Privacy Policy

Who is responsible

Quiet Orbit is operated by Zeus Apps B.V., a private limited company registered in the Netherlands. Privacy questions and requests: privacy@quietorbit.org. Everything else: support@quietorbit.org.

Where your information is stored

Quiet Orbit stores your focus activity and preferences on your iPhone. That can include:

• Focus setups and reminder schedules
• Session history, focused time, expedition progress, and findings
• Ship and sound choices
• Private session notes, if you use that Premium feature
• Sessions you flew with friends, with their names and ships as they were at landing
• App settings and onboarding state

There is no Quiet Orbit account. You never create one, and we never hold a username, email address, or password for you.

This information also syncs through iCloud, into your own private CloudKit database. That database belongs to your Apple Account, not to us. We cannot read it, cannot list what it contains, and cannot recover it on your behalf. It exists so your expedition survives a new iPhone. Whether syncing is active on your device is shown in Settings, Your Data, iCloud & Data.

Delete All Quiet Orbit Data, under Settings, Your Data, iCloud & Data, Delete All Data, removes this information from your iPhone and from your private iCloud database. It asks twice, and it ends any running session safely and releases app blocking before it deletes anything. It also deletes the Fly together records your iPhone still has in the shared database (below). Deleting your data does not cancel a subscription.

Fly together

Fly together lets you focus at the same time as up to three friends. It is the one part of Quiet Orbit that shares anything with other people, and only with the friends whose invite you accept or who accept yours. There is no public list of sessions or pilots, and strangers cannot find you.

When you host or join a session, your iPhone writes a few short records to Quiet Orbit's shared database in iCloud, Apple's CloudKit public database for the app. A record can only be found through that session's link or its six-character code. The records hold:

• The plan: when it leaves, how long it lasts and its breaks, its shape, and the world everyone flies to
• Your ship as your friends see it: its class, paints and lights, its name (the bird name it was given, or the name you typed), its registry mark, and two small pictures of it, from behind and from the side
• The name you chose for friends to see, if you set one. It is optional: without it, friends see your ship's name. It is also printed on the picture of the session that you or a friend can share, so anyone that picture is sent to sees it too
• What you are working on, only if you write it in the Working on field when you join. Left empty, nothing is shared
• Your state: waiting, flying, on a break, landed or left, and when it changed

Your friends never see your minutes, your progress, your findings, the apps you block, or why a session ended. A session ended early shows as landed, the same as one you finished.

Apple attaches to each record an identifier for the iCloud account that wrote it. That identifier belongs to Quiet Orbit only, is not your Apple Account name or email address, and is what lets only your iPhone change or delete your records. Writing a record needs iCloud; without it you can still fly along from a friend's link, and they will not see your ship.

Each record expires a day after its session leaves, and your iPhone deletes the records it wrote the next time Quiet Orbit runs after that. Leaving a session before it starts deletes your ship's record at once, and Delete All Quiet Orbit Data deletes every record your iPhone still has there. If you never open Quiet Orbit again after a session, its records can remain until you write to privacy@quietorbit.org and we delete them. As the app's operator we can see this shared database in Apple's developer tools. We do not read it, except to delete a record on request, to act on a report, or to fix a fault.

Names, typed ship names and shared lines are checked against a word list on the iPhone that sends them and again on the iPhones that show them. On a friend's card, Hide names shows their ship's bird name instead, on your iPhone only, and Report opens an email to support@quietorbit.org naming the ship. You decide whether to send it.

To keep your crew up to date, Quiet Orbit asks iCloud to wake it when a friend's state changes. These silent notifications show nothing on screen and carry nothing about you or your friends: the app reads the crew again when one arrives. When the host changes the time or cancels, iCloud also shows you one notification, written by your own iPhone when you joined: the world and the time, nothing about the host or the crew.

A session you flew together is also kept with the rest of your history, on your iPhone and in your private iCloud database: when it was, the world and the shape, what the crew carried home, and your crew's names and ships as they were at landing. Only you can see it, and Delete All Quiet Orbit Data removes it.

Screen Time and app blocking

If you switch on App Blocking, Apple asks you to authorize Screen Time access and provides a system-owned picker for choosing apps, websites, or categories to block. Apple represents those selections as privacy-preserving tokens. Quiet Orbit uses them only to apply the blocking you asked for, during a session.

Your selection is stored only on your iPhone, in a storage area shared between Quiet Orbit and its own extensions, and it is never transmitted anywhere: not to us, not to PostHog, not to any other provider. Because Apple's tokens are meaningless outside your device and outside this app, Quiet Orbit itself cannot tell which apps you chose. It can only ask iOS to hold back whatever the tokens refer to.

You can use Quiet Orbit without granting Screen Time access. Focusing without blocking is a fully supported way to use the app, and every other feature behaves identically.

Notifications

If you enable reminders, Quiet Orbit asks iOS for notification permission and stores the schedules needed to deliver them. You can change reminder schedules in Quiet Orbit, and notification permission in iPhone Settings.

Purchases and subscriptions

Purchases are processed by Apple through the App Store. We use RevenueCat to present offers and to determine whether Premium features are available. RevenueCat may process an app-specific customer identifier, purchase and subscription events, product and entitlement information, and limited technical information needed to provide and analyze subscriptions. Quiet Orbit never receives your payment-card details.

Once per install, RevenueCat also receives a short-lived attribution token from Apple's AdServices framework. RevenueCat exchanges it with Apple, which says whether the install came from one of our ads on the App Store (Apple Ads) and, if so, which campaign, ad group and search keyword. We use this only to learn which ads lead to subscriptions. It does not involve Apple's advertising identifier, needs no tracking permission, is tied only to the same app-specific customer identifier as your purchases, and is not used to follow you across other companies' apps or websites.

Product analytics

We use PostHog, on its EU Cloud, to understand whether the core flows work. Quiet Orbit sends a fixed, closed list of pseudonymous product events. The list is not open-ended: it is defined in the app's source as an allowlist, and no event can be sent that is not on it.

The events describe starting, completing, returning to, and continuing an expedition, and where people give up:

• opening the app: whether it was a fresh launch, whether setup is finished, whether Premium is active, how many destinations you have completed, which of the app's languages it is speaking, and whether you chose that language for the app rather than your phone. Never a session length or a duration
• opening one of the app's main places: the four tabs (Control, Archive, Log, Ship), the Star Map, Settings, Awards and the Hangar. That it was opened, never how long you stayed
• reaching each setup screen, so we can see where setup is abandoned
• opening Set Up a Focus Session, and how you got there: its button, a notification, Siri, Shortcuts or the Lock Screen control, or a widget
• tapping one of the app's notifications: which kind (a reminder, a note about your progress, the weekly summary, the trial reminder, the end of a session or a break, flying together). Never its words
• the verdict on the reminder and app-blocking permission prompts: allowed or not, and on which screen you were asked. Never which apps you chose
• a purchase that did not complete, with a coarse reason (cancelled, network, store problem). Never the store's own message, which can name your account
• opening the optional mission brief
• saving a session note: whether it was the first note for that session and whether the session finished. Never the text, an excerpt, a hash, or even its length
• completing onboarding: which step, how many presets chosen, how many scheduled days, which broad time band (morning, afternoon, evening, or night), never your exact reminder time, and which of four answers you picked to "What's the hard part for you?"
• abandoning a launch before the session begins
• starting a session: destination, length, number of legs, break length, progress at that destination, how you got to Set Up, whether apps were actually blocked, which background sound played, which focus setup it was by its built-in identifier (never the name you gave it), and whether Premium is active
• continuing after a protected break
• completing a session or ending one early: focused seconds, overrun, how far through the plan you were, and how many times the block screen came up during it. Never which app or website you tried to open
• revealing a finding and completing a destination: catalog identifiers, rarity, and counts
• opening a finding in the Archive and earning a badge: catalog identifiers, kind and rarity
• opening the release notes, from where, and pressing Show me on one of them; and finishing or leaving one of the short first-run tours, at which step
• starting a purchase: which plan (monthly, yearly or lifetime) and from which screen. Never your payment details, which only Apple sees
• a backup file written or failed: whether it went to iCloud Drive or to this iPhone, and whether it was the daily backup or Back Up Now. A backup restored: how many sessions it added, and whether the phone had nothing of its own yet. Never what a backup holds
• iCloud keeping your data only on this phone: whether iCloud is full, refusing uploads, or signed out
• turning Screen stays on, Haptics, progress notes or the daily backup on or off
• choosing an action at the end of a session, staging a next launch, selecting a destination, and displaying a collectible in your ship
• sharing a picture from the app: that the share preview was opened and from which screen, that Share was pressed, the shape of the picture (story or square), and the kind and rarity of the finding, which world or which badge it showed. Never the picture itself, the words sent with it, or where you sent it
• opening the weekly log: whether from its row or from the weekly notification, and whether that week had finished. Never its minutes, its days, or what you were working on
• in the Hangar: opening the paint sheet and on which tab, and which paint, engine light, light rhythm, dock or ship you picked or tried on, by its catalog identifier, with where it comes from. Never your ship's name
• the Outside view: switching to it and back, and which camera you chose (behind, beside, above or from afar) and where
• flying together: hosting a session together (its length, number of legs, the shape picked, and how many minutes ahead it was set), joining one (how many ships were already aboard, whether it had already left, whether you came by link or by code, and whether iCloud was signed in), a join turned away because the crew was full, had left, or needed a newer app, leaving before departure, the host cancelling it or moving its time (how many ships were aboard, and how many minutes ahead the new time is), the departure and the landing (how many ships flew, whether you hosted, the shape flown, whether you finished), and flashing your lights (how many friends were on the break). Never a name, a code, what anyone is working on, or who you flew with
• turning this setting back on

We never ask why you ended a session, and no event records a reason. We do not send private session-note text, your ship's name, focus setup names or purposes, Screen Time selections, notification content, or anything you wrote. We do not send the length, an excerpt, or a hash of a note. We do not use this data for advertising or cross-app tracking.

Session replay, autocapture, automatic screen-view capture, and person profiles are all switched off in the app's PostHog configuration, and Quiet Orbit never calls identify. There is no account to identify you with.

Each event carries the technical context PostHog attaches automatically: a random identifier, app version and build, device model and type, operating system name and version, locale, timezone, and the SDK version. That identifier is generated on your device the first time analytics runs. It is not Apple's advertising identifier and not the identifier for vendors, so it does not follow you into any other app, and Delete All Quiet Orbit Data resets it.

Analytics is on by default and can be switched off at any time in Settings, Your Data, Share anonymous usage. While it is off, Quiet Orbit does not start the analytics SDK at all, so nothing is recorded and no request is made to PostHog, including the configuration request the SDK would otherwise send on every launch. Switching it off stops anything further being sent. Events already uploaded cannot be recalled.

Crash reports

From version 2.0, Quiet Orbit uses Sentry, in its EU data region in Frankfurt, Germany, to learn when the app crashes or stops responding. It runs only while Settings, Share anonymous usage is on, the same switch as product analytics. While it is off, Quiet Orbit does not start the crash reporter, so nothing is recorded and no request is made to Sentry.

A crash report says where in Quiet Orbit's own code the problem happened: the stack trace of each thread, the kind of error, and the app's recent system events, such as going to the background or a low-memory warning. With it come the app version and build, device model, iOS version, language and time zone, memory and storage, battery and network state, and whether the app was on screen. The same is sent when the app stops responding for two seconds or more, or when iOS closes it for using too much memory. Separately, Sentry counts each time the app is opened: when, for how long, and whether that use ended normally or in a crash. That is how we know how often each version crashes.

From version 2.0, a crash or a hang also carries a short recording of the screen from the moments before it, so we can see what led there. Every piece of text and every image in it is masked out before it leaves your iPhone, so it shows the shapes of the screen, never your session notes, your ship's name, or anything you typed, and no taps are recorded. Ordinary use is never recorded: the recording is kept briefly on the phone and sent only with a crash or a hang. Crash reports carry no screenshots and no web address the app visited, and performance tracing is switched off. Sentry does store the IP address each report arrives from, and the approximate location (country, region, and city) it works out from that address, which helps tell a crash on one network or in one country from a crash everywhere. The only identifier the app itself sends is a random one generated on your device, separate from the analytics identifier, so we can tell one crash on ten iPhones from ten crashes on one. It is not Apple's advertising identifier and not derived from the identifier for vendors, and Delete All Quiet Orbit Data deletes it, along with any crash report not yet sent.

Switching it off stops crash reporting and deletes any crash report still waiting on your iPhone. Reports already sent cannot be recalled.

Feedback board

Settings has a Feedback & Ideas row. It opens a page run by UserJot, a feedback service, inside Quiet Orbit. Opening it sends nothing about you: the app does not tell UserJot who you are, and it has no account to tell it with. Once per launch, the app asks UserJot for the board's address; that request carries no personal information.

Everything on the board is your choice. If you post an idea, vote, comment, or create a UserJot account to do so, UserJot receives what you enter: the text, your votes, and the name and email address you give it. UserJot processes that under its own privacy policy, and its page may set its own cookies inside the app. Like any web page, it also sees the app version and iOS version in the request.

You can read the board without posting, and Quiet Orbit works the same whether you ever open it. To have a post or an account removed, use the account controls on the board, or write to privacy@quietorbit.org and we will ask UserJot on your behalf.

This website

This website carries no analytics, no advertising, and no tracking scripts. It sets no cookies and does not profile visitors. Our hosting provider processes the technical request information needed to serve and protect the site.

A Fly together invite link opens a page on this site with the session's code and plan in its address: when it leaves, how long it lasts, and the world, and the language the sender's app speaks. The page reads them only to show them, in that language or your browser's, and to offer the app; it stores nothing and is not indexed by search engines. Its App Store link carries a campaign label naming the page's language, so Apple's App Store statistics can count installs that came from invites, by language, in aggregate.

If you contact support, we receive what you choose to send: your email address, your message, and any app version or diagnostics you include. Please do not send session notes or other sensitive information unless your request needs it.

Why we process information

• To provide the app and the features you ask for, including sessions, reminders, blocking, purchases, and support
• To maintain security, prevent abuse, and diagnose failures
• To understand and improve the product with privacy-minimized analytics
• To comply with legal obligations and enforce our terms

Depending on the flow, the legal basis is performance of a contract, your consent, compliance with a legal obligation, or our legitimate interest in operating and improving Quiet Orbit.

Service providers

• Apple: App Store distribution and purchases, notifications, the Screen Time frameworks you authorize, iCloud storage of your own data in a private database we cannot access, and the shared CloudKit database that carries Fly together sessions
• RevenueCat: subscription offers, purchase status, entitlements, and Apple Ads attribution
• PostHog (EU Cloud): privacy-minimized product analytics
• Sentry (EU region): crash and diagnostic reports, only while you share anonymous usage
• UserJot: the feedback board in Settings, for what you choose to post there
• Cloudflare: delivery and security for this website
• Our email provider, for support correspondence

These providers process information under their own terms or on our behalf. We may also disclose information where legally required, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. We do not sell personal information.

International transfers

Some providers may process information outside your country. Where required, we rely on appropriate transfer safeguards. Our PostHog project uses EU Cloud, and our Sentry organization stores its data in the EU, in Frankfurt. RevenueCat states that customer data may be stored in the United States. What you post on the feedback board is stored by UserJot under its own policy, which states where.

Retention

• Information on your iPhone, and in your private iCloud database, stays until you delete it, delete the app, or the operating system removes it.
• Fly together records in the shared database expire a day after their session leaves and are deleted by the iPhone that wrote them, as described under Fly together.
• Support messages are kept for 24 months.
• Product analytics events are kept for 12 months.
• Crash reports, and the counts of how often the app is opened, are kept for up to 90 days.
• Posts, votes, and accounts on the feedback board stay with UserJot until you remove them there or ask us to.
• Purchase and entitlement records are kept as long as needed to provide subscriptions, meet legal obligations, and resolve disputes.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent. You may also complain to your local data-protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Because your Quiet Orbit activity lives on your iPhone and in a private iCloud database we have no access to, we generally do not hold that information and cannot identify it as yours. You can remove all of it yourself with Delete All Quiet Orbit Data. You control notifications and Screen Time permission in iPhone Settings, and your subscription through Apple.

For a privacy request about information we do hold, write to privacy@quietorbit.org. We may need to verify the request.

Children

Quiet Orbit is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child under 16 has given us personal information, write to privacy@quietorbit.org and we will delete it.

Security

We use reasonable technical and organizational measures designed to protect information. No system is completely secure, and we cannot guarantee absolute security.

Changes

We may update this policy when Quiet Orbit or the law changes. We publish the updated version here and change the effective date. Where a change materially affects your rights, we give additional notice if required.

Contact

Zeus Apps B.V., Netherlands. privacy@quietorbit.org