PRIVACY POLICY

Effective October 10, 2026. This policy explains what Orbvue collects and why. Orbvue is operated by Align AI Studio LLC, the data controller (contact details at the end). Orbvue is built to be stateless by default.

1. Free tools: nothing you enter is stored on our servers

Domains, IP addresses, wallet addresses, emails, company names and usernames you enter are used only to answer that request. They are never written to a database, log store or cache by Orbvue, and lookup responses are sent with Cache-Control: no-store.
No advertising, no analytics pixels, no tracking cookies, and no profiles combining data about a person across tools.
Only public, non-personal feeds (earthquakes, flights, news events, weather, natural events, ISS position, Bitcoin block height) are cached at the edge for seconds to minutes.

2. Stored in your browser only

Recent searches (a short list per tool), a “seen the intro” flag, your sound preference, hidden partner panels, and cached Starlink orbital data are kept in your browser’s local storage. They are never sent to Orbvue. Clear them with “LOCAL ONLY · CLEAR” or by clearing site data.
Crew access keys are kept in your browser’s local storage.

3. Tool-specific handling

Breach exposure. An email you check is sent once, server-side, to Have I Been Pwned and is not stored or logged by Orbvue. You must confirm the address is yours (or that you have permission). Only breach metadata is shown (name, date, kinds of data exposed), never passwords, hashes or leaked records. A site-wide counter of request timestamps (no emails) enforces HIBP’s rate limit.
Password check. Your password is hashed (SHA-1) in your browser; only the first 5 characters of the hash go, browser-direct, to api.pwnedpasswords.com (k-anonymity). Orbvue’s servers never receive it.
Public records & username check. Queries are proxied to the listed registries and platforms for that request only. GitHub is checked browser-direct (GitHub sees your IP and the handle).
Image metadata. Images are parsed entirely in your browser and never uploaded. Reverse-image search is a hand-off you choose to make to Google, Bing, TinEye or Yandex, under their policies.
Ethereum lookups go from your browser directly to Blockscout (eth.blockscout.com), which sees your IP and the address; Starlink data is downloaded by your browser from CelesTrak.
Crew location (opt-in). Stored per crew in a Cloudflare Durable Object: the crew name, members’ display names, hashed access keys and hashed single-use invite tokens, and, only while a member is actively sharing, that member’s latest position and accuracy. No location history. A position is deleted when sharing stops, the chosen window ends, after 15 minutes without an update, or when the member leaves or is removed; deleting the crew erases everything.
Domain ownership verification uses a token derived from the domain name, so it needs no stored state.

4. Orbvue Pro (opt-in): what we store and why

Monitoring can’t work without remembering what to monitor, so Orbvue Pro is the one place we keep personal data, and only what monitoring needs:

Account email: to sign you in (one-time codes) and contact you about your account. Stored encrypted (AES-256-GCM), with a keyed hash used for lookups.
Watched email addresses (up to 5, each verified by a code sent to that address): stored encrypted, with the names of breaches each appears in (never the leaked data) and the time of the last check, so we alert you only about new breaches.
Alert history: which breaches triggered an alert and when (kept 12 months).
Sign-in and verification codes: stored only as keyed hashes, expire after 10 minutes, deleted within a day. A keyed hash of your IP address is kept with each code request for up to a day to prevent abuse.
Session: one essential, HttpOnly cookie (ov_s) keeps you signed in for up to 30 days; its value is stored only as a hash. It is not used for tracking.
Email log: a copy of each email we send (encrypted) and its delivery status, kept 30 days for troubleshooting; code emails have their content removed after a day.
Subscription record: your PayPal subscription ID, plan, status, renewal date and verification times, obtained from PayPal. We never receive your card or bank details.

Retention & deletion. Delete a watched address or your whole account at any time from the Pro dashboard; deletion is immediate (minimal billing records may be kept as required for tax and accounting). If your subscription ends, watched addresses are deleted after 30 days.

5. Service providers

Cloudflare: hosting, edge network and the Orbvue Pro database.
Have I Been Pwned: receives email addresses we check, to return breach results.
Resend: delivers Orbvue Pro emails.
PayPal: processes Orbvue Pro payments under its own privacy policy.
Google Fonts and Esri (map tiles) may receive standard request metadata such as your IP address.
Public data providers listed in the Terms receive lookups, mostly via our server (so they see our request, not your IP).

We don’t sell or rent personal data, and we don’t share it for advertising. Partner links never include what you searched (see Disclosure).

6. Email & unsubscribe

Every breach alert includes a one-click unsubscribe link (and standard List-Unsubscribe headers). You can pause alerts per address or stop all Orbvue email from your dashboard. Sign-in codes you request are still sent.

7. Your rights

You can access, correct, export or delete your Orbvue Pro data from the dashboard or by emailing hello@orbvue.com. Depending on where you live (for example under the GDPR or U.S. state privacy laws such as the CCPA/CPRA), you may also have rights to object, restrict processing or appeal a decision, and to complain to a data-protection authority. We don’t sell or “share” personal information as those laws define it, and we will not discriminate against you for exercising your rights. Our legal bases are performance of the contract (Pro), your consent (monitoring each address, location sharing) and legitimate interests (security, abuse prevention).

8. Security

Personal data in Orbvue Pro is encrypted at rest with keys held as server secrets, codes and session tokens are stored only as hashes, and access is limited to what operating the service requires. No system is perfectly secure; if we learn of a breach affecting your data we’ll notify you as required by law.

9. International transfers

Orbvue is operated from the United States and runs on Cloudflare’s global network; data may be processed in the U.S. and other countries where our providers operate.

10. Children

Orbvue is not directed to children under 13, and Orbvue Pro accounts are for adults (18+). We don’t knowingly collect personal data from children; contact us if you believe we have.

11. Changes

We’ll post updates here with a new effective date and notify Pro subscribers by email of material changes.

12. Contact

Align AI Studio LLC · Align AI Studio LLC, 9905 S Pennsylvania Ave, Ste A, Oklahoma City, OK 73159 · hello@orbvue.com

◂ Back to the orb