Privacy policy

1. Controller and contact

The controller is Zetsukae (Alexis D'Angelo), an independent operator based in Switzerland. Contact: contact@zetsukae.com. The operator's postal address is available on request by email. See the Legal Notice.

EU representative: The operator is based in Switzerland. No EU representative is currently listed. If you have questions about personal data, contact the operator directly using the details above.

2. Data processed

• Account and authentication: email address, username, password credentials handled by Supabase Auth, account and email-confirmation status, and authentication or password-recovery events.
• Terms record: the accepted Terms version and acceptance timestamp, stored with signup metadata.
• Profile: account identifier, username, avatar, role, verification and badge status, and account timestamps.
• Community content: messages, replies, drawings/images, poll options, votes, and related timestamps. Usernames, messages, images, and aggregate vote results may be visible publicly. Individual vote records are used internally and are not intended to identify voters publicly.
• Safety and moderation: reports and their details, blocks, moderation reasons and dates, audit events, and administrator notes. These records are restricted to relevant account holders or authorized moderators/administrators as described by the service.
• Support and requests: information included in emails or other communications you send to the operator.
• Technical data: hosting, authentication, database, network, and security providers may process IP addresses, browser/device information, request logs, and security events. The operator does not currently operate a separate analytics service.

Please do not include sensitive personal information in public posts. Orbit is not designed for special-category data or confidential communications.

3. Purposes and legal grounds

Data is used to create and operate accounts; authenticate users; display and moderate community content; provide replies, polls, and voting; store profile images and drawings; respond to reports and support requests; prevent abuse and protect service integrity; maintain backups and security; and meet legal obligations or establish, exercise, or defend legal claims.

Where GDPR applies, the relevant legal ground is generally performance of the service contract (Article 6(1)(b)), legitimate interests in operating a safe community and protecting the service (Article 6(1)(f)), or compliance with a legal obligation (Article 6(1)(c)). Consent is used where legally required for an optional technology or activity. Under Swiss law, processing is assessed under the FADP and applicable personality-rights rules. The exact ground depends on the processing and circumstances.

4. Public content

Messages, replies, usernames, avatars, drawings, and poll results can be shown to visitors, including people who are not signed in. Public content may be copied or indexed by third parties outside the operator's control. Reports, account emails, private notes, and individual voter identities are not intended to be public.

5. Providers and recipients

• Supabase: authentication, database, realtime services, and object storage. The project region supplied by the operator is West EU (Ireland). Supabase may also use subprocessors; consult its current privacy and subprocessor information.
• Vercel: website hosting, delivery, and server-side functions, including username sign-in and recovery. Vercel may process request and security logs.
• Google Fonts: font files are requested from Google when pages that use those fonts load.
• Ko-fi: the support widget is loaded from Ko-fi on the home page. Ko-fi and its providers may receive technical information when the page/widget loads or is used, and may set or read their own browser storage.

Providers process data under their own terms and, where applicable, contractual data-processing terms. Data may also be disclosed to authorities, advisers, or other parties when legally required or necessary to protect people, rights, or the service.

6. International transfers

The primary Supabase project region is West EU (Ireland), as configured by the operator. Vercel, Google, Ko-fi, and provider subprocessors may process data in Switzerland, the EEA, or other countries depending on their services and configuration. Where a transfer requires a legal safeguard, the relevant provider arrangements may include an adequacy decision or approved standard contractual clauses. Contact the operator for information about safeguards applying to a particular transfer.

7. Retention and deletion

• Messages older than two days that do not meet either configured vote threshold are scheduled for hourly cleanup.
• When an account is deleted, its username is anonymized and its authored messages are scheduled for deletion after two days. Votes and reports submitted by the account are deleted as part of the account-deletion flow.
• The email address is retained in a restricted deletion-cooldown table for one week to prevent immediate account recreation with the same email.
• Some moderation/audit records, public uploaded files, provider logs, and backups may persist after account or content deletion. The application does not currently publish a fixed deletion schedule for all such copies; they are retained only as configured by the operator/provider and should be reviewed and documented.

Other data is kept only as long as reasonably needed for the purposes above, legal obligations, security, or claims. Provider logs and backups follow the retention schedules and settings of the relevant providers.

8. Cookies and local storage

The app uses browser storage for the Supabase authentication session, theme and display preferences, tutorial settings, and temporary notices. These technologies support sign-in, security, or preferences. Pages that use Google Fonts request font files from Google. The home page loads the third-party Ko-fi support widget automatically; Ko-fi receives technical request data and may use its own storage. No separate consent prompt is currently shown for Google Fonts or Ko-fi. No separate advertising or analytics tool is currently configured by the operator.

9. Your rights

Depending on the law that applies, you may request information/access, correction, deletion, restriction of processing, data portability, or object to certain processing. Where processing is based on consent, you may withdraw it for the future. You may also complain to a competent supervisory authority. In Switzerland, the authority is the Federal Data Protection and Information Commissioner (FDPIC: edoeb.admin.ch). If GDPR applies, you may complain to a competent EU/EEA supervisory authority, including in your habitual residence, workplace, or the place of an alleged infringement.

Send requests to contact@zetsukae.com. We may ask for reasonable information to verify your identity. We aim to respond within the time required by applicable law. Some information may be retained where a legal exception applies or deletion would affect other users' legitimate rights.

10. Children

Orbit is not intended for children under 16. If you believe a child has provided personal data, contact the operator so the matter can be reviewed and appropriate action taken.

11. Security and changes

Reasonable technical and organizational measures are used to protect data, but no online service can guarantee absolute security. This policy may be updated when the service, providers, or legal requirements change. The current version and its effective date will be posted here.