Last updated: October 12, 2026
This policy covers Orbit Station 1.7 (versions 1.7.5 and 1.7.6) and Orbit Station 1.8. Chrome installs 1.8 automatically once it is published in the Chrome Web Store, so for a while both versions are in use. Where the two versions behave differently, the text names the version.
Orbit Station is local-first: everything you create is stored in your browser, and the Free features need no account. From version 1.8, the one value kept outside this browser by Chrome itself is a “used Orbit” flag in Chrome’s own sync storage, which Chrome carries through your Google account and which never reaches us (see What We Store on Your Device). While you use Orbit, the only outbound requests by default are site icons: to show a logo on each saved link (including tabs and bookmarks you import), the extension asks DuckDuckGo’s public icon service for that site’s icon, which shares the site’s domain name (for example github.com) — never the full URL, your identity, or anything you wrote. Open tabs, recently closed tabs and bookmarks that Orbit only lists (in the sidebar, the Import screen or onboarding) are shown with a generic icon drawn on your device, so listing them sends nothing. The features below are off by default and send nothing until you turn them on or choose to use them. The one exception is the uninstall-survey link (item 4): it tells us only the extension version, and the few rough details it also carries reach us only if you submit the survey. Each is disclosed in full further down:
#), so they reach us only if you submit the survey, together with your answers.Free needs no account, and apart from the icon lookups above, what you create stays in your browser. Pro sync is opt-in — it only runs after you sign in and either turn it on or buy Pro from inside the extension, and you can turn it off at any time. We never run advertising and never sell your data. Ever.
All your settings, workspaces, links, notes, to-dos, and preferences live in your browser via chrome.storage.local; wallpaper images you upload are kept in the extension’s own IndexedDB storage. On Free, this data never leaves your device unless you export it as a JSON file or turn on one of the optional features below — by default, the only part of it sent anywhere is each saved link’s domain name, for its icon. If you uninstall and choose to submit the survey, a few rough details about how you used Orbit go with your answers (section 4). If you turn on Pro cross-device sync, the data listed in section 5 below is also stored in your cloud account.
One value in Chrome’s sync storage (from version 1.8). Version 1.7.6 and earlier do not use Chrome’s sync storage. From version 1.8, once Orbit’s new tab has opened (after any setup steps), it stores the number 1 under the name orbit-used in chrome.storage.sync, Chrome’s own storage that follows your Google account when Chrome sync is on. It holds nothing else: no ID, links or settings. Chrome carries it between your own computers through your Google account; it never reaches us, and it is not Orbit’s Pro sync. Each Orbit page checks it before writing, so it is written only once. When you install Orbit on another computer signed in to the same Chrome account, Orbit reads it at install to skip the first-run welcome tab and start on the Galaxy look, as earlier versions do. Chrome deletes it when you uninstall Orbit.
If you use the extension without signing in (every Free feature works that way), it does not send us, and we do not store on our servers:
If you sign in (needed only for Pro), we store your Google account details and billing status, and with sync turned on, the data described in section 5, all linked to your Google email and account ID. On any plan, we never use tracking cookies, fingerprints or advertising identifiers. Our analytics and feedback endpoints do not log IP addresses; our hosting, sign-in and payment providers (Vercel, Supabase, Stripe) may record IP addresses in their own security logs.
Orbit Station requests the following Chrome permissions, each tied to a specific user-facing feature. Up to version 1.7.6, Chrome grants all of them when you install Orbit. From version 1.8, bookmarks and sessions are optional and are requested only when you use the feature that needs them. None are used for background monitoring. The background worker reads your saved workspaces only when you press one of its keyboard shortcuts, and, from version 1.8, once when Chrome installs Orbit: it checks whether this browser profile already holds Orbit data and reads the orbit-used flag (see What We Store on Your Device) to choose the first-run experience. To keep the uninstall-survey link (section 4) up to date, it uses only a few saved values: your current view, whether setup is finished and the install date, plus, from version 1.8, your current look (up to version 1.7.6 the link always names the Galaxy look). Those details reach us only if you submit the survey.
chrome.storage.local, plus, from version 1.8, the one orbit-used flag in chrome.storage.sync described above.
chrome.search.query API. We do not change, override, or read your search settings. The command palette’s Ask AI rows don’t use this; they open the AI site you pick (see Pages We Open for You).
chrome.identity API opens Google’s consent screen so you can authenticate. We request the minimum scopes (openid, email, profile) and never request access to Gmail, Drive, Calendar, or any other Google service. Free features never ask you to sign in, and users who never sign in are unaffected.
Items 1, 2, 3 and 5 are opt-in and off by default. Item 4, the uninstall survey, opens for everyone when you uninstall: its link tells us only the extension version, and your answers and the rough details in the link are sent only if you submit the survey.
Status: off by default. Turn it on in the Weather widget (Tools sidebar) or in Settings → Privacy.
What is sent: your latitude and longitude, rounded to 2 decimal places (about 1 km), to Open-Meteo’s forecast API (api.open-meteo.com) — or, if you type a place name instead, that place name, exactly as you typed it, to Open-Meteo’s geocoding API (geocoding-api.open-meteo.com) to look up its coordinates, which are rounded the same way before the forecast request. Your browser is asked for your location only when you haven’t typed a place. Open-Meteo is a free, open-source weather API that does not require an API key.
What is kept: the last forecast, the place name you typed and your °F/°C choice, on your device only. We never receive your location.
When it is sent: only while Weather is on: when the new tab page or the Weather widget needs a fresh forecast (the last one is more than 30–60 minutes old), when you press refresh, or when you change the location.
How to revoke: toggle Weather off in Settings → Privacy. Browser geolocation permission can also be revoked from your browser's site settings.
Status: off by default, and used only by the Galaxy look (the only look up to version 1.7.6). Toggle in Settings → Privacy. When off, or (from version 1.8) on any other look, the backdrop is drawn on your device (the Photo look’s landscapes ship inside the extension) and makes no network requests.
What is sent: a single image request to Picsum Photos (a free image CDN) containing only a date-based seed (e.g. orbit-2026-07-20) and the requested resolution. No account, no cookies set by us, no personal data.
When it is sent: at most once per day per open new tab, when the wallpaper loads.
How to revoke: toggle off in Settings → Privacy; the extension immediately falls back to the local gradient backdrop.
Status: off by default. Toggle in Settings → Privacy.
What is sent (only when enabled, at most once per 24 hours, in batches of up to 50 events; a failed upload is retried an hour later at the earliest):
1.1.0)session_start, stack_launched, day_n_active), each with its timestamp and the day number since installWhat is never sent: URLs, page titles, bookmark contents, note text, todo text, workspace names, search queries, or any browsing activity. Our events endpoint does not record or store IP addresses.
Where it is stored: in a private table in our database (hosted by Supabase) that only our server can read; no public or signed-in access. Before storing, the random instance ID is replaced with a one-way hash that cannot be turned back into the ID; we use it only to count distinct installs. Each row holds the event name, the extension version, the day it happened, the day number since install and the simple details above. If storing fails, we email ourselves only the number of events of each type in that batch, labelled with the first 12 characters of the same hash rather than the ID.
Why we collect it: to measure activation friction (e.g. how many users complete the first stack) so we can fix the onboarding for everyone. Aggregate use only.
How to revoke: toggle off in Settings → Privacy and nothing further is sent. Events recorded while sharing is off are never sent, even if you turn it back on later: turning it on deletes them from your device first.
Status: when you uninstall, Chrome opens orbitstation.app/why-uninstall in a new tab, for everyone, whether or not analytics is on. Its link looks like ?v=1.7.5#d=7-29&view=grid&skin=space&setup=y (from version 1.8, for example ?v=1.8.0#d=7-29&view=grid&skin=clean&setup=y). The part before the # is the only part your browser sends to us when the page opens, and it carries only the extension version. The rough, anonymous details after the # are in the part of the link that browsers do not send to any server: they stay in your browser, and reach us only if you submit the survey. The link holds:
v: the extension version (before the #)d (after the #): about how long Orbit was installed, as one of 0, 1, 2–6, 7–29 or 30+ daysview (after the #): the view you used (grid, list, galaxy or board; “other” if it was none of these, or “none” if no new tab was opened yet)skin (after the #): the look you used. Up to version 1.7.6 it is always “space” (Galaxy, the only look). From version 1.8 it is one of clean, space (Galaxy), focus, photo, paper or contrast (High contrast).setup (after the #): whether you finished the setup steps (y or n)Nothing else is in the link: no ID, name, email, links, page titles, notes or search terms. Loading the page shares only the extension version with us (the page also loads its fonts from Google Fonts); no answers and none of the rough details are sent unless you pick a reason and click submit.
What is sent: a single reason code from a fixed enum (e.g. missing-feature, too-slow, want-default-tab, too-busy), an optional free-text comment if you write one, an optional “Switching to” answer (up to 80 characters; both are stored as you typed them), the rough details from the link listed above (read from the link in your browser at that moment), the extension version, and the time of submission. Your answer is stored with those details in the same private database table as the analytics events (with no instance ID) and emailed to our private inbox.
How to skip: close the page or do not click submit. No answers or rough details are sent without an explicit click.
Status: off by default. Available only on the Pro plan, and only after you choose “Sign in with Google” in Settings → Sync across devices and either turn on “Enable cloud sync” or buy Pro from inside the extension, which turns sync on once the subscription is active (you’ll see “Cloud sync is now on”). You can turn it off at any time. Features that don’t need Pro never ask you to sign in, and nothing syncs without Pro.
What is stored: the contents you create in the extension — your galaxies, workspaces, saved links and tab stacks (with their URLs and titles, including bookmarks and tabs you imported and windows you saved with Session Capture), notes, to-dos, boards (including the Reading board), calendar entries, your daily focus, focus-timer settings and session count, planet positions, links between items, and your settings (including the name you entered for the greeting and, from version 1.8, your chosen look and its options, such as the High contrast settings). It also includes your Team profile name, teammates you added and your share history, and any email-account labels and addresses saved by an earlier version (the email feature is currently hidden). The read-later list, weather data, uploaded wallpaper images and analytics events are not synced. This is stored in your own account-scoped rows so it can sync to your other signed-in devices.
Who can see it: every row is protected by row-level security so only your signed-in session can read or write it through the app. Our administrators have technical access to the database for operations but do not view your content except at your request or where required by law.
Where it is stored: Supabase (Postgres), in the United States (us-east-1), encrypted in transit (TLS) and at rest.
Account identity: your Google account email and name (and the profile-photo link Google includes), plus a unique account ID, used solely to authenticate you and associate your data with your account. We request only the openid email profile scopes.
Billing status: if you subscribe, your plan, trial and billing-period dates, and your Stripe customer and subscription IDs are stored with your account so the extension can unlock Pro.
How to revoke: turn off “Enable cloud sync” to stop syncing, sign out, or use “Delete my cloud data” in Settings → Sync across devices to permanently erase your synced data and account. See Data Retention below.
Optional analytics and uninstall feedback are received by serverless API endpoints we operate (api/events and api/uninstall-feedback). They are stored in a private table in our Supabase database that only our server can read (there is no public or signed-in access to it). Uninstall answers, and the per-type event counts of any analytics batch that cannot be stored, are also emailed to a private inbox via Resend (our transactional email provider). We do not share this data with third parties or use it for advertising. Resend processes the message in transit only; we do not retain server logs of payload contents.
Open-Meteo (its forecast and geocoding APIs) is contacted directly from your browser when the weather widget is enabled, and Picsum Photos is contacted directly from your browser when the daily photo wallpaper is enabled. We do not proxy or log those requests.
If you enable Pro cross-device sync, your content is sent directly from the extension to your account-scoped storage on Supabase over an encrypted connection. Payments for Pro are processed by Stripe on our website; we never see or store your full card details. When you start checkout from the extension, your account ID and email are passed in the address of our checkout page on orbitstation.app so Stripe can link the subscription to your account.
If you contact us through the support form or by email, we receive the name, email address and message you send and use them only to reply. Support-form messages are delivered to our inbox via Resend.
Sub-processors. We rely on a small set of vetted providers strictly to deliver these features: Vercel (hosting for orbitstation.app and the API endpoints above), Supabase (authentication, database, and realtime sync for Pro, and the private table for analytics events and uninstall answers), Stripe (payment processing for Pro), and Resend (transactional email such as the reminder before a Pro trial ends, support messages, and the opt-in analytics/feedback digests). Each processes only the data needed for its function.
Some actions open a web page in a new tab. The site that serves the page receives what is in its address, under its own privacy policy:
orbitstation.app/why-uninstall with the extension version in the part of the address sent to us. A few rough, anonymous details (about how long you had Orbit, which view and look you used, whether you finished setup) follow the #, which browsers do not send, so they reach us only if you submit the survey. If you submit it we receive your reason, optional comment, optional “Switching to” answer, those details, the extension version and a timestamp (see section 4).orbitstation.app/whats-new. Its address carries nothing about you.Orbit Station's use of any information received from Google APIs — both the Chrome extension APIs listed under "Permissions We Request" and, for Pro users who opt in, the basic profile information (openid email profile) received when you sign in with Google — adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:
orbit-used flag in Chrome’s sync storage.Orbit Station's single purpose is to replace the browser's new tab page with a configurable workflow launcher: organise links into workspaces, group multiple URLs into one-click "tab stacks," search and launch them via a keyboard-first command palette, and access supporting tools (notes, todos, focus timer) from the sidebar. All listed permissions and the optional features above exist solely to support this single purpose.
Orbit Station does not knowingly collect any information from children under 13. The Free tier does not require an account, sign-in, or any personal information. The optional Pro cross-device sync feature requires Google sign-in and is intended for adults; it is not directed to or marketed to children.
We may update this privacy policy when the extension's data behaviour changes. Material changes will be reflected here with an updated "Last updated" date. We do not maintain an email list and therefore cannot notify users individually; please re-read this page after major version updates.
Version 1.7.5 (October 2026) added a few rough, anonymous details (about how long you had Orbit, which view and look you used, whether you finished setup) to the uninstall-survey link (section 4). They travel after the #, which browsers do not send, and reach us only if you submit the survey; as before, the part of the link sent to us when the page opens carries only the extension version. Also in October 2026, the email we send ourselves when an analytics batch cannot be stored was reduced to per-type event counts.
Version 1.7.6 (October 2026) fixes a bug where the new tab could stop responding after you closed Settings or Import. It does not change what Orbit stores or sends.
Version 1.8 (until your browser has updated to it, the 1.7 statements above apply) makes bookmarks and sessions optional: Chrome asks for them only when you use the feature that needs them, and keeps grants you gave an earlier version. It adds five looks to Galaxy, six in all, so the uninstall-survey link’s look detail can be clean, space, focus, photo, paper or contrast instead of always space, and the background worker also reads your current look for that link. It stores one orbit-used flag in Chrome’s own sync storage so another computer on your Chrome account skips the welcome tab (it never reaches us), and the worker reads that flag once at install. Opt-in analytics gain details about switching looks, the first run, the What’s new card and optional permission requests. With Pro sync on, your chosen look and its options are synced with your other settings. Nothing new is sent unless you turn analytics on, submit the survey or use Pro sync.
Questions or data deletion requests: support@orbitstation.app — or use the form at orbitstation.app/support.
See also our Terms of Service, which govern use of the Pro subscription.
© 2026 Omnivurse Technologies. All rights reserved.