Privacy First · Local-First

Your privacy
lives in your phone.

orbiTome is designed to know as little as possible about you. Here you'll find exactly what we collect, why, and for how long.

Last updated: 4 November 2026 · Version 6.6

🔒 Event history: only on your device
💨 Cloud data: deleted when the event expires
👻 Invisible event: not shown on the public map
🚫 No selling of data to third parties
Index
01 · Controller

Who is responsible for your data

The data controller is Cesare Bramante, independent developer of orbiTome — Via Basilio Bricci 43, 00152 Roma RM, Italia · phone +39 3483919089 · email info@orbitome.com · certified email (PEC) cesare.bramante@pec.it. For privacy questions, write to the address in the Contact section; all contact details are also on the Contact page.

This policy applies to the orbiTome mobile app available on Google Play Store (Android) and on App Store (iOS), as well as related services such as the universal link orbitome.com/join/….

02 · Data collected

What we collect and why

orbiTome collects the data necessary for the app to work, keeping it to the bare minimum. Here is the full picture:

Data type
Where it's stored
Purpose
Phone number
🔐 Firebase Authentication
Sign-in with an SMS code. The number is kept by Firebase Authentication; your cloud profile holds only a fingerprint of the number and the country code, so that people who already have your number in their contacts can find you. The app does not show your number to other users.
Profile photo (optional)
☁️ Cloud (Firebase)
Displaying your public profile to friends
Event cover photo (optional, Plus)
☁️ Cloud (Firebase)
Image on the event card and in the invite link's preview, without metadata; deleted with the event
Organisation profile (optional)
☁️ Cloud (Firebase)
Type, name, logo, description, website, location and saved places, email or certified email and registry number (public bodies and associations), opening hours and phone (businesses), co-managers and the address of the public page. This is the organisation's data and may be visible to everyone
Location (GPS)
☁️ Temporary cloud
Creating events on the map; deleted when the event expires
Event history
📱 Local only
Your personal "Vault"; it never leaves the device
Phone contacts
📱 Local · fingerprint to cloud
Your address book stays on the phone. To find friends already on orbiTome, only a fingerprint of the numbers reaches our servers for the match, not the address book: for your contacts the server receives only the first part of the fingerprint, and the final match happens on the phone. The same mechanism lets your contacts who use the app find you, as in common messaging apps; there is no public list of users. When you block someone a fingerprint is kept too, not the number. A fingerprint reduces the data that leaves the phone but is still personal data, and we treat it as such. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in letting you find the contacts who already use orbiTome; fingerprints that match no user are not kept. You choose which contacts to import and can revoke address-book access in the system settings (Art. 21).
Contacts who will attend (public events)
☁️ Temporary cloud
To show you how many of your contacts said “I'm in” to a public event, the app sends our server the identifiers of your contacts who are already registered (100 at most, never numbers or names), with a limit on requests; the server replies with the number only
Public event statistics (views and link taps)
☁️ Temporary cloud
When you view a public event or tap its link, our server counts the view and the tap at most once per person per day: to spot duplicates it keeps your identifier with the event and the day for a short period, then deletes it automatically. The organisation only sees the totals, never who. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in giving it aggregate statistics
Public event page visits (on the website, orbitome.com/join)
☁️ Temporary cloud
When you open the page of an organisation's public event on the website, our server counts the visit: so as not to count you twice, it keeps a code derived from your IP address and browser (a hash), never the address itself, for about two days, then deletes it automatically. The organisation only sees the number of visits. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in giving it aggregate statistics
Tags/Groups
📱 Local only
Managing private lists (e.g. "Five-a-side"); never shared
Diagnostics data
🔗 Third party (Google)
App performance analysis; anonymized
User blocks (user_blocks)
☁️ Cloud (Firebase)
Anti-stalking protection: keeps the mutual block relationship. When the account is deleted, the blocks you made are deleted automatically; blocks other users made against you stay tied to the fingerprint of your number (see “Deletion”, below)
In-app purchases (purchase history)
🔗 Store + RevenueCat
Only if you buy something in the app. Payment is handled by Apple or Google: we do not receive your card details. RevenueCat receives your purchase history from the stores, linked to your orbiTome account identifier (not to your phone number), and tells us which benefits are active; your profile records only that status. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Passwords / Private messages
🚫 Not collected
orbiTome does not collect or store this type of data
03 · Architecture

Local vs Cloud: the double vault

orbiTome uses a hybrid architecture designed with privacy as the starting point, not as an afterthought.

📱

The Vault — Local Database

Your event history, your contacts, and your personal tags are stored on your smartphone and are not transmitted to our servers in readable form. You can export the local database as an encrypted file (AES-256) to Google Drive or another personal storage app via the native Share Sheet, accessible only with your recovery code.

📸

📸🧭 Photos, videos and location games

The photos and videos you add to an event's album stay on your phone, in the app's private folder: they are not uploaded to our servers and they do not end up in your Gallery. The same goes for the Photo hunt picture: it only serves to show it to another player and it is deleted straight afterwards. If you create a backup, the album photos go into it encrypted; videos don't.

In Find the pin your position is read only when you press “Check” and sent to our servers to work out the band (from freezing to boiling hot, up to “you are on the point”): it is not stored, neither on the server nor on your phone, and it is not shown to the other players. The hidden point, on the other hand, is stored on the server until the game ends, in a collection the app does not read: it is known to whoever hid it, or to nobody if it was picked at random.

🖼️

Event cover photo (Plus)

If you add a cover photo to one of your events, an orbiTome Plus feature, the image is uploaded to Firebase Storage (Google) after its metadata — location, date, device — has been stripped on your phone. It is seen by whoever sees the event in the app — your contacts or, if the event is invisible, only your invitees — and by anyone who opens its invite link orbitome.com/join/…, including as the link's preview image, for example in messaging apps.

From Firebase Storage the cover photo is deleted when the event expires or is deleted, and with your account; you can also remove it earlier from the event card. If you save the event as a template, a copy of the cover photo stays in the template, on your phone. If a cover photo seems inappropriate to you, you can report it from the event card with the reason “Inappropriate image”. The cover photo is stored in the United States: see «Data transfers outside the EU», below.

🏛️

Organisations: public bodies, associations and businesses

Next to your personal profile, you can also use orbiTome as an organisation: a public body, a non-profit association or a business. The organisation's name, logo and description and its public events are visible to everyone: in the app to people nearby, in the «In town» view, and on the website, on the page orbitome.com/org/…, also to people without the app. The other data in the profile may also be seen by other users: enter only data about the organisation. The logo is the pin of its events on the map. Logos and posters go to Firebase Storage (Google), in the United States: the poster is the event's cover photo and is deleted like the cover photo (see «Event cover photo (Plus)», above); the logo is replaced when you upload a new one and is deleted with your account. We check public bodies and associations by hand, using the data in the profile; a business publishes while its subscription is active.

People who reply “I'm in” to a public event do not appear by name, either to the organisation or to anyone else: everyone sees how many people will attend, and each person sees how many of their own contacts will attend, always as a number. To count them, the app sends our server the identifiers of your contacts who are already registered on orbiTome, never numbers or names, and the server replies with the number only; people who have a block with you are not counted. If in the profile you choose «I also use orbiTome as: Nothing else», the public page goes offline and you can no longer publish public events; the profile data stays in your account until you delete it.

☁️

The Temporary Whiteboard — Cloud (Firestore)

Only the data needed to sync events travels to the cloud: public profile, event location, and status. Each item has an expires_at calculated when the event is created, which depends on how the event was set up: 2 hours from the start for a standard event, 11:59 PM the same day for the “tonight” slot, 4 hours from the start when you pick your own date and time, the stated time for an idea. If you are the host and you are on site, the event can be extended one hour at a time, up to a maximum of 6 hours from the start. An automatic Cloud Function handles hourly cleanup. Our servers are not a permanent record of where you've been.

👻
🔎

Contact filter: on your device

Invisible events appear only to your invitees, other events only to your contacts: this filtering happens directly on each orbiTome user's device, not on a server. Your event history stays only on your phone. The exceptions are public events, visible to people nearby, and the number of contacts who will attend a public event, which our server works out: see «Organisations: public bodies, associations and businesses», above.

Invisible event

When you make an event invisible, the event's visibility is set to "tag" (private): the event disappears from the public map and is accessible only to the people you have explicitly invited via link. The «Invisible event» label is visible in the interface while in use.

⚠️

Security of local contacts

The user's contacts are stored exclusively on the local device, in unencrypted storage. On devices with root or jailbreak access, phone numbers could be accessible to third-party applications with elevated privileges: orbiTome disables Android Auto Backup (via the flag android:allowBackup="false" in the manifest) to prevent extraction of clear-text data via ADB backup. We recommend not using the app on rooted devices.

04 · Third-party services

Who else touches your data

orbiTome integrates the following third-party services. Each has its own privacy policy; we provide links so you can review them directly.

Cookies and website measurement. This policy covers the app. The website www.orbitome.com uses technical cookies and, only with your consent, Google Analytics 4. The /join invitation pages use no cookies and no measurement. Full list, durations and how to give or withdraw consent: Cookie policy.

Data transfers outside the EU. App data is stored in Google Cloud's eur3 multi-region (Belgium/Netherlands), except Firebase Storage images (profile photos and event cover photos), which are stored in the United States, in the us-central1 region. Some services we rely on — Firebase Authentication (sign-in), Firebase Cloud Messaging (push notifications) and some processing functions, such as the clean-up of expired events and account deletion — are provided by Google LLC from infrastructure located in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, to which Google LLC is certified, and, as a fallback, on the Standard Contractual Clauses included in the Google Cloud Data Processing Terms. Copies of the safeguards: https://cloud.google.com/terms/data-processing-addendum · https://www.dataprivacyframework.gov RevenueCat, Inc., which handles in-app purchases, stores data in the United States; the transfer relies on the Standard Contractual Clauses (controller-to-processor module) included in its Data Processing Addendum: https://www.revenuecat.com/dpa.

05 · Store requirements

What the stores require (Google Play and App Store)

orbiTome is distributed on Google Play Store (Android) and on App Store (iOS). Google and Apple, as store operators, collect some store-level information regardless of our choices:

This data is managed directly by Google according to its own privacy policies: orbiTome has no direct access to the data collected by the store's systems.

06 · Retention

How long we keep your data

Data
Duration
How to delete it
Event data (cloud)
⏱ when the event expires
Automatic deletion via TTL and Cloud Function
Public profile (cloud)
Until account deletion
Profile → Delete account (also deletes all created live events and the blocks you made)
Organisation profile
Until the account is deleted
Profile → Delete account. With «I also use orbiTome as: Nothing else» the public page goes offline at once; to delete the profile data sooner, write to privacysicurezza@orbitome.com
Public event statistics
Short period, then automatic deletion
No action needed: the per-person, per-day record deletes itself; only the event totals remain, with no names
Public event page visits (website)
About two days, then automatic deletion
No action needed: the code deletes itself; only the event totals remain, with no addresses or names
Local history
Until uninstall
Privacy & Vault → "Clear local data" removes all local data; or uninstall the app
User blocks (user_blocks)
Until account deletion
The blocks you made are deleted automatically by the Cloud Function onUserDeleted when the account is deleted. Blocks other users made against you stay tied to the fingerprint of your number until whoever made them unblocks you or deletes their own account
In-app purchases
Until account deletion
When you delete your account we remove the benefit status from your profile and ask RevenueCat to delete your customer profile. Apple and Google keep their own receipts under their own rules.
Encrypted backup
Until manually removed
Delete the file from iCloud Drive or Google Drive manually
Analytics data
Per Google policy (typically 14 months)
See privacy.google.com
07 · Your rights (GDPR)

You're in control

If you reside in the European Union or the EEA, you have the following rights under Regulation (EU) 2016/679 (GDPR):

👁️
Access
You can request a copy of all the personal data we hold about you.
✏️
Rectification
You can correct your profile data directly from the app at any time.
🗑️
Deletion
You can delete your account and all associated data from the Profile screen. Deletion removes your profile, created live events and the blocks you made, both in the cloud and locally. If another user had blocked you, their block stays tied to the fingerprint of your number after the deletion too, as for a number that never signed up: it only serves to stop you from contacting that person again.
📦
Portability
You can export your local history as an encrypted file (AES-256) via the backup feature.
🚫
Objection
You can object to processing based on legitimate interest, diagnostics included, by writing to the address given in the Contact section.
⚖️
Complaint
You can lodge a complaint with the competent data protection authority.

To exercise any of these rights, write to privacysicurezza@orbitome.com or use the features built into the app directly.

08 · Minors

Use by minors

orbiTome is intended for users aged 13 or older (or the minimum age required by applicable local law). We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided personal data, please contact us immediately so we can proceed with deletion.

09 · Contact

Got questions?

For any request regarding privacy, the management of your data, or to exercise your rights, you can contact us:

✉️

Privacy Email

Write to privacysicurezza@orbitome.com — we reply within 30 days, as required by the GDPR. For formal communications you can use the certified address cesare.bramante@pec.it.

🏠

Controller contact details

Cesare Bramante · Via Basilio Bricci 43, 00152 Roma RM, Italia · +39 3483919089 · info@orbitome.com. All contact details: Contact.

We reserve the right to update this policy to reflect changes in our services or in the law. In case of substantial changes, we will notify you via in-app notification or email. The current version is always available at this address.