Privacy Promise

Every submitted request requires one fresh current-screen capture. Orbit writes it with mode 0600 inside an Orbit-owned temporary directory and associates it with that turn.

Orbit does not continuously record your screen. If capture fails, the turn is blocked instead of being sent without visual context. The file is deleted after success, failure, interruption, cancellation, launch failure, or app termination. Crash recovery sweeps only stale Orbit-owned captures.

Orbit offers two voice modes with very different privacy characteristics:

• Local Voice: Requires Apple on-device speech recognition. Orbit selects the exact Siri Natural Nora / Voice 4 identifier used by Shortcuts and verifies that its installed macOS speech asset is available. Otherwise it reports and uses a compatible Apple fallback. Voice 4 narration streams directly through the local audio subsystem without creating an Orbit narration file.
• Cloud Voice: Explicitly sends audio to OpenAI for transcription and AI-generated speech. Orbit shows the voice disclosure in this mode. Your API key is stored in macOS Keychain.

We don't want your data. The native Orbit macOS app contains zero tracking SDKs, zero analytics engines, and zero crash reporters that “phone home” to our servers. Any crash logs are generated locally by macOS and stay on your machine.

All API keys and credentials are stored exclusively in the macOS Keychain — the same secure enclave that Safari and other Apple apps use. Orbit never writes keys to plain text files, config files, or environment variables.

Orbit starts Codex with unrestricted filesystem and command access, automatic approvals, and no per-operation approval switch. Codex can run commands and read or edit files available to your macOS account. The optional Agent Folder changes starting context, not this security boundary.

Local support logs are private, capped at 5 MiB with three rotations, and contain only allowlisted event categories. Orbit redacts credentials, authorization headers, prompts, capture paths, home paths, and full command arguments.

Depending on how you configure Orbit, it interacts with third parties:

• ChatGPT / Codex: Powers the AI assistant. Handles your text, screen context, and the streamed work that follows. Uses your existing ChatGPT subscription.
• OpenAI API (optional): Only if you enable Cloud Voice. Audio is sent to OpenAI for transcription and GPT TTS for speech, using the API key you provide.

Orbit is now public on GitHub, so the privacy claims on this page can be checked against the shipped code and release tooling directly: no bundled telemetry, no hosted backend, and intentional capture instead of passive recording.