Orbital Launcher is a home screen for Android, made by Alid0n. To be a home screen it has to read a certain amount about your phone. This is the whole of what it reads, where each piece goes, and what leaves the device.
There is no Orbital account, no sign-in to Orbital and no Orbital server. There is no analytics library, no crash-reporting service and no ad network in the app, and no advertising identifier is read. Nothing you do in Orbital is gathered up by its maker, profiled or sold. Some things do go to other companies, because you switched on a feature that needs them — that is the list below, and it is the whole of it.
The short version
Almost everything stays on the phone: your apps, your contacts, your calendar, your notifications, what you open and how often, and the layout you build. Your notes stay too, with one exception: unless you turn it off, Orbital also hands a note or a to-do you type into the command bar to Google Keep. See "Notes, to-dos, and Google Keep" below.
Five kinds of request can go out to the internet. Each needs something from you before it can happen — a permission you granted, a widget you added, or a key you pasted in:
- Rough coordinates go to Open-Meteo, so the glance can tell you the weather.
- A line you type into the command bar goes to Anthropic, OpenAI or Google — whichever one you pasted a key for — only when you have pasted in a key at all, and only for the lines Orbital could not read by itself.
- The topics you chose, and the place you typed go to Google News, for the news widget.
- A US postal code you type into the news widget goes to Zippopotam, to turn it into a town name. The answer is kept, so a code that resolves is sent once.
- Your handle and app password on Bluesky, or your access token on Mastodon, go to the server you named, if you add a feed widget and sign in — and then to nowhere else.
Three more things go out that are not on that list, and none of them is covered by the sentence above. A feed address you paste into the news widget yourself is fetched from whatever site that address points at. Choosing the Terminal lettering — or a theme that sets it for you — fetches that font through Play Services, which carries nothing about you but is still a request leaving the phone. And Android's own backup copies most of Orbital's settings to your Google account. All three are described below.
Several more things leave Orbital without leaving the phone, by being handed to another app on it. A note or a to-do you type into the command bar goes to Google Keep, with no permission, no widget and no key in front of it, and the switch for that arrives on. A note's words are also drawn into the notification shade. The answer to a sum goes to the system clipboard. A line Orbital could not read goes to your search app, or to whichever app you pick out of the share sheet if you ask it to. None of those is a server of Orbital's, and none of them is nothing either: they are all under "What leaves Orbital without leaving the phone".
A layout you save to share is a file whose whole purpose is to be handed to somebody else. What it carries, what is held back, why the holding back cannot be complete, and what happens to the file afterwards are under "Layouts, and giving one to somebody else".
Two things Orbital can do that are worth knowing before you do them rather than after: it can delete events from your calendar, and clearing a day takes a repeating event away entirely rather than the one occurrence. Both are under "Calendar".
What Orbital reads, and why
Orbital asks for none of this at install time. Each one is requested when something needs it, and whatever you decline simply goes quiet.
| What | Why | Where it goes |
|---|---|---|
| Installed apps | To show them, and to open them | Stays on the phone |
| Contacts | Names, photos, numbers and email addresses, for people on the wheel and for "text mum" or "email sam" in the command bar | Orbital sends none of it anywhere. See "Contacts" for the two paths that ride your own backups |
| Calendar | The month view, the next thing in the glance, events you ask the command bar to make, and taking one off when you clear a day | Stays on the phone |
| Notifications | The count and the latest one in the glance, the dots on icons, and what is playing | Stays on the phone |
| Usage access | To order apps by what you actually open, and to know which app is in front so the wheel can step aside | Stays on the phone |
| Approximate location | The weather | Rounded coordinates go to Open-Meteo. Nothing else does |
| Draw over other apps | The wheel inside other apps | Stays on the phone |
| Alarms | Setting one in your clock app, and asking it to take one back | Goes to your clock app, on this phone |
| Notes | A note or a to-do you type into the command bar | On the page, in the notification shade, and to Google Keep on this phone unless you turn that off |
| Lock the screen | The double-tap gesture, if you turn it on | Nothing leaves |
| News | Headlines in the news widget | Topics and place go to Google News |
| Feed | Posts in the feed widget | What you sign in with goes to the server you named |
Orbital holds no permission to read your text messages, your call history, your photos, your videos or your files, and it does not ask for one. The command bar searches your apps and your contacts and nothing else — there is nothing else it is able to search. Why photos and messages will not be added later is written into the source, at assistant/Finder.kt, as a note to anyone who might try.
What stays on the phone
Notifications
Orbital reads notifications through Android's notification listener, which you grant yourself in system settings and can take back there at any time. It is what puts a count and the latest line in the glance, dots on app icons, and the now-playing controls on the screen.
Android hands this access over whole. There is no version of it that covers only some apps, so granting it means Orbital is shown every notification on the phone rather than only the ones you wanted it for. Orbital says so in the app as well, on the screen in front of the button that sends you to the system setting.
While a notification exists, Orbital holds the app it came from, its title, one line of its text, the time it arrived, and the app's own way back to what the notification is about, so that tapping one here opens the conversation rather than the app. For a message or an email the title and the line are the sender and the preview, because that is what the notification contains. None of it is written to storage and none of it is sent anywhere: it sits in memory for as long as the notification does and goes when the notification goes.
The grant also lets Orbital take a notification down, which is what dismissing one from the glance does. It cannot read anything the notification does not carry, and it does not send or reply to anything.
Contacts
Orbital reads names, photographs, phone numbers and email addresses so that people can be put on the wheel and reached from the command bar.
Opening the command bar reads the numbers and the addresses out of your whole address book, because "text mum" and "email sam" have to find the right person without stopping to ask you which one. That list is held for as long as the bar is open and dropped when it closes. An address is used in two places and nowhere else: it fills in the email the command bar opens for you, and it is the line shown under a name in the search results for somebody whose entry has no number.
That read happens whenever the bar opens, and no switch in Orbital stops it. The "People in the results" switch, under "What it searches" in the assistant's settings, decides only whether people appear among the results you see. Withdrawing the contacts permission in your phone's settings is what stops the reading.
Only the people you actually put on the wheel are stored, and only by the identifier Android uses for them. People you mark as important are stored by the name shown on the phone, because that is what a messaging app writes into a notification title. The rest of your address book is read when a screen needs it and forgotten when that screen closes.
Orbital sends no contact to anybody. A number or an address the command bar uses goes into a message or an email that your own app opens, with the send left to you. Two smaller paths are worth naming rather than covering with an absolute: the identifiers of the people on your wheel sit inside your layout, and the names on your priority list inside that list, so both ride along with Android's backup and with any backup or private layout file you save yourself. A layout saved to share holds people back entirely.
Calendar
Orbital reads the start time, title, all-day flag and colour of upcoming events, for the month view and the glance, and writes an event when you ask the command bar for one. Nothing from your calendar is stored by Orbital and nothing is sent anywhere.
Orbital can also delete an event. Asking the command bar to clear a day — "clear Tuesday" — opens that day's list with a × beside each entry, and tapping one takes that event off your calendar straight away. There is no confirmation step and no undo inside Orbital. It needs permission to write to your calendar, which Orbital asks for alongside permission to read when you connect the calendar to the glance or to a month widget, and again on the clear-a-day screen if you have not granted it. Decline and the day stays readable and nothing else.
A repeating event goes entirely. Orbital removes the event rather than the single occurrence, so clearing one Tuesday takes every other Tuesday with it. That is deliberate, and it is not what "clear Tuesday" sounds like, so it is written here: to lose one occurrence and keep the series, do it in your calendar app instead.
What you open
Orbital keeps its own tally of which apps you open and how often, so the wheel can put the ones you use first, and notes which apps you tend to push the overlay aside in. Nothing in Orbital sends either of them anywhere, and a reset clears both.
They are not among the files Orbital keeps out of Android's backup, though, so if that backup is on they go up to your Google account with the rest of your settings. Orbital's own "Save a backup" leaves them out, because they describe one phone rather than one person. Both are under "What Orbital stores, and Android's backup".
Crashes
If Orbital closes unexpectedly it writes a report inside its own private storage holding the Android version, the phone's make and model, and the error. It also keeps a short list of the times it crashed, which is how it tells one bad launch from a loop.
If it crashes three times in a few minutes it starts over with a plain home screen, and copies the files it is about to empty before emptying them — your wheel, your widgets and your pages, and on a second attempt your settings and your priority list. That copy holds the text of any notes you wrote. It is kept so that what was lost still exists on the phone; there is no way to put it back from inside Orbital yet, so treat it as evidence rather than as a rescue. It sits in the same private storage as the report and goes when the report goes.
No code in Orbital uploads any of it, and nothing carries it off the phone behind your back. The report, the list of crash times, the note that a recovery happened and both recovery copies are all named in Orbital's two backup rule files, which keeps every one of them out of Android's cloud backup and out of phone-to-phone transfer alike. So a stack trace, your phone's make and model, and a copy of your home screen with the text of your notes in it stay on the phone they came from unless you move them yourself. You can save the report to a file of your own, or clear all of it from the control panel; a reset clears all of it; and the next crash writes over the report.
Locking the screen
Double-tap to lock is off unless you turn it on. Android does not let an ordinary app turn the screen off, so it goes through device administration. The one policy Orbital declares is force-lock: it cannot wipe the phone, set password rules, or see what you do. Turning the setting off gives the privilege back. While it is on, Android will ask you to deactivate it before you can uninstall Orbital.
The overlay
The overlay strip draws the same wheel over other apps. It is off unless you turn it on, it is only ever as tall as what it draws, and pushing it away leaves nothing but a handle to pull it back by. While it runs it keeps a notice in the notification shade, which is Android's rule for anything that stays running like this and is how you can always tell it is there. Turning it off is a switch in the control panel. It sends nothing anywhere.
What leaves Orbital without leaving the phone
Everything in this section goes to another app on the same phone rather than to a server. That is not the same as being sent over the internet, and it is not the same as staying put either: once something is in another app it is under that app's rules and not Orbital's; one of these carries your words to a Google account by default, and another hands your voice to an app that most likely recognizes it on a server. So they are written out rather than folded into "stays on the phone".
Notes, to-dos, and Google Keep
A note you type into the command bar has two places to go, and it arrives set to use both. One is the page you are on, where it becomes a note widget stored in Orbital's own private storage with the rest of your layout.
The other is Google Keep, and that switch arrives on too. Orbital sends the note's text, and the date and time as a heading, to Keep through Android's ordinary share mechanism — the same path a browser uses to share a page — and Keep opens with the note in it. It goes to another app on this phone, not to a server of Orbital's; Orbital has no account with Google, sends nothing else with it, and gets nothing back. What happens to it next is between you and Keep, whose own terms and syncing are Google's, and syncing is what Keep is for.
A to-do goes the same way. Beginning a line with "todo", "to do" or "later" makes Orbital ask when to remind you. Answer with a time and it becomes a reminder, which stays on this phone. Answer that you only want the note, and what you typed takes exactly the path a note takes, Keep included.
Nothing is sent if Keep is not installed. To turn it off: the control panel, Orbital Assistant, "Where notes go", the Google Keep switch. The home screen is a separate switch beside it, and with both off the assistant says it has nowhere to put a note rather than dropping it quietly.
A reminder is not a note in this sense: "remind me to call Sam at six" writes a note on the page and schedules the alarm, and nothing about it goes to Keep.
The notification shade
A note you write also appears in the notification shade, and that switch arrives on as well. The entry shows the note's first line, with the whole of it there when you pull the entry open; a to-do shows the same with its due time beside it. That is the point of the feature — the home screen is only in front of you when nothing else is, and the shade is always one swipe away — but it means a note's words are drawn somewhere other than the page you put them on.
Two things follow from that and are worth knowing. Whether the shade's contents show on your lock screen is your phone's own setting rather than Orbital's. And any other app you have granted notification access to can read Orbital's notifications the same way Orbital reads other apps' — that is what notification access is.
The channel is silent: no sound, no vibration, no badge. To turn it off: the control panel, Notifications, "Your own notes", "Keep notes in the shade". Reminders are posted the same way, on their own channel.
The clipboard
Ask the command bar for a sum and Orbital puts the answer on the system clipboard, labelled with the sum, so that it can be pasted somewhere. That is the only thing in Orbital that writes to the clipboard.
It is called out here because the clipboard belongs to the whole phone rather than to Orbital. On current versions of Android the app you are looking at can read what is on it; on versions before Android 10, so could apps sitting in the background. An arithmetic answer is rarely a secret, but it stays there until something else is copied over it, and nothing in Orbital — a reset included — clears it.
Handing a line to another app
A line the command bar could not read for itself has two ways out that stay on the phone, and both are a tap you make. They are offered whether or not you have pasted in an assistant key: a line the bar could not place is as likely to want one of these with a key as without.
"Search the web" hands what you typed to whatever app answers web searches on your phone, under that app's own policy. A line that starts with "search" always goes that way, and with no key pasted in the button at the bottom of the sheet does the same thing.
"Ask another app" opens your phone's share sheet with the line in it, and whichever app you pick receives exactly what you typed — an assistant, a notes app, a messaging app, anything installed that accepts text. Orbital does not choose the app, does not restrict the list, and never sees what the app does next.
The rest of what the command bar does has the same shape and is described where it comes up above: a message, an email or a call opens in your own app with the fields filled in and the send left to you; an event goes into your calendar; an alarm goes to your clock app; and a place opens in whatever your phone uses for maps, on a pin rather than on a route, because Orbital asks for the place and not for directions.
Speaking instead of typing
The microphone at the end of the command bar hands the listening to whatever app on your phone turns speech into words — on most phones that is Google's. Orbital holds no microphone permission and asks for none: that app records the audio under its own permission and hands Orbital back a line of text, which is put in the box for you to read and edit.
The hand-off is on the phone. What the recognizer does with the audio is not Orbital's to say, and on most phones recognition happens on a server rather than on the handset — so the audio may well leave, under that app's policy rather than this one. Orbital neither sees the recording nor learns which app took it.
Nothing is sent by Orbital until you tap the button underneath, and then the words go exactly where a typed line would have gone. Where the phone has nothing installed that can listen, the microphone is not drawn.
Layouts, and giving one to somebody else
The control panel can write your home screen out as a file, and it offers two different files because they are for two different purposes. Both are under "Layouts".
"Save a full copy, notes and all" is the private one. It is a copy of three of Orbital's preference files — the wheel, the widgets and the pages — and it takes everything in them, because putting your own home screen back means putting back what was written on it. So it holds the text of every note, the times of the reminders on those notes, the identifier of every person on your wheel or in a people row, the town your news widget is set to, and any feed addresses you added. It is not a file to hand to anybody, which is why the row says what it holds rather than only what it is for.
"Save this layout to share" is the one meant to be given away, and it is written differently. Rather than copying files, Orbital builds a new document field by field from a fixed list of what a shared layout is allowed to carry. It is the first of the two rows on purpose, because it is the one with a disclosure in front of it.
What goes into it: which pages exist and where they sit, and the name you typed on each one; for every widget, its kind, where it sits, how big it is and the small numbers saying how it is drawn; the name of each folder and the apps inside it; the app behind each shortcut; an app scroller's own settings line and the apps it was given; and all three rings of the orbit dock, as apps.
What is held back: the text of your notes, the times of your reminders, everyone on your wheel and in your people rows, the town your news is set to, the feeds and topics that widget follows, and widgets belonging to other apps, which mean nothing on another phone anyway. The screen that asks before writing lists each of those and how many of each were left out.
Two things travel that people do not expect, and Orbital puts both in front of you first. The first is the apps. A shared layout names every app on the wheel, in every folder and behind every shortcut, and which apps are on somebody's home screen can say a great deal about them. The second is the names you typed: a page called "Rehab" or a folder called "Dr Shapiro" crosses over exactly as you wrote it. Blanking those would take the most useful thing in a layout with it, and replacing them with something generic would mean showing you a name the file does not carry. So the confirmation screen lists every app that is going, by name, and every page and folder name that is going, and nothing is written until you have read that list and agreed to it.
Orbital also holds back apps it recognizes as personal, and that list cannot be complete. It ships inside the app as assets/holdback.txt, and it names dating and hookup apps, LGBTQ+ apps, sexual and reproductive health, mental health, recovery and addiction, particular conditions and medications, religion, and immigration and legal aid — partly as named apps, partly as words matched against whole parts of a package name so that apps nobody listed are still caught. It can only ever name apps somebody writing the list had heard of, and the apps that give the most away are often local, niche, or deliberately named to say nothing on a lock screen. Treat it as a floor and not as a promise. The list of apps on the confirmation screen is the part that does not depend on it, and it is the part to read. If a phone has no such list on it at all, the screen says so rather than implying a protection that did not run.
Where the file goes is yours. Orbital writes it to the place you choose in your phone's own file picker and does nothing else with it: it is not uploaded, and Orbital neither knows nor asks where you put it or who you send it to. Once it has gone to somebody, it is a file in their hands — there is no way to recall it, expire it, or change what is in it.
Loading a layout replaces your home screen. Either kind replaces every page, every widget and all three rings of the wheel. Orbital counts what that costs first — how many pages, widgets, docked apps and people go, and what your own pages and folders are called — and asks before it does it. The arrangement being replaced is copied first, so that "Put my old layout back" has something to find. That copy holds the text of your notes, the times of the reminders on them and the people who were on your wheel, which makes it the most personal file Orbital keeps. It sits in a directory Android's backup never takes, so it cannot travel. It goes when you tap "Forget the old layout", when another layout is loaded over it, when you restore defaults, or when you uninstall Orbital.
A shared layout from somebody else cannot bring their notes, their reminders or their contacts onto your phone. Orbital reads a layout file on the assumption that it is hostile: anything of that kind found in one is dropped rather than placed, and the screen afterwards says how much was dropped and why.
What leaves the phone
The weather
The weather card in the glance is on out of the box, but it cannot ask anything until you grant approximate location, and Orbital does not ask for that at install. Once you have, Orbital asks api.open-meteo.com what the weather is where you are — while the home screen is in front of you, and at most once every thirty minutes. A weather widget on a page does the same.
Orbital asks Android for coarse location only, never fine, and uses the last position Android already had rather than asking for a fresh fix. The coordinates are rounded to three decimal places — roughly a hundred metres — before the request is built. Nothing else goes with it: no name, no account, no identifier. The answer is held in memory and never written to disk. Open-Meteo's own privacy notice governs what they do with the request. To stop it: turn the weather card off and take any weather widget off the page, or withdraw the location permission.
The assistant
The command bar reads most of what people type on the phone itself, and that part never touches the network. With no API key, Orbital makes no internet request of its own from the command bar at all.
That is not the same as nothing leaving it, and the difference matters enough to spell out. Without a key, a line Orbital cannot read becomes a web search handed to whatever app answers searches on your phone, or goes to whichever app you pick if you press "Ask another app"; and a note or a to-do goes to Google Keep unless you have turned that off. Those are hand-offs to apps on this phone rather than requests of Orbital's, and they are described under "What leaves Orbital without leaving the phone".
There are three services you can paste a key for, and you choose which by pasting one in:
| Key | Where the line goes |
|---|---|
| Anthropic | api.anthropic.com |
| OpenAI | api.openai.com |
| Google Gemini | generativelanguage.googleapis.com |
With one key pasted in, that is the service, and nothing else has to be set. With more than one, the control panel is where you say which of them to ask. Whichever it is, a line Orbital could not read for itself is sent when you press Ask — on that press and at no other moment. Nothing is sent while you type, nothing is sent in the background, and nothing is sent for a line Orbital understood on its own. Only the service you chose is contacted. The other two are never sent anything, and a key you are not using is never sent anywhere either.
What goes in the request is exactly this: the line you typed, and the current local date and time, alongside the instructions telling the service to answer with a single errand. The instructions are word for word the same whichever of the three is being asked. There are no contacts in it, no app list, no location, no notifications and no identifier of any kind. Because it is whatever you typed, only you can know what is in it — if you would not put something in a message, do not type it into the command bar.
It goes straight from your phone to that company under your own key, with no Orbital server anywhere in the path. Anthropic, OpenAI and Google are separate companies; the terms of whichever one you chose govern what happens to the request after it arrives, and what is kept is between you and your own account there. To stop it: clear the key field in the control panel.
Your keys are stored in a file only Orbital can read. Android's cloud backup is told to skip that file, Android's phone-to-phone transfer is told to skip it, and Orbital's own backup export leaves it out, so it is yours to put back by hand on a new phone. It is not encrypted beyond the protection Android gives every app's private storage and whatever whole-device encryption your phone applies.
News
A news widget fetches headlines from news.google.com when it comes on screen, at most once every twenty minutes for the same set of sources, and again when you tap its header. The request carries the topics you chose and, for local news, the place you typed. No identifier and no account goes with it.
If what you typed is a five-digit US postal code, Orbital sends it to api.zippopotam.us to turn it into a town name, because the news feed is addressed by place rather than by postcode. An answer is kept on the phone so it is not asked again. Only an answer: if the lookup fails, because you are offline or because the service does not know that code, the postcode goes again on the next fetch.
If you paste a feed address in yourself, Orbital fetches it from whatever site that address points at, and that site sees the request. Headlines are cached on the phone so the widget has something to show before the next fetch. To stop all of this: take the news widget off the page.
The feed
The feed widget does nothing until you add one and sign in. Orbital reads Bluesky and Mastodon, which are the two networks that still let a third party read your own timeline.
The two networks ask for different things, and what ends up on the phone differs with them.
For Bluesky you type your handle and an app password. Both go over HTTPS to the server you named — bsky.social unless you name another — which hands back a session token and a refresh token, and those are what Orbital stores. The app password itself is never written down.
For Mastodon you type the host and an access token you made yourself on that server. There is nothing to exchange it for: the token is what goes to the server, and the token is what is kept. So on Mastodon the thing stored on your phone is precisely the thing you typed.
Either way it goes directly to the server you named and to nobody else, and there is no Orbital server in the path. What is stored sits in the same file as your assistant keys, with the same three exclusions: Android's cloud backup, Android's phone-to-phone transfer, and Orbital's own backup export. It is used to read your timeline and for nothing else. Afterwards the widget fetches your timeline from that server when it comes on screen and when you tap to refresh.
To stop it: sign the account out from inside the widget, which deletes its token from the phone; a reset signs out every account for the same reason. You can also revoke the app password or token from the service's own settings, which is the only way to be certain, since only that server can tell you what still has access.
Fonts
The Terminal lettering is fetched by Google's downloadable-fonts provider, which is part of Play Services and already on the phone. That is a request for a font file and carries nothing about you. If the provider is not there, Orbital uses a monospace font your phone already has.
This is the one outbound request with no permission, no widget and no key in front of it, so it is worth saying where it comes from. Picking the Terminal lettering starts it, and so does picking a theme that letters itself in Terminal, because a theme sets the lettering along with everything else. Orbital arrives set to your phone's own lettering, so nothing is fetched until you choose.
What Orbital stores, and Android's backup
Almost everything Orbital saves is a preference file inside its own private storage: your settings, the wheel and the dock, your pages and widgets — including the text of any notes you wrote and the place typed into a news widget — the people and apps you marked as important, your reminders and a record of the alarms you asked your clock app for, the cached headlines, and the usage counts. The rest are plain files in the same private storage: the crash files described above, and the copy of the arrangement Orbital keeps when you load a layout over it.
Android's own automatic backup copies most of that to your Google account. That is Android's backup rather than Orbital's; it is governed by Google's terms and you can turn it off in your phone's settings. Android's rule is that it takes everything an app stores except what the app names in two exclusion files, so the honest way to say this is as two lists rather than as a summary.
What travels, if Android's backup is on: your settings; your layout, meaning the pages with their names, the widgets and the wheel, and therefore the text of any notes you wrote and the identifier of everyone you put on the wheel; the names of the contacts you marked as important; the cached headlines and the town a postal code was resolved to; and the counts of what you open and of where the overlay keeps being pushed aside. All of it goes to your Google Drive, where Orbital never sees it again.
What does not travel, because Orbital names each one in both res/xml/backup_rules.xml and both halves of res/xml/data_extraction_rules.xml, keeping them out of the cloud backup and out of phone-to-phone transfer alike: your assistant keys and your Bluesky and Mastodon tokens, which share one file; your reminders; the crash report; the list of crash times; the record that a recovery happened; and both recovery copies. The copy kept when you load a layout is not in that list because it does not need to be — it lives in a directory Android's backup never takes at all.
"Save a backup" in the control panel writes your settings, wheel, widgets, pages and priority list to a file wherever you choose. That file is yours; Orbital does not upload it or know where you put it. It is worth remembering that it holds the text of any notes you wrote. It leaves out your key, your feed tokens, your reminders and the usage counts. A layout file is a different thing and is described under "Layouts, and giving one to somebody else".
How to delete everything
- Restore defaults, in the control panel, clears your settings, the wheel, your pages, widgets and notes, your priority list, your reminders, the usage counts, and the news widget's stored file — which is where the town a postcode was resolved to lives, and that is gone for good. The cached headlines go from that file too, but a launcher that is still running holds its own copy of them and can write some back; they are public headlines, and the town is the part that mattered. A reset also cancels every reminder Orbital had waiting; takes Orbital's notes and reminders out of the notification shade, though the overlay's own notice stays while the overlay is running, because Android requires a running service to show one; signs out of every Bluesky and Mastodon account; and deletes the crash report along with the crash times, the recovery note and the recovery copies. It keeps your assistant keys, because nothing sends one anywhere on its own and a key cannot be read back off the phone once it is gone.
- Alarms are the exception, and a reset cannot take them back. An alarm Orbital set is an entry in your clock app, not in Orbital. Orbital can ask that app to dismiss one, but asking is the whole of it: there is no answer, and a clock app is free to show its own screen instead, to ignore the request, or to refuse it. A reset does not ask — it would be a poor way to stop a phone waking somebody up — so it drops Orbital's record and leaves the alarms alone. They are in your clock app's own list, with "(Orbital)" on the end of their labels.
- A note already in Google Keep belongs to Keep. Clearing Orbital's notes cannot reach a copy that has been sent there; delete that one in Keep. Switching the Keep destination off stops any more from going.
- The copy of your previous layout — the one "Put my old layout back" uses — holds the text of your notes and the people who were on your wheel. Restoring defaults deletes it, along with the offer to put that layout back. So does "Forget the old layout" in the control panel under Layouts, loading another layout over it, and uninstalling Orbital.
- A layout or backup file you saved is yours, and one you sent somebody is theirs. Orbital cannot reach either. Delete the file where you put it. A copy already handed to somebody else cannot be recalled.
- Whatever is on the clipboard stays there until something else is copied over it. A reset does not clear it.
- Clearing an assistant key field in the control panel removes that key. There is one field per service, so clearing all three is what stops the command bar making any request of its own.
- Signing out of a feed account, from inside the widget, deletes that account's token.
- Uninstalling Orbital removes the whole sandbox: every preference file, every crash file, the kept copy of a previous layout, the cached headlines, your key and your tokens. If Android's backup has already copied your settings to your Google account, that copy is managed from your Google account's backup settings, not from Orbital.
There is no account to close and no server to write to, because Orbital has neither.
Children
Orbital is not directed at children. There is no account to make, no profile kept on anybody, and nothing at all goes to Orbital's maker. What does leave the phone is listed above, along with what starts it.
Changes
If Orbital starts doing something this document does not describe, this document changes first. The date at the top is when it last changed, and the new version is published before the release it applies to.
Contact
Alid0n — alid0ndev@gmail.com
Write for anything: a question about this policy, something in it you think is wrong, or a request about your data. There is no form and no ticket system; it is one person and an email address.