independently per their own retention policy.
Server logs: Standard server logs are retained for up to 90 days for security and debugging purposes, then purged.
Our right to delete. We may delete your data, in whole or in part, at any time after account termination, after prolonged inactivity (24 months or more without a successful login), or where we believe deletion is appropriate for operational, legal, safety, or risk-management reasons. Deletion is generally irreversible. You are responsible for exporting or backing up any data you wish to retain before deletion. We are not liable for any loss arising from deletion under this section.
We take reasonable, commercially appropriate measures to protect your information:
No system is 100% secure. While we work in good faith to protect your data, you acknowledge and accept that you provide your data to Orbit at your own risk and that we cannot and do not guarantee against unauthorized access, disclosure, alteration, or loss. To the maximum extent permitted by applicable law, we disclaim liability for any unauthorized access to or use of your data that occurs despite our reasonable security measures.
In the event of a data breach affecting your information, we will notify affected users and applicable regulators where and to the extent required by applicable law (such as state breach-notification statutes, GDPR, or Ley 172-13). If you believe your account has been compromised, contact us immediately at hello@orbitfamily.app.
California residents have the right to know what personal information we collect, request deletion of their data, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact hello@orbitfamily.app.
Residents of the Dominican Republic have rights under Ley No. 172-13 de Protección de Datos de Carácter Personal, including the right to access, rectify, cancel, and object to the processing of their personal data (derechos ARCO). To exercise these rights, please contact us at hello@orbitfamily.app. We will respond within 30 days.
Mexican residents have rights under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), including ARCO rights (Acceso, Rectificación, Cancelación y Oposición) and the right to revoke consent. To exercise these rights, contact hello@orbitfamily.app.
Regardless of where you live, you may contact us at any time to access, correct, or delete your data. We will honor all reasonable requests within 30 days.
Orbit uses only essential session cookies required to keep you logged in and maintain your preferences (such as language selection). We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies that profile your behavior.
Our servers are located in the United States (Google Cloud Platform). If you access Orbit from outside the United States — including from the Dominican Republic, Mexico, or other countries — your data is transferred to and processed in the United States. By using Orbit, you consent to this transfer.
We rely on the terms of our service provider agreements (including Google Cloud's data processing addendum) to ensure appropriate safeguards are in place for international transfers.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 30 days before the new policy takes effect. Continued use of Orbit after the effective date constitutes your acceptance of the updated policy.
The current version of this policy is always available at orbitfamily.app/privacy/.
By creating an Orbit account, completing onboarding, or otherwise using Orbit, you acknowledge that you have read, understood, and agree to this Privacy Policy and to the Terms of Service, and that together they form a binding legal agreement between you and Orbit Family. If you do not agree, do not create an account or use Orbit.
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:
We aim to respond to all privacy-related inquiries within 5 business days.