Privacy Policy

The data controller is Marko Kovalevskis, operating OrbitalWiki as an individual. We have not appointed a representative or a data protection officer, because the project is small and does not carry out large-scale or high-risk processing. You can reach us at hello@orbitalwiki.com.

Early-access form. When you join the launch list we collect the email address you submit.

Server and security data. Like any website, our servers receive standard request data such as IP address, user agent, request path, timestamp, and error logs. Forms on the site run anti-abuse checks such as origin validation and rate limiting. We do not currently run a public email sign-up form; if we add one, it may use a Cloudflare Turnstile challenge to tell humans from bots, and we will update this policy before turning it on.

Analytics (opt-in, cookieless).We use PostHog to understand aggregate usage, for example pages viewed, basic events, approximate location derived from your IP address, and device and browser type. Analytics only run if you choose “Accept analytics” in the consent banner shown on your first visit; if you decline, PostHog is never loaded. Even when enabled it runs in cookieless mode: it sets no cookies and does not track you across other sites. Your choice is remembered with a single strictly-necessary entry in your browser’s local storage so we do not ask again.

Developer accounts and API keys. If you create an account, we store your email address and an authentication record. When you generate an API key we store a hash of the key (never the key itself). To prevent abuse — such as one person farming many free keys from multiple accounts — we also record, at the moment of key creation, the IP address and a device fingerprint (a value derived in your browser from your device and browser characteristics), together with per-key usage counts. The fingerprint is computed locally in your browser; we do not use a third-party tracking service for it.

Billing data. When paid subscriptions are enabled, checkout, payment method details, invoices, tax handling, and subscription lifecycle events are processed by Lemon Squeezy, our payment provider and merchant of record. Your checkout details (including your email and the plan you choose) are submitted to and handled by Lemon Squeezy under its own terms and privacy policy. We store the account email, plan, subscription status, customer identifiers, and webhook events needed to grant or revoke access. We do not store full payment-card numbers.

• Manage the launch list and contact you. We send only the launch and product updates you asked for. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• Keep the service secure and prevent abuse. This covers origin checks, rate limiting, and bot detection. Legal basis: our legitimate interests in protecting the service (Article 6(1)(f) GDPR).
• Provide developer accounts and API access. Creating an account, issuing and managing API keys, and counting usage against your plan. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Prevent API-key abuse. We use the IP address and device fingerprint recorded at key creation to detect and block the same person creating multiple accounts to bypass free-tier limits. Legal basis: our legitimate interests in preventing fraud and abuse (Article 6(1)(f) GDPR). You can object to this (see your rights below); if a block is mistaken, contact us and we will review it manually.
• Understand and improve the product. This is what our cookieless analytics are for. Legal basis: your consent (Article 6(1)(a) GDPR), given through the consent banner, which you can withdraw at any time by declining analytics or contacting us. We do not load any analytics before you opt in.
• Process subscriptions and enforce paid access. This covers checkout, invoices, subscription status, plan changes, refunds where applicable, and access changes. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and our legal obligations for accounting and tax records (Article 6(1)(c) GDPR).

We do not sell your personal data and do not use it for third-party advertising.

We share data only with providers that process it on our behalf under appropriate agreements:

• Vercel hosts the website and serverless API routes.
• Supabase stores early-access email records and prototype catalog data.
• Cloudflare would provide the Turnstile anti-bot check if we add a public sign-up form.
• PostHog provides cookieless product analytics.
• Resend sends confirmation or product emails when email delivery is configured.
• Lemon Squeezy processes paid subscription checkout and billing when purchases are enabled.
• Google Fonts serves the web font files used by the landing page.

Some providers above may process data on servers outside the European Economic Area (EEA), including in the United States. Where that happens, the transfer is covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Our analytics data is processed in PostHog’s EU region.

We keep early-access email records until the prototype access period ends, until you ask us to delete the record, or until the list is migrated to an explicit account or mailing-list consent flow. Security logs are kept only as long as needed to investigate abuse. Analytics data is retained according to our analytics provider’s configured retention period.

Developer-account data (your email and API-key hashes) is kept for the life of your account and removed when you delete the account or ask us to. The IP address and device fingerprint attached to a key are kept while the key exists and for a limited period afterwards for abuse prevention, then deleted.

To request deletion or correction, email hello@orbitalwiki.com.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing, including our analytics;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise any of these, email hello@orbitalwiki.com. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

We keep cookie use to a minimum. Analytics and error monitoring are off until you opt in through the consent banner, and analytics even then run cookieless. The banner offers a genuine three-way choice: accept analytics, essential only (functional cookies for theme and language keep working, analytics and error monitoring are off), or decline all (the same, plus those functional cookies stop persisting past your current browsing session). Your choice is remembered in one strictly-necessary cookie so it applies across orbitalwiki.com and all its subdomains, not just the page you chose it on. The only other cookies that may be set are functional, security-related ones from the Cloudflare Turnstile check on the form. See the Cookie Policy for the full list.

OrbitalWiki is not directed at children, and we do not knowingly collect personal data from anyone under the age required for valid consent in their country (13 in Belgium, and up to 16 in some other EEA countries).

We will update this policy before any new processing takes effect and revise the date above. Questions about this policy can be sent to hello@orbitalwiki.com.