Orbita ← Back

Privacy Policy

This is a translation of our German privacy policy (Datenschutzerklärung). In case of any discrepancy, the German version prevails.

1. Controller

One Pixel Ahead UG (haftungsbeschränkt)
Markus Goedecke
Euschertsfurth 102
94551 Lalling
Germany
Email: admin@one-pixel-ahead.com

2. Your rights

You have the following rights regarding the personal data concerning you:

You also have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.

3. Core principle: your data stays on your device

Orbita is an application that runs locally. Your email messages, attachments, contacts, drafts and settings are stored only on your device (in a database in the app's storage area). Like all app data, this database may be included in device backups you make through your operating system (for example iCloud Backup or Time Machine). Orbita's own backups and exports exist only on the Mac, are only created when you start them, and are saved where you choose. The credentials for your email accounts are kept in your operating system's keychain. We do not operate any server that receives, stores or reads your email, and we have no access to this data. Besides the connection to your email providers and the DNS lookup when you set up an account (both section 4), the app makes further connections: purchase verification through the App Store (section 5), the lookup of profile pictures and company logos through our server, which is on by default and can be switched off (section 6), and, only with your consent, the transmission of crash reports to our server (section 8).

Orbita loads external content in email, such as images, only if you allow it for a single message or for a sender. The server the content is loaded from then receives your IP address.

4. Connection to your email providers

The app connects directly from your device to the servers of your email provider (IMAP/SMTP, Google Gmail API, Microsoft Graph). The privacy policies of these providers apply to their processing of your data. Sign-in with Google and Microsoft uses OAuth; Orbita does not receive the passwords for these services, only access tokens, which are stored on your device. If you instead set up an account manually via IMAP, for example with an app password (also possible for Gmail), Orbita stores that password in your device's keychain. For Gmail accounts connected via Google Sign-In, section 4a also applies.

When you set up an account, Orbita determines the right provider by looking up the domain's MX record via DNS. Only the domain part of your email address (e.g. “example.com”) is sent to the DNS-over-HTTPS service of Cloudflare, Inc. (cloudflare-dns.com), never the address itself. Legal basis: Art. 6(1)(b) GDPR (setting up the feature you requested).

4a. Data from Google accounts (Gmail)

When you connect a Gmail account, Orbita accesses the following through the Gmail API and Google Sign-In: your email messages including headers, content and attachments, your labels and drafts, read status, and your email address, name and profile picture from your Google account.

Use: Orbita uses this data only for features you see in the app: showing, searching (on your device) and syncing your email; showing the people you correspond with and the links contained in your email; applying your actions (mark as read or unread, archive, mark as spam or not spam, move to trash or restore from it); saving drafts and sending email on your behalf.

Storage: The data is stored on your device in the app's database; access tokens are kept in the system keychain. The diagnostic log on your device (section 9) may contain Gmail label names and attachment file names, but no content of your email. No email is stored on servers operated by One Pixel Ahead. Like all app data, the database and the diagnostic log may be included in device backups you make through your operating system (for example iCloud Backup or Time Machine). Orbita's own backups and exports exist only on the Mac, are only created when you start them, and are saved where you choose.

Sharing: We do not sell Google user data and do not use it for advertising or to train artificial intelligence models. We have no access to your email. The only transfers are:

We look at crash reports and diagnostic logs only to fix bugs.

Deletion: When you remove a Gmail account in Orbita (Settings → Email Accounts), Orbita deletes that account's messages, attachments, drafts, sync data and access tokens from your device and attempts to revoke Orbita's access to your Google account. If that fails, for example without an internet connection, access at Google remains in place. Backups, exports and attachments you saved yourself remain until you delete them. You can also revoke access yourself at any time at https://myaccount.google.com/permissions. Your email stored at Google is not affected.

Limited Use disclosure: Orbita's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Purchase, purchase verification and updates through the App Store

Orbita is distributed exclusively through Apple's App Store. Buying the full version, checking whether a purchase exists, and delivering updates all happen through the App Store (StoreKit), on the Mac and on iOS. Your device communicates with Apple for this; we do not operate our own server for it and receive no data from Apple that could identify you. Apple's privacy policy applies.

Orbita does not request update information from us and does not send usage or installation data to us.

6. Profile pictures and company logos

To show profile pictures of your contacts and company logos, Orbita sends a request to our server (api.orbita.email). No email address leaves your device. For profile pictures, Orbita sends the SHA-256 hash of the address; our server uses it to query the Gravatar service (Automattic Inc., USA). For company logos, that is for company addresses and for links in your email, Orbita sends only the domain name, in plain text; our server first fetches the website of that domain and, if no logo is found there, queries Google's favicon service (Google Ireland Limited). Gravatar, the website operators and Google receive neither your IP address nor your email addresses. Our server receives your IP address; it appears in our server's access logs (section 11), but the hash or domain does not. This feature is on by default.

You can switch this feature off at any time in Settings under “Privacy & Permissions”. Legal basis: Art. 6(1)(f) GDPR; switching it off acts as an objection.

7. Access to your contacts

If you allow it in Settings, Orbita reads profile pictures from your device's Contacts app. This data stays on the device and is not transmitted. You can withdraw the permission at any time in the system settings.

8. Crash reports (only with your consent)

Crash reports are off by default. Only if you turn them on during setup or later in Settings under “Logs” does Orbita send technical reports on errors to our self-hosted GlitchTip instance (errors.one-pixel-ahead.com) on our server at Host Europe GmbH in Germany. We use the reports only to detect, understand and fix errors in Orbita. The reports are not shared with third parties.

A report contains the error message, the program flow up to the error (stack trace), the app version, the operating system and its version, technical details about the app's runtime environment, as well as the time and a random report ID. Device name, device model and user identifiers are not transmitted. Email addresses are removed automatically before sending. File paths and error messages may nevertheless contain individual details such as your user name or folder, file or server names. Your IP address is processed technically during transmission but is stored neither in GlitchTip nor in the access logs of this service.

Individual reports are deleted automatically after 30 days at the latest. GlitchTip groups recurring errors into an issue; this issue, including the title and location of the error, is kept as long as the error keeps occurring and is deleted 30 days after it last occurred at the latest. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time by switching crash reports off in Settings; from that moment on the app records and sends no further reports.

9. Local diagnostic log

The app writes a diagnostic log on your device. It records technical events and error messages of the app, including the names of your folders and Gmail labels, attachment file names and internal identifiers of accounts and messages. It does not contain subject lines or the content of your email, nor any credentials (passwords, access tokens). Before writing an entry to the log, Orbita removes email addresses and your user name where it appears in file paths. It does so again when you view, copy or share the log in the app. Entries written by versions before 0.8.320, which did not yet filter the log, are deleted once, the first time version 0.8.320 or later is started. The log stays on your device and, like all app data, may be included in device backups you make through your operating system; you can view and delete it in Settings → Advanced → Logs.

The log is only transmitted to us if you send it to us yourself as part of a support request. We use it only to fix the reported bug and delete it 30 days after your request has been closed. Legal basis: Art. 6(1)(b) GDPR (handling your support request about Orbita).

10. Website orbita.email

When you visit our website, our servers automatically record technical information (browser type, operating system, IP address, time and requested resource) to ensure stable and secure operation. The website sets no cookies and uses no analytics or tracking services. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

11. Hosting

Our servers (website, profile picture lookup, crash reports) are operated by Host Europe GmbH, Cologne, in Germany. The access and error logs of the website and the profile picture lookup serve to ensure operation and to fend off attacks; they are deleted automatically after seven days. The crash report service does not log IP addresses. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

12. Contacting us by email

If you contact us by email, the information you provide, including your contact details, is stored to handle your request. This data is deleted as soon as it is no longer needed for handling your request, unless statutory retention obligations apply.

13. Encryption

The profile picture lookup, the transmission of crash reports to our server and visits to our website are encrypted with TLS. Connections to your email providers are encrypted where the provider supports it.

14. Note on Apple system functions

macOS and iOS check an app's signature when it starts and may contact Apple to do so. This check is a function of the operating system and beyond our control; Apple's privacy policy applies.

15. Changes to this privacy policy

We reserve the right to amend this privacy policy to keep it in line with current legal requirements or to reflect changes to our services.

Last updated: 10 October 2026