Orbital Launcher privacy policy

Orbital Launcher is a home screen for Android, made by Alid0n. To be a home screen it has to read a certain amount about your phone. This is the whole of what it reads, where each piece goes, and what leaves the device.

There is no Orbital account and no sign-in to Orbital. There is no analytics library, no crash-reporting service and no ad network in the app, and no advertising identifier is read. Nothing you do in Orbital is gathered up by its maker, profiled or sold. Orbital's own website and its small server are contacted for three things only: the theme store, layout codes and the referral programme, each described below. Some things go to other companies, because you switched on a feature that needs them — that is the list below, and it is the whole of it.

The short version

Almost everything stays on the phone: your apps, your contacts, your calendar, your notifications, what you open and how often, and the layout you build. Your notes stay too, with one exception: unless you turn it off, Orbital also hands a note or a to-do you type into the command bar to Google Keep. See "Notes, to-dos, and Google Keep" below.

Six kinds of request can go out to the internet. Each needs something from you before it can happen — a permission you granted, a widget you added, or a key you pasted in:

1. Rough coordinates go to Open-Meteo, so the glance can tell you the weather.
2. A line you type into the command bar goes to Anthropic, OpenAI or Google — whichever one you pasted a key for — only when you have pasted in a key at all, and only for the lines Orbital could not read by itself.
3. A request to arrange your home screen, with a short summary of it, goes to Anthropic, OpenAI or Google only if you add a cloud brain with your own key and agree to the notice that names what is sent. Orbital never receives it. See "Cloud brains (optional, Premium)".
4. The topics you chose, and the place you typed go to Google News, for the news widget.
5. A place you type for the news widget or the weather — a US postal code or a town name — goes to Zippopotam (for a postal code) or to Open-Meteo's geocoder (for a town name), to turn it into a town and its coordinates. The answer is kept on the phone, so a place that resolves is sent once.
6. Your handle and app password on Bluesky, or your access token on Mastodon, go to the server you named, if you add a feed widget and sign in — and then to nowhere else.

A few more things go out that are not on that list, and none of them is covered by the sentence above. A feed address you paste into the news widget yourself is fetched from whatever site that address points at. Choosing a lettering, or a theme that sets one, fetches that font through Play Services, which carries nothing about you but is still a request leaving the phone. The theme store fetches its list and its themes from orbitallauncher.com. Each time Orbital starts, it asks its server whether the referral programme is running. Android's own backup copies most of Orbital's settings to your Google account. And the smart widget can ask Android's own geocoder where an event's address is, which on most phones Android answers through Google Play services over the network. Downloading an on-device brain fetches its model file from Hugging Face; the brain itself then runs on the phone and sends nothing. All of these are described below.

The smart widget, part of Orbital Premium, does its work on the phone: it reads your notifications, calendar and a few details of the phone's state to choose what to show, and keeps only a small table of when you open apps and today's list of the cards it showed. See "The smart widget" below.

Several more things leave Orbital without leaving the phone, by being handed to another app on it. A note or a to-do you type into the command bar goes to Google Keep, with no permission, no widget and no key in front of it, and the switch for that arrives on. A note's words are also drawn into the notification shade. The answer to a sum goes to the system clipboard. A line Orbital could not read becomes a web search in your browser or search app, or goes to whichever app you pick out of the share sheet if you ask it to, and a web address you type opens in your browser. An event's address goes to your maps app when you tap Directions or Navigate on the smart widget. None of those is a server of Orbital's, and none of them is nothing either: they are all under "What leaves Orbital without leaving the phone".

A layout you save to share is a file whose whole purpose is to be handed to somebody else. What it carries, what is held back, why the holding back cannot be complete, and what happens to the file afterwards are under "Layouts, and giving one to somebody else".

Orbital Premium, if you buy it, is bought through Google Play, and the purchase is made and handled by Google Play rather than by Orbital. Orbital receives no card details, and keeps only a note on the phone of whether Premium is active. That is under "Orbital Premium, and Google Play".

The referral programme (a month of Premium for you and a friend) uses a one-way hashed device identifier and a Google Play integrity check, only for referral fraud prevention and reward delivery, kept only while the referral or reward is active plus 90 days. While the programme is running, every copy of Orbital uses them to ask whether a reward is due. That is under "Sharing your setup, layout codes and referrals".

Two things Orbital can do that are worth knowing before you do them rather than after: it can delete events from your calendar, and clearing a day takes a repeating event away entirely rather than the one occurrence. Both are under "Calendar".

What Orbital reads, and why

Orbital asks for none of this at install time. The intro lists each one with what it switches on, and you can grant them one at a time, all together with "Grant all", or later from Permissions in the settings. Otherwise each is requested when something needs it, and whatever you decline simply goes quiet. The intro itself sends nothing anywhere; what you choose in it is saved with your settings and layout.

Orbital holds no permission to read your text messages, your call history, your photos, your videos or your files, and it does not ask for one. The command bar searches your apps and your contacts and nothing else — there is nothing else it is able to search. Why photos and messages will not be added later is written into the source, at assistant/Finder.kt, as a note to anyone who might try.

What stays on the phone

Notifications

Orbital reads notifications through Android's notification listener, which you grant yourself in system settings and can take back there at any time. It is what puts a count and the latest line in the glance, dots on app icons, and the now-playing controls on the screen. For Now Playing, the same grant lets Orbital read what the playing app shares about it — the title, the artist, the artwork and the position — which is held in memory only.

Android hands this access over whole. There is no version of it that covers only some apps, so granting it means Orbital is shown every notification on the phone rather than only the ones you wanted it for. Orbital says so in the app as well, on the screen in front of the button that sends you to the system setting.

While a notification exists, Orbital holds the app it came from, its title, one line of its text, the time it arrived, and the app's own way back to what the notification is about, so that tapping one here opens the conversation rather than the app. For a message or an email the title and the line are the sender and the preview, because that is what the notification contains. None of it is written to storage and none of it is sent anywhere: it sits in memory for as long as the notification does and goes when the notification goes. The one exception is the smart widget's list of the cards it showed today, described under "The smart widget".

The grant also lets Orbital take a notification down, which is what dismissing one from the glance does. It cannot read anything the notification does not carry, and it does not send or reply to anything.

Contacts

Orbital reads names, photographs, phone numbers and email addresses so that people can be put on the wheel and reached from the command bar.

Opening the command bar reads the numbers and the addresses out of your whole address book, because "text mum" and "email sam" have to find the right person without stopping to ask you which one. That list is held for as long as the bar is open and dropped when it closes. An address is used in two places and nowhere else: it fills in the email the command bar opens for you, and it is the line shown under a name in the search results for somebody whose entry has no number.

That read happens whenever the bar opens, and no switch in Orbital stops it. The "People in the results" switch, under "What it searches" in the assistant's settings, decides only whether people appear among the results you see. Withdrawing the contacts permission in your phone's settings is what stops the reading.

Only the people you actually put on the wheel are stored, and only by the identifier Android uses for them. People you mark as important are stored by the name shown on the phone, because that is what a messaging app writes into a notification title. The rest of your address book is read when a screen needs it and forgotten when that screen closes.

Orbital sends no contact to anybody. A number or an address the command bar uses goes into a message or an email that your own app opens, with the send left to you. Two smaller paths are worth naming rather than covering with an absolute: the identifiers of the people on your wheel sit inside your layout (and inside a keyboard shortcut you set to open one of them), and the names on your priority list inside that list, so both ride along with Android's backup and with any backup or private layout file you save yourself. A layout saved to share, and a settings file for another phone, hold people back entirely.

Calendar

Orbital reads the start time, title, all-day flag and colour of upcoming events, for the month view and the glance, and writes an event when you ask the command bar for one. Nothing from your calendar is stored apart from the smart widget's list of today's cards, and nothing is sent to any server of Orbital's. The smart widget reads a little more, and can pass an event's address to Android's own geocoder; both are described under "The smart widget".

Orbital can also delete an event. Asking the command bar to clear a day — "clear Tuesday" — opens that day's list with a × beside each entry, and tapping one takes that event off your calendar straight away. There is no confirmation step and no undo inside Orbital. It needs permission to write to your calendar, which Orbital asks for alongside permission to read when you connect the calendar to the glance or to a month widget, and again on the clear-a-day screen if you have not granted it. Decline and the day stays readable and nothing else.

A repeating event goes entirely. Orbital removes the event rather than the single occurrence, so clearing one Tuesday takes every other Tuesday with it. That is deliberate, and it is not what "clear Tuesday" sounds like, so it is written here: to lose one occurrence and keep the series, do it in your calendar app instead.

What you open

Orbital keeps its own tally of which apps you open and how often, so the wheel can put the ones you use first, and when each app was last opened, for the drawer's "Last used" order. It notes which apps you tend to push the overlay aside in, and which music apps have played, up to twelve, so a Now Playing widget with nothing playing can open the one you last used. Nothing in Orbital sends any of them anywhere. Reset everything clears all but the music apps.

They are not among the files Orbital keeps out of Android's backup, though, so if that backup is on they go up to your Google account with the rest of your settings. Orbital's own "Save a backup" leaves them out, because they describe one phone rather than one person. They are under "What Orbital stores, and Android's backup".

The smart widget keeps a separate, smaller table of when you open apps, which never leaves the phone in any backup. It is described in the next section.

The smart widget

The smart widget is part of Orbital Premium. It shows the one or two things most useful right now, and everything it reads is processed on the phone. Nothing it reads is sent to Orbital or to anybody else, with the one exception of the geocoder described below.

• Notifications, only if you have granted notification access. Missed calls and messages are shown as you choose in the widget's settings: counts only, the senders (the default), or the first line of each message. Where a sender is shown as a phone number, the widget can offer to call or text it. Notifications about deliveries, flights, rides and bookings are also read on the phone for a status — out for delivery, a gate, a driver arriving — and shown as a card, never the notification itself.
• Your calendar, only with the calendar permission and while "Use my calendar" is on. The widget reads today's and tomorrow's events — their times, titles, locations, and descriptions, so a meeting link or a phone number can be offered — for today's plan, the next event and tomorrow's first event. Birthdays and anniversaries come from your calendar the same way; to find the birthdays calendar, the widget reads each calendar's name and the account it belongs to.
• When you open apps. To suggest apps, the widget keeps a small table of counts: for each app, how often it was opened in each hour of the day on weekdays and on weekends, and how many of those times headphones were in, the phone was charging, or an event with an address was coming up. It holds counts, never times, keeps at most 40 apps, and lets old habits fade.
• Screen time, only if you have granted usage access. It is worked out on the phone from Android's own usage records.
• Your location, only if you have already allowed it for the weather. The widget uses the last position the phone already has, never a fresh fix, to show a straight-line distance to an event.
• Headphones, a car connection and Do Not Disturb. Their current state is read on the phone to choose which cards to show. Headphones are recognised by the kind of audio output, never by a device's name.
• The battery, your next alarm, your reminders and what is playing. The battery level, whether it is charging and how long until it is full; the time of the next alarm in your clock app; Orbital's own reminders; and the media playing now, with the music apps described under "What you open".
• Weather. The weather cards use the same forecast described under "The weather".

Finding an event's address. To work out that distance, the widget passes the event's address to Android's own geocoder. It does so only when location is allowed and the phone already knows where it is. The geocoder is part of Android rather than Orbital, and on most phones it answers through Google Play services over the network, so the address may leave the phone under Google's privacy policy. The answer is held in memory for a few hours and never written to storage.

Directions. Tapping Directions or Navigate on an event hands its address to your maps app, which opens on the phone. What that app does next is under its own policy.

What is stored. The table of app habits, and today's list of the cards the widget showed — each card's title and one line, as they appeared on the home screen, and when it was first shown — along with which cards you have already seen or put off. The list starts again each day. All of it sits in the widget's own file, which is excluded from Android's cloud backup and from phone-to-phone transfer, is left out of every backup and layout file Orbital writes, and is cleared by Reset everything in the control panel.

Orbital also contains a stock quote feature. It is not active: it is not offered, and no quote data is fetched.

Effects, icon packs and wallpapers

Some home-screen effects react to the phone: parallax reads the motion sensor, the charging effect reads the battery, the notifications effect reads the notification count, and the weather effect uses the forecast Orbital already has. All of it is read on the phone, and nothing is kept or sent. The animations and effects you choose are saved with your settings. If you choose an icon pack, Orbital reads the icons from that installed app. Orbital can set your phone's wallpaper to one of its own or to a theme's picture, and reads your current wallpaper's colours to match its previews; it never reads the picture itself.

Crashes

If Orbital closes unexpectedly it writes a report inside its own private storage holding the Android version, the phone's make and model, and the error. It also keeps a short list of the times it crashed, which is how it tells one bad launch from a loop.

If it crashes three times in a few minutes it starts over with a plain home screen, and copies the files it is about to empty before emptying them — your wheel, your widgets and your pages, and on a second attempt your settings and your priority list. That copy holds the text of any notes you wrote. It is kept so that what was lost still exists on the phone; there is no way to put it back from inside Orbital yet, so treat it as evidence rather than as a rescue. It sits in the same private storage as the report and goes when the report goes.

No code in Orbital uploads any of it, and nothing carries it off the phone behind your back. The report, the list of crash times, the note that a recovery happened and both recovery copies are all named in Orbital's two backup rule files, which keeps every one of them out of Android's cloud backup and out of phone-to-phone transfer alike. So a stack trace, your phone's make and model, and a copy of your home screen with the text of your notes in it stay on the phone they came from unless you move them yourself. You can save the report to a file of your own, or clear all of it from the control panel; a reset clears all of it; and the next crash writes over the report.

Locking the screen

Orbital can turn the screen off in two places, and both are off unless you turn them on. One is double-tapping empty space on the home screen. The other is kids mode: if Orbital itself stops working while kids mode is on, it ends kids mode so that you are not locked out, and locks the phone as it goes, so the way back in is your usual unlock rather than an open handset. Kids mode works without this; without it the phone comes back unlocked instead.

Android does not let an ordinary app turn the screen off, so both go through device administration. The one policy Orbital declares is force-lock: it cannot wipe the phone, set password rules, or see what you do. Turning off the last thing that uses it gives the privilege back — so turning double-tap off releases it unless you have a kids mode code set, and forgetting that code releases it as well. While it is held, Android will ask you to deactivate it before you can uninstall Orbital.

The overlay

The overlay strip draws the same wheel over other apps. It is off unless you turn it on, it is only ever as tall as what it draws, and pushing it away leaves nothing but a handle to pull it back by. While it runs it keeps a notice in the notification shade, which is Android's rule for anything that stays running like this and is how you can always tell it is there. Turning it off is a switch in the control panel. It sends nothing anywhere.

The phone's assistant gesture

You can choose Orbital as the phone's digital assistant in Android's settings. Its assist gesture or assist key then opens Orbital's command bar over whatever app is in front, and the bar works exactly as it does on the home screen. It is off unless you choose it, and choosing another assistant in the same place turns it off.

When the assistant is opened, Android may pass along the name of the app in front and whatever that app offers to share with an assistant. Orbital reads none of it: the command bar starts empty and knows only what you type into it. While kids mode is on, the gesture opens nothing.

The slash shortcut

On a phone with a hardware keyboard, you can have a slash open Orbital's command bar from inside any app. It is off unless you turn it on, first on Orbital's Keyboard page and then in Android's Accessibility settings, where it is listed as Orbital slash shortcut.

Android lets an app notice a key pressed inside another app only through Accessibility, and it hands such an app every key pressed on a hardware keyboard, in every app. Orbital acts on one: a slash pressed on its own, while no text box has the cursor. Every other key goes straight on to the app you are in. No key is stored, and none is sent anywhere.

To tell whether you are typing, Orbital asks Android whether the box with the cursor can be typed into, and whether the app in front is Orbital itself. It does not read what is written in the box, and it listens to nothing else Android can describe about the screen. The shortcut stands down in kids mode and on the lock screen. Turning it off on the Keyboard page turns it off in Android's settings too.

What leaves Orbital without leaving the phone

Everything in this section goes to another app on the same phone rather than to a server. That is not the same as being sent over the internet, and it is not the same as staying put either: once something is in another app it is under that app's rules and not Orbital's; one of these carries your words to a Google account by default, and another hands your voice to an app that most likely recognizes it on a server. So they are written out rather than folded into "stays on the phone".

Notes, to-dos, and Google Keep

A note you type into the command bar has two places to go, and it arrives set to use both. One is the page you are on, where it becomes a note widget stored in Orbital's own private storage with the rest of your layout.

The other is Google Keep, and that switch arrives on too. Orbital sends the note's text, and the date and time as a heading, to Keep through Android's ordinary share mechanism — the same path a browser uses to share a page — and Keep opens with the note in it. It goes to another app on this phone, not to a server of Orbital's; Orbital has no account with Google, sends nothing else with it, and gets nothing back. What happens to it next is between you and Keep, whose own terms and syncing are Google's, and syncing is what Keep is for.

A to-do goes the same way. Beginning a line with "todo", "to do" or "later" makes Orbital ask when to remind you. Answer with a time and it becomes a reminder, which stays on this phone. Answer that you only want the note, and what you typed takes exactly the path a note takes, Keep included.

Nothing is sent if Keep is not installed. To turn it off: the control panel, Orbital Assistant, "Where notes go", the Google Keep switch. The home screen is a separate switch beside it, and with both off the assistant says it has nowhere to put a note rather than dropping it quietly.

A reminder is not a note in this sense: "remind me to call Sam at six" writes a note on the page and schedules the alarm, and nothing about it goes to Keep.

The notification shade

A note you write also appears in the notification shade, and that switch arrives on as well. The entry shows the note's first line, with the whole of it there when you pull the entry open; a to-do shows the same with its due time beside it. That is the point of the feature — the home screen is only in front of you when nothing else is, and the shade is always one swipe away — but it means a note's words are drawn somewhere other than the page you put them on.

Two things follow from that and are worth knowing. Whether the shade's contents show on your lock screen is your phone's own setting rather than Orbital's. And any other app you have granted notification access to can read Orbital's notifications the same way Orbital reads other apps' — that is what notification access is.

The channel is silent: no sound, no vibration, no badge. To turn it off: the control panel, Notifications, "Your own notes", "Keep notes in the shade". Reminders are posted the same way, on their own channel.

The clipboard

Ask the command bar for a sum and Orbital puts the answer on the system clipboard, labelled with the sum, so that it can be pasted somewhere. Two other things write to it: tapping Copy on a layout code in the share sheet, and a bug report on a phone with no email app at all, described under "Reporting a bug" below.

It is called out here because the clipboard belongs to the whole phone rather than to Orbital. On current versions of Android the app you are looking at can read what is on it; on versions before Android 10, so could apps sitting in the background. What Orbital puts there stays until something else is copied over it, and nothing in Orbital — a reset included — clears it.

Handing a line to another app

A line the command bar could not read for itself has two ways out that stay on the phone, and both are a tap you make. They are offered whether or not you have pasted in an assistant key: a line the bar could not place is as likely to want one of these with a key as without.

"Search the web" opens a page of search results for what you typed, in your browser. The words go to the search engine that goes with your phone's search app or browser: DuckDuckGo, Bing, Brave Search, Ecosia or Qwant where that app is one of theirs, and Google Search otherwise. Where the Google app is the one your phone uses for web searches, the search is handed to that app instead. Either way the search is made by your browser or search app, not by Orbital, and it is under that search engine's own policy. A line that starts with "search" or with "*" always goes that way, and with no key pasted in the button at the bottom of the sheet does the same thing.

"Ask another app" opens your phone's share sheet with the line in it, and whichever app you pick receives exactly what you typed — an assistant, a notes app, a messaging app, anything installed that accepts text. Orbital does not choose the app, does not restrict the list, and never sees what the app does next.

A line that starts with "?" is a question for the assistant. With a key pasted in, it goes to the service you chose when you press Ask, as described under "The assistant" below; without one, the button at the bottom of the sheet is "Ask another app".

A web address typed as the whole line — "example.com", say, or "https://example.com/page" — opens in your browser, or in an app that handles that address, as any link on your phone does. The address is all that is handed over.

The rest of what the command bar does has the same shape and is described where it comes up above: a message, an email or a call opens in your own app with the fields filled in and the send left to you; an event goes into your calendar; an alarm goes to your clock app; and a place opens in whatever your phone uses for maps, on a pin rather than on a route, because Orbital asks for the place and not for directions.

Reporting a bug

Start a line in the command bar with "report a bug", "bug" or "@Orbital" and Orbital writes an email to the Orbital team at OrbitalLauncher@gmail.com, then opens it in your own email app. Nothing is sent until you send it there, and you can read and change every word first.

The email holds what you typed, and under it a short list of details that help us reproduce the problem: Orbital's version, the Android version, the phone's make and model, whether it was on a phone, a folded foldable or a large screen, and the theme, home layout and dock style you had chosen. Nothing else — no contacts, no location, no list of your apps. It goes from your email account, so we see the address you send it from, and we use the report only to fix the problem.

If no app on the phone can send email, the report is put on the clipboard instead, so that you can paste it into an email yourself.

Speaking instead of typing

The microphone at the end of the command bar hands the listening to whatever app on your phone turns speech into words — on most phones that is Google's. Orbital holds no microphone permission and asks for none: that app records the audio under its own permission and hands Orbital back a line of text, which is put in the box for you to read and edit.

The hand-off is on the phone. What the recognizer does with the audio is not Orbital's to say, and on most phones recognition happens on a server rather than on the handset — so the audio may well leave, under that app's policy rather than this one. Orbital neither sees the recording nor learns which app took it.

Nothing is sent by Orbital until you tap the button underneath, and then the words go exactly where a typed line would have gone. Where the phone has nothing installed that can listen, the microphone is not drawn.

Layouts, and giving one to somebody else

The control panel can write your home screen out as a file, and it offers two different files because they are for two different purposes. Both are under "Layouts".

"Save a full copy, notes and all" is the private one. It is a copy of the files that hold your arrangement — the wheel, the widgets, the pages, the drawer's home widgets, the drawer's own tabs, folders and pages, and a foldable's big-screen settings — and it takes everything in them, because putting your own home screen back means putting back what was written on it. So it holds the text of every note, the times of the reminders on those notes, the identifier of every person on your wheel or in a people row, the town your news widget is set to, and any feed addresses you added. It is not a file to hand to anybody, which is why the row says what it holds rather than only what it is for.

"Save this layout to share" is the one meant to be given away, and it is written differently. Rather than copying files, Orbital builds a new document field by field from a fixed list of what a shared layout is allowed to carry. It is the first of the two rows on purpose, because it is the one with a disclosure in front of it.

What goes into it: which pages exist and where they sit, and the name you typed on each one; for every widget, its kind, where it sits, how big it is and the small numbers saying how it is drawn; the name of each folder and the apps inside it; the app behind each shortcut; an app scroller's own settings line and the apps it was given; and all three rings of the orbit dock, as apps.

What is held back: the text of your notes, the times of your reminders, everyone on your wheel and in your people rows, the town your news is set to, the feeds and topics that widget follows, widgets belonging to other apps, which mean nothing on another phone anyway, and shortcuts added from other apps, which name a web page, a contact or a place as well as the app. The screen that asks before writing lists each of those and how many of each were left out.

Two things travel that people do not expect, and Orbital puts both in front of you first. The first is the apps. A shared layout names every app on the wheel, in every folder and behind every shortcut, and which apps are on somebody's home screen can say a great deal about them. The second is the names you typed: a page called "Rehab" or a folder called "Dr Shapiro" crosses over exactly as you wrote it. Blanking those would take the most useful thing in a layout with it, and replacing them with something generic would mean showing you a name the file does not carry. So the confirmation screen lists every app that is going, by name, and every page and folder name that is going, and nothing is written until you have read that list and agreed to it.

Orbital also holds back apps it recognizes as personal, and that list cannot be complete. It ships inside the app as assets/holdback.txt, and it names dating and hookup apps, LGBTQ+ apps, sexual and reproductive health, mental health, recovery and addiction, particular conditions and medications, religion, and immigration and legal aid — partly as named apps, partly as words matched against whole parts of a package name so that apps nobody listed are still caught. It can only ever name apps somebody writing the list had heard of, and the apps that give the most away are often local, niche, or deliberately named to say nothing on a lock screen. Treat it as a floor and not as a promise. The list of apps on the confirmation screen is the part that does not depend on it, and it is the part to read. If a phone has no such list on it at all, the screen says so rather than implying a protection that did not run.

Where the file goes is yours. Orbital writes it to the place you choose in your phone's own file picker and does nothing else with it: it is not uploaded, and Orbital neither knows nor asks where you put it or who you send it to. Once it has gone to somebody, it is a file in their hands — there is no way to recall it, expire it, or change what is in it.

Loading a layout replaces your home screen. Either kind replaces every page, every widget and all three rings of the wheel. Orbital counts what that costs first — how many pages, widgets, docked apps and people go, and what your own pages and folders are called — and asks before it does it. The arrangement being replaced is copied first, so that "Put my old layout back" has something to find. That copy holds the text of your notes, the times of the reminders on them and the people who were on your wheel, which makes it the most personal file Orbital keeps. It sits in a directory Android's backup never takes, so it cannot travel. It goes when you tap "Forget the old layout", when another layout is loaded over it, when you use Reset everything, or when you uninstall Orbital.

A shared layout from somebody else cannot bring their notes, their reminders or their contacts onto your phone. Orbital reads a layout file on the assumption that it is hostile: anything of that kind found in one is dropped rather than placed, and the screen afterwards says how much was dropped and why.

My Saved Layouts, sharing and submitting

"Save My Layout" on Look & Feel keeps your look and arrangement together as one layout in the theme store, under My Saved Layouts: the theme and colors, the styles, motion, dock, drawer, gesture and foldable settings, the pages and their names, each widget's kind, place and size, the folders and what is in them, the drawer home's widgets, which apps sit where, and one of Orbital's own wallpapers if one is on your home screen. It is built from a fixed list, like the shared layout above, so it never holds what your notes say, reminders, contacts, the weather's place, the news widget's topics and feeds, calendar details, other apps' widgets, shortcuts added from other apps, hidden apps, kids mode, keyboard shortcuts, the assistant's service or keys, or any account. It is kept in Orbital's own files on your phone, and like your other settings it can travel with Android's backup.

Sharing a saved layout writes that same layout to a file and hands it to the app you pick in Android's share sheet. Before it goes, apps Orbital recognizes as personal are held back (the same list described above), and the screen names every app that is going. Orbital does not upload it or know where it went.

Submitting a layout opens your email app with the layout file attached, addressed to orbitallauncher@gmail.com, so that it can be reviewed and perhaps included in Orbital. Nothing is sent unless you send that email yourself, and it holds only what a shared layout holds, plus your email address as your email app sends it.

A layout file opened with Orbital, or imported from the theme store, is read with the same hostile-file rules as above and added to My Saved Layouts after you confirm. Nothing on your home screen changes until you choose to apply it, and applying one can be undone from the theme store.

Copying your settings to another phone

"Copy my settings to another phone" writes a file with how Orbital looks and behaves — the theme, the dock, the drawer, gestures and the like — and hands it to the app you pick in Android's share sheet. It leaves out your pages, apps and notes, and the settings that say something about you: the weather's place, hidden apps, kids mode, keyboard shortcuts, and the assistant's keys. Opening such a file changes settings only, after you confirm, and can be undone straight away.

Importing your home screen from another launcher

"Import your home screen" reads a backup file that another launcher saved, which you pick in your phone's file picker. It is read on the phone, and a temporary copy made while reading is deleted afterwards. Orbital keeps only what it needs to rebuild your home screen: the apps on each page and in the dock, folders and their names, the grid, the default page and the icon pack, plus a list of widgets and shortcuts for you to add again. Nothing from the file is uploaded. Your previous home screen is kept in the same private copy as a loaded layout, so it can be put back.

What leaves the phone

The weather

The weather card in the glance is on out of the box, but it cannot ask anything until you grant approximate location or type a place in the weather settings, and Orbital does not ask for location at install. Once it has one or the other, Orbital asks api.open-meteo.com what the weather is there — while the home screen is in front of you, and at most once every thirty minutes. A weather widget on a page does the same.

Orbital asks Android for coarse location only, never fine, and uses the last position Android already had rather than asking for a fresh fix. Where there is no position, it uses the place you typed instead. The coordinates are rounded to three decimal places — roughly a hundred metres — before the request is built. Nothing else goes with it: no name, no account, no identifier. The answer is held in memory and never written to disk. Open-Meteo's own privacy notice governs what they do with the request.

A place you type is turned into coordinates once. A five-digit US postal code goes to api.zippopotam.us, and a town name, or a code that service does not know, goes to Open-Meteo's geocoder at geocoding-api.open-meteo.com. What comes back is kept on the phone in a file that stays out of Android's backup, so the same place is not asked again; a lookup that fails is tried again next time. The place you typed is kept with your settings, and Reset everything leaves it in place so the weather keeps working. To stop all of it: turn the weather card off and take any weather widget off the page, or withdraw the location permission and clear the place.

The assistant

The command bar reads most of what people type on the phone itself, and that part never touches the network. With no API key, Orbital makes no internet request of its own from the command bar at all.

That is not the same as nothing leaving it, and the difference matters enough to spell out. Without a key, a line Orbital cannot read becomes a web search, opened as a page of results in your browser or handed to the Google app where that is your search app, or goes to whichever app you pick if you press "Ask another app"; a web address you type opens in your browser; and a note or a to-do goes to Google Keep unless you have turned that off. Those are hand-offs to apps on this phone rather than requests of Orbital's, and they are described under "What leaves Orbital without leaving the phone".

There are three services you can paste a key for, and you choose which by pasting one in:

Asking one of these services is part of Orbital Premium; without Premium, nothing is sent even with a key pasted in. With one key pasted in, that is the service, and nothing else has to be set. With more than one, the control panel is where you say which of them to ask. Whichever it is, a line Orbital could not read for itself is sent when you press Ask — on that press and at no other moment. Nothing is sent while you type, nothing is sent in the background, and nothing is sent for a line Orbital understood on its own. Only the service you chose is contacted. The other two are never sent anything, and a key you are not using is never sent anywhere either.

What goes in the request is exactly this: the line you typed, and the current local date and time, alongside the instructions telling the service to answer with a single errand. The instructions are word for word the same whichever of the three is being asked. There are no contacts in it, no app list, no location, no notifications and no identifier of any kind. Because it is whatever you typed, only you can know what is in it — if you would not put something in a message, do not type it into the command bar.

It goes straight from your phone to that company under your own key, with no Orbital server anywhere in the path. Anthropic, OpenAI and Google are separate companies; the terms of whichever one you chose govern what happens to the request after it arrives, and what is kept is between you and your own account there. To stop it: clear the key field in the control panel.

Your keys are stored in a file only Orbital can read, and each key in it is encrypted with a key that your phone's Android Keystore holds and never hands out. Android's cloud backup is told to skip that file, Android's phone-to-phone transfer is told to skip it, and Orbital's own backup export leaves it out, so it is yours to put back by hand on a new phone. The same keys are used by cloud brains, described next, and the same file holds which cloud brain providers you have agreed to, so no backup or transfer brings an agreement back.

Cloud brains (optional, Premium)

Ask Orbital can arrange your home screen when you ask in your own words — "put my music apps in a folder on page two", say. The rules on the phone always answer first, and a request they understand never goes anywhere. A request they cannot read can be planned by a brain: one that runs on the phone, described under "On-device brains" below, or a cloud brain, which uses your own API key with Anthropic Claude, OpenAI ChatGPT or Google Gemini. Cloud brains are part of Orbital Premium.

Off unless you turn one on. Nothing is sent to a cloud brain until you have added your own key for that provider and agreed to a short notice in the app that says what is sent. You are asked once for each provider, and a provider you have not agreed to is never asked, whatever else is set. You can withdraw your agreement at any time on the Brain page, and you are then asked again before that provider is next used. An agreement is never restored from a backup or moved to a new phone, and Reset everything forgets it, so a key pasted on a new or reset phone is asked about afresh.

What is sent. Each time a cloud brain plans a request, Orbital sends that provider:

• Your request, exactly as you typed or spoke it.
• A short summary of your home screen: the names of your apps, leaving out any you have hidden and any that Orbital recognizes as personal, the same ones it holds back from a layout you share (on a phone with a great many apps, only the ones you use most are named); each page's number, the name you gave it and what is on it — apps by name, folders by their name and the apps inside them, with the same apps left out, and every other widget by its kind alone, such as "clock widget" or "note widget"; the apps on your dock, again without those; the names of your home layout and theme; and the current values of the home-screen settings the assistant is allowed to change, such as icon size, the clock's style and the drawer's order.
• Orbital's own lists of the themes, wallpapers, layouts, widget kinds and drawer orders a plan may use, and the instructions that tell the service how to write a plan. None of this is about you.

What is never sent: what your notes and pins say, your messages, your contacts or the people on your wheel, your notifications, your calendar, your reminders, your location, your photos or files, and any identifier for you or your phone. A note, a people row or a calendar widget is described only by the kind of widget it is. Your key for that provider goes with the request, because that is how the provider knows it is yours, and, as with any request over the internet, the provider sees your phone's IP address. The request introduces itself only as "Orbital".

Where it goes. Straight from your phone to the provider you chose, over HTTPS, using your own key: api.anthropic.com, api.openai.com or generativelanguage.googleapis.com. Orbital never receives it. There is no Orbital server in the path, and Orbital keeps no copy of the request, the summary or the brain's reply; what your home screen was like before a plan you apply is kept on the phone, so that Undo can put it back. The plan is checked on the phone against what your home screen can actually do, shown to you step by step, and changes nothing until you tap Apply, after which one Undo puts everything back.

Which brain is asked. The brain you picked on the Brain page, or, if you let Orbital choose, the most capable brain that is ready. If that brain cannot answer — the phone is offline, the provider's quota is used up, or it takes too long — Orbital may try another brain you have set up, which can be one on the phone or another provider you have agreed to. If no brain can plan the request and you have a key for the assistant's AI answers, the request alone, without the summary, goes to that service as described under "The assistant". To keep requests on the phone whenever a brain there can take them, turn on "Prefer on-device" on the Brain page.

The provider's own policy applies. Anthropic, OpenAI and Google are independent companies, and the request is made under your key and your own account with them. What happens to it after it arrives, and how long it is kept, is set by that account and by the provider's privacy policy: Anthropic's privacy policy, OpenAI's privacy policy and Google's privacy policy, together with the terms of the API service you signed up for.

To stop it: tap "Stop sending requests to" that provider on the Brain page, which withdraws your agreement and keeps your key; pick an on-device brain or turn on "Prefer on-device" there; or clear that provider's key in the assistant's settings, which stops every request to that provider. Without Orbital Premium, no cloud brain is asked even with a key saved.

On-device brains

An on-device brain runs entirely on your phone and sends nothing anywhere: your request, the summary of your home screen and the plan all stay on the phone. To use one, you download its model file once, from the Brain page. The file comes from Hugging Face (huggingface.co), where the model's publisher hosts it, and Orbital checks it against a fingerprint before using it. Hugging Face sees an ordinary download request, and its own privacy policy applies to that; Orbital sends nothing about you with it. The list of brains to choose from ships inside the app. Downloaded models are kept in Orbital's own storage, are never included in any backup, and can be deleted from the Brain page at any time.

News

A news widget fetches headlines from news.google.com when it comes on screen, at most once every twenty minutes for the same set of sources, and again when you tap its header. The request carries the topics you chose and, for local news, the place you typed. No identifier and no account goes with it.

If what you typed is a five-digit US postal code, Orbital turns it into a town name first, because the news feed is addressed by place rather than by postcode. The code goes to api.zippopotam.us, or to Open-Meteo's geocoder if that service does not know it, as described under "The weather". An answer is kept on the phone so it is not asked again. Only an answer: if the lookup fails, because you are offline or because neither service knows that code, the postcode goes again on the next fetch. A town name is passed to the news feed as you typed it.

If you paste a feed address in yourself, Orbital fetches it from whatever site that address points at, and that site sees the request. Headlines are cached on the phone so the widget has something to show before the next fetch. To stop all of this: take the news widget off the page.

The feed

The feed widget does nothing until you add one and sign in. Orbital reads Bluesky and Mastodon, which are the two networks that still let a third party read your own timeline.

The two networks ask for different things, and what ends up on the phone differs with them.

For Bluesky you type your handle and an app password. Both go over HTTPS to the server you named — bsky.social unless you name another — which hands back a session token and a refresh token, and those are what Orbital stores. The app password itself is never written down.

For Mastodon you type the host and an access token you made yourself on that server. There is nothing to exchange it for: the token is what goes to the server, and the token is what is kept. So on Mastodon the thing stored on your phone is precisely the thing you typed.

Either way it goes directly to the server you named and to nobody else, and there is no Orbital server in the path. What is stored sits in the same file as your assistant keys, with the same three exclusions: Android's cloud backup, Android's phone-to-phone transfer, and Orbital's own backup export. It is used to read your timeline and for nothing else. Afterwards the widget fetches your timeline from that server when it comes on screen and when you tap to refresh.

To stop it: sign the account out from inside the widget, which deletes its token from the phone; a reset signs out every account for the same reason. You can also revoke the app password or token from the service's own settings, which is the only way to be certain, since only that server can tell you what still has access.

Fonts

Orbital ships no font files of its own. Every lettering beyond your phone's own, Terminal included, is a Google Font fetched by Google's downloadable-fonts provider, which is part of Play Services and already on the phone. Each is a request for a font file and carries nothing about you. If the provider is not there, Orbital uses a font your phone already has.

A font is fetched when a screen shows it to you or when something you chose uses it: the font library, a sample or a theme's card in the theme store, a lettering or a theme you pick, the assistant's lettering, a notepad writing style, or kids mode's look. Orbital arrives set to your phone's own lettering, so nothing is fetched until you open one of those or choose one.

Distance to an event

To show how far away an event is, the smart widget passes the event's address to Android's own geocoder, and only when location is allowed and the phone already knows where it is. On most phones Android answers through Google Play services over the network, so the address may leave the phone, under Google's privacy policy. To stop it: withdraw the location permission, or turn off "Use my calendar" in the smart widget's settings. More is under "The smart widget".

The theme store

When you open the theme store, Orbital asks orbitallauncher.com for the list of themes in its catalog, over HTTPS, and downloads it only if it has changed since it last asked. Pictures of the themes come from the same address as they appear on screen, and a theme's own file and wallpaper are downloaded when you tap Get or "Surprise me". Nothing but orbitallauncher.com is contacted for any of it. Searching the store happens on the phone.

Some store features also work in the background, and only if you turn them on. With "Notify me when a new drop goes live" on in the theme store's settings, or with a drop or a season switched on in the theme store, Orbital checks the list at most once a day. It can then post a notification when a drop goes live, and a drop you switched on is downloaded and put on by itself when it arrives. Theme shuffle changes your theme on the schedule you choose, using themes already on the phone, and downloads a newer version of one of them when the list has one.

No personal data goes with these requests: no identifier, no account, no cookie and nothing about your phone beyond what any web request carries. The app introduces itself only as "Orbital". Downloaded themes, the list and the pictures are kept in Orbital's own storage so the store works offline, and removing a theme deletes its file. Your likes, collections and interests in the store stay on the phone with your other settings, and nothing is sent about them.

A theme is data only, and it cannot run code. It can choose colors, shapes, a font, a wallpaper, one of Orbital's own built-in effects, and a home screen, drawer and dock arrangement. A theme's picture wallpaper becomes your phone's wallpaper when it is applied, in place of the one you had. To stop all of this: turn off drop alerts, the drops and seasons you switched on, and shuffle, and don't open the theme store.

Theme ratings and feedback

Orbital Premium members can rate a theme from one to five stars once they have used it for a while, and can send a few words of feedback about it. Nothing is sent until you tap to rate or to send. A rating carries the theme, your stars and any text you write, how long you have used the theme, the app version and your language setting, to forms.orbitallauncher.com.

To make sure each person rates a theme once, the app also sends a random ID created for this installation and proof of your Google Play purchase, which the server checks with Google Play. It may also carry a token from Google Play's Integrity API, which the server checks with Google, under Google's own privacy policy. The server keeps only a one-way scrambled form of these IDs, never the IDs or the purchase token themselves, and never stores your IP address; a salted hash of it is used briefly to prevent abuse. No name, email address or other personal details are collected.

Ratings are combined into the average shown for each theme, and individual ratings are never published. To keep the averages fair, we limit how often ratings can be sent and may exclude ratings that appear abusive. Feedback is read by the Orbital team to improve the themes. Your own rating is also kept on the phone so you can see and change it.

App updates

When Orbital is installed from Google Play, it asks the Play Store app on your phone, at most once a day, whether a newer version is available, and can show a notification or a banner in Settings when one is. There is no Orbital server in this: the question goes to Google Play, under Google's privacy policy. To stop it, turn off "Notify me about app updates" in Settings.

Sharing your setup, layout codes and referrals

A share picture is made on your phone. "Share my setup" draws a picture of your home screen and hands it to the app you choose; Orbital does not upload it. It is drawn from the same stripped layout a shared layout file is written from, and stripped again before drawing, so it never shows notification text, calendar events, note text or contact names: widgets that hold personal things are drawn as plain placeholders. It carries the theme or layout name, a link and a QR code for that link. The link, and the QR code, include your referral code, described below.

A layout code is the one thing that uploads a layout, and only when you tap "Get a code". The layout goes to forms.orbitallauncher.com, the same small server the site's forms use, after the same stripping a shared layout file gets, together with your referral code. The server keeps the layout and when it was last opened, and gives back a short code such as ORB-7K2Q4M. Anyone with the code can open that layout, so share it as you would the file. A code nobody opens for 90 days is deleted with its layout; each opening starts the 90 days again. Typing a code into the theme store, or opening a layout link, fetches that layout. In the first seven days after installing Orbital, it can also claim a referral for whoever shared it, as described below.

Referrals: a month of Premium each. When somebody installs Orbital through your link or layout code and uses it for a week, you each get a month of Premium (two months for them if you own Premium for life), up to five times for you. Orbital's server decides whether the programme is running, and can change those numbers.

Whether the programme is running. Each time Orbital starts, and when you open the share sheet or the Premium page, it asks forms.orbitallauncher.com whether the programme is on. That request carries nothing beyond what any web request carries. While the programme is off, none of the requests below is made.

To make the programme work, and to stop it being gamed:

• Your referral code is random, made on your phone the first time you open the share sheet, and put in the links, QR codes and layout codes you share. It is not your name, email or account. When somebody installs through your link, Google Play's Install Referrer tells their Orbital your code on its first launch; it is read once and never again, and the code is sent only to claim the referral.
• A one-way hashed device identifier. Orbital reads Android's per-app device ID and turns it, on the phone, into a keyed one-way hash (HMAC-SHA256), using a key the server provides. Only the hash is sent; the ID itself never leaves the phone, and the hash is not stored on it. It is what makes a referral reward "one per phone".
• A Google Play integrity check. Referral requests carry a token from Google Play's Integrity API whenever Google Play can provide one. Orbital's server asks Google what it says: whether this is Orbital as installed from Google Play, on a genuine Android device. Google's own privacy policy covers what Play Services does to answer.

While the programme is running, these requests can be made, each with the hash and an integrity token:

• Claiming a referral, if you installed through a link that carried a code, or opened a layout code or link in the first seven days. It sends that code, and is retried for up to 14 days if it cannot get through.
• The week of use, counted from the days Orbital is opened as your home screen. At most once a day, while a claimed referral is in its week, or once you have a referral code of your own, Orbital tells the server it was opened today, with your referral code. Nothing about what you did in it.
• Checking for a reward. When Orbital starts, when you open the share sheet, and otherwise at most once a day, Orbital asks the server whether Premium is due to you from a referral, with your referral code if you have one. This check is made by every copy of Orbital while the programme is running, whether or not you share or were referred.
• Lifetime owners. If you own Premium for life, Orbital sends the Google Play purchase token of that purchase about once a week, which the server checks with Google Play so that friends you refer get two months. The server keeps only that it was verified and a one-way hash of the token, never the token.

These are used only for referral fraud prevention and to deliver the reward. The server, forms.orbitallauncher.com, keeps the device hash with: the referral code used and when, the days Orbital was opened during the week of use, the codes you shared, how many rewards you have earned, your Premium-until date, whether a lifetime purchase was verified, and salted one-way hashes of the IP address and network the referral came from, to hold bursts of sign-ups for review. They are kept only while the referral or reward is active, plus 90 days, and then deleted. Nothing is shared with anybody or used for advertising. On the phone, the programme's state (your code, the codes you referred, your Premium-until date, the days counted and the server's key) is kept in its own preference file, orbital_referral.

When free Premium ends, Orbital shows a short recap of what you used (the Premium theme, fonts, assistant look, home layout and effects), and saves your setup as "My Premium setup" in My Saved Layouts, unless you saved one yourself, so it can be put back later. The recap's counts, and whether a one-time welcome-back offer was shown, are kept on your phone only, in orbital_premium_ending, and never sent anywhere. One reminder can appear as a notification three days before the end, only if you have already allowed Orbital's notifications. Neither orbital_referral nor orbital_premium_ending travels in Android's backup.

For rate limiting, the server also holds a salted hash of the requesting IP address with the time of each request, and forgets them after a day.

Orbital Premium, and Google Play

Orbital is free to install, and Orbital Premium is an optional upgrade bought inside it: a monthly or yearly subscription, or a single lifetime purchase.

Purchases are made and handled by Google Play. The screen on which you choose a plan and pay is Google Play's own, shown over Orbital rather than drawn by it. Your card, your other payment details and your billing address go to Google and never pass through Orbital. Orbital receives no card details and has no way to see them.

What Orbital does learn is what Google Play tells any app about its own products: the prices to show, in your currency; which of Orbital's products the Google account on the phone has bought; and whether a purchase is complete or still waiting on payment. Orbital asks for that through the Play Store app on your phone — when the home screen or the settings come to the front, when the phone wakes while the dock over other apps is switched on, at most about once a minute, and whenever you tap "Restore purchases" — and adds nothing of its own to the question: no identifier, and nothing about your phone or what is on it. There is no Orbital server in the path; the one exception is the referral programme's check of a lifetime purchase, described under "Sharing your setup, layout codes and referrals". Google Play's billing library, which Orbital uses for all of this, sends its own diagnostic information to Google, as it does in every app that uses it.

Orbital keeps only a note on the phone of whether Premium is active, on which plan, and when Google Play last confirmed it, so that it works offline and from the moment the launcher starts. A subscription is honoured from that note for up to 40 days without word from Google Play, and after that waits until Google Play next confirms it. That note sits in a file of its own, which Orbital names in both of its backup rule files, so it goes neither to Android's cloud backup nor in a phone-to-phone transfer. Orbital's own backup and layout files leave it out as well. A new phone gets Premium back by asking Google Play, never from a copy.

The purchase itself — its receipt, a subscription's renewals, and any refund — is governed by Google Play's terms and Google's privacy policy. To change or cancel a subscription: the control panel, Orbital Premium, "Manage subscription", which opens Google Play's own page for it.

What Orbital stores, and Android's backup

Almost everything Orbital saves is a preference file inside its own private storage: your settings (on a foldable, one set for each screen), including the weather's place, hidden apps, keyboard shortcuts, and your likes and collections in the theme store; the wheel and the dock; your pages and widgets — including the text of any notes and pins you wrote and the place typed into a news widget; the drawer's tabs, folders and pages, and any names you gave apps; the people and apps you marked as important; your reminders and a record of the alarms you asked your clock app for; the cached headlines and the places looked up for them and for the weather; what you open, described under "What you open"; the smart widget's file; kids mode and its code; each settings page's recent changes, with what each setting was before and after, so they can be undone; what the edit modes remember about you, such as which tips you have seen, and their change history; your edit presets, and the animations and fonts you kept; on a foldable, the copies kept so a theme's setting-up can be reverted; and the Premium, referral and Premium-ending files. The rest are plain files in the same private storage: the crash files described above; My Saved Layouts; downloaded themes and the store's list; the private copies Orbital keeps so a layout can be put back; and files it prepares for the share sheet, which are kept in its cache; each new share deletes any more than a day old.

Android's own automatic backup copies most of that to your Google account. That is Android's backup rather than Orbital's; it is governed by Google's terms and you can turn it off in your phone's settings. Android's rule is that it takes everything an app stores except what the app names in two exclusion files, so the clearest way to say this is as two lists rather than as a summary.

What travels, if Android's backup is on: your settings; your layout, meaning the pages with their names, the widgets, the wheel and the drawer's tabs and folders, and therefore the text of any notes and pins you wrote and the identifier of everyone you put on the wheel; the names of the contacts you marked as important; the cached headlines and the town a news postal code was resolved to; the counts and times of what you open, where the overlay keeps being pushed aside, and the music apps that have played; My Saved Layouts and downloaded themes; and your edit presets, kept animations and fonts. All of it goes to your Google Drive, where Orbital never sees it again.

What does not travel, because Orbital names each one in both res/xml/backup_rules.xml and both halves of res/xml/data_extraction_rules.xml, keeping them out of the cloud backup and out of phone-to-phone transfer alike: your assistant keys and your Bluesky and Mastodon tokens, which share one file; your reminders; the note of whether Orbital Premium is active; the referral and Premium-ending files; kids mode and its code; the places looked up for the weather; the smart widget's table of app habits and its list of today's cards; the phone's screen measurements; each settings page's recent changes, with their before and after values; the edit modes' memory and change history; on a foldable, the copies kept so a theme's setting-up can be reverted, meaning both screens' previous settings and the big screen's previous layout, which holds the text of notes and the people on it; and the crash files, meaning the report, the list of crash times, the record that a recovery happened, the note that kids mode was ended by a crash, and both recovery copies. The copy kept when you load a layout or import a home screen, the undo copy for My Saved Layouts and the theme shuffle's schedule are not in that list because they do not need to be — they live in a directory Android's backup never takes at all — and neither are the files prepared for the share sheet, which live in Orbital's cache, which Android's backup never takes either.

"Save a backup" in the control panel writes your settings, wheel, widgets, pages, the drawer's tabs, folders and home widgets, the names you gave apps, and your priority list to a file wherever you choose. That file is yours; Orbital does not upload it or know where you put it. It is worth remembering that it holds the text of any notes you wrote, the weather's place, your hidden apps and your keyboard shortcuts. It leaves out your keys, your feed tokens, your reminders, your pins, the record of what you open, the cached news and places, the smart widget's file, kids mode, My Saved Layouts and the Premium and referral files. A layout file, and the settings file for another phone, are different things, described under "Layouts, and giving one to somebody else".

How to delete everything

• Reset everything, at the end of the About Orbital page in the control panel (or "Reset everything and run the intro", which does the same and then starts the intro again), clears your settings, the wheel, your pages, widgets, notes and pins, the drawer's tabs and folders, the names you gave apps, your priority list, your reminders, the record of what you open and where the overlay is pushed aside, the smart widget's table of app habits and its list of today's cards, kids mode and its code, the places looked up for the weather, and the news widget's stored file — which is where the town a news postcode was resolved to lives, and that is gone for good. The cached headlines go from that file too, but a launcher that is still running holds its own copy of them and can write some back; they are public headlines, and the town is the part that mattered. A reset also cancels every reminder Orbital had waiting; takes Orbital's notes and reminders out of the notification shade, though the overlay's own notice stays while the overlay is running, because Android requires a running service to show one; signs out of every Bluesky and Mastodon account; and deletes the crash report along with the crash times, the recovery note and the recovery copies. It also clears each settings page's recent changes, the edit modes' memory and change history, a foldable's copies kept for reverting a theme's setting-up (including the big screen's previous layout), the undo copy for My Saved Layouts, and every file prepared for the share sheet.
• What Reset everything keeps. Your assistant keys, because nothing sends one anywhere on its own and a key cannot be read back off the phone once it is gone. The note of whether Orbital Premium is active, because that is a record of a purchase rather than a setting, and the referral and Premium-ending files. The place you typed for the weather, so the weather keeps working. My Saved Layouts and downloaded themes, which you can delete one by one in the theme store. It also leaves some smaller files: the music apps that have played, your edit presets, the animations and fonts you kept, and the shuffle's schedule. To remove all of these too, clear Orbital's storage in Android's app settings, or uninstall it.
• Alarms are the exception, and a reset cannot take them back. An alarm Orbital set is an entry in your clock app, not in Orbital. Orbital can ask that app to dismiss one, but asking is the whole of it: there is no answer, and a clock app is free to show its own screen instead, to ignore the request, or to refuse it. A reset does not ask — it would be a poor way to stop a phone waking somebody up — so it drops Orbital's record and leaves the alarms alone. They are in your clock app's own list, with "(Orbital)" on the end of their labels.
• A note already in Google Keep belongs to Keep. Clearing Orbital's notes cannot reach a copy that has been sent there; delete that one in Keep. Switching the Keep destination off stops any more from going.
• The copy of your previous layout — the one "Put my old layout back" uses — holds the text of your notes and the people who were on your wheel. Reset everything deletes it, along with the offer to put that layout back. So does "Forget the old layout" in the control panel under Layouts, loading another layout over it, and uninstalling Orbital.
• A layout or backup file you saved is yours, and one you sent somebody is theirs. Orbital cannot reach either. Delete the file where you put it. A copy already handed to somebody else cannot be recalled.
• Whatever is on the clipboard stays there until something else is copied over it. A reset does not clear it.
• Clearing an assistant key field in the control panel removes that key. There is one field per service, so clearing all three is what stops the command bar making any request of its own. The same keys are the ones cloud brains use, so clearing a key also stops that provider's cloud brain.
• A cloud brain agreement can be withdrawn from the Brain page with "Stop sending requests to" that provider, without clearing the key. Reset everything forgets every agreement as well.
• A downloaded brain can be deleted from the Brain page, which removes its model file from the phone.
• Signing out of a feed account, from inside the widget, deletes that account's token.
• Uninstalling Orbital, or clearing its storage in Android's app settings, removes the whole sandbox: every preference file, every crash file, the kept copies of previous layouts, My Saved Layouts, downloaded themes, the cached headlines, your keys, your tokens and the note of whether Premium is active. A purchase itself belongs to your Google account, and Google Play keeps its own record of it. If Android's backup has already copied your settings to your Google account, that copy is managed from your Google account's backup settings, not from Orbital.
• On Orbital's server. A layout code is deleted 90 days after it was last opened, and referral records 90 days after the referral or reward ends. A request about either can be sent to the address under "Contact".

There is no Orbital account to close.

Children and kids mode

Who Orbital is for. Orbital is a home screen app for adults and general audiences. It is not designed for children to install or set up, and there is no account to make and no profile kept on anybody.

What kids mode is. Kids mode is a tool for parents and guardians. A parent turns it on in Orbital's settings and locks it with a PIN or a pattern, then can hand the phone to a child with only the apps they chose, a choice of kids themes and a few simple built-in games, which the parent can turn off. The code is never stored as itself: what is kept is a salted, one-way fingerprint of it, on this phone, in a file Android's backup is told to leave behind and that neither a saved backup nor a shared layout can carry. Nobody, Orbital's maker included, can read the code back from what is stored. If you choose, the phone's own lock screen can also end kids mode, through Android's own screen for your PIN, pattern or password. If you forget the code and have not allowed that, the only way out is a factory reset; the setup screen says so before you choose a code.

Kids mode holds Orbital's home screen; it does not lock the whole phone. The notification shade and the recent apps button belong to Android and still work as usual.

What happens to data in kids mode.

• Orbital collects no personal information from a child. There is no account, no advertising, no analytics and no tracking, in kids mode or anywhere else in the app.
• Game scores exist only while a game is on screen. They are never stored or sent.
• Opening an app from kids mode is not recorded. Orbital's count of what you open, the drawer's "Last used" list and the smart widget's table of app habits are not added to. Android keeps its own usage records; if you have granted usage access, the smart widget's screen time reads those on the phone later, as it does at any other time.
• Where a parent has allowed the search box, what a child types only narrows the chosen apps on screen and is never saved.
• The one thing a child can change is which kids theme the screen wears. That choice is saved with your settings on the phone.
• Kids mode sends nothing about the child anywhere. Its screen can cause one kind of request: a kids theme's lettering is a Google Font, fetched through Google Play services the first time it is needed and then kept on the phone. That request names the font and nothing else. Kids themes from the theme store are downloaded from orbitallauncher.com when a parent adds them, before kids mode is on; the child's theme picker only shows themes already on the phone.
• Checks Orbital makes for the phone as a whole carry on as usual, whether or not kids mode is on: Google Play's check of whether Orbital Premium is active, the referral programme's checks with Orbital's server while the programme is running, and theme drops if you switched them on. Each is described above. None of them carries anything about the child, such as the apps they open, the games they play or the theme they pick.
• While kids mode is on, none of these can be reached from the child's screen: Orbital's settings, the app drawer, editing, widgets (including the smart widget, now playing, the weather, news and feeds), the assistant and command bar, the phone's assistant gesture when Orbital is the assistant, the slash shortcut, the overlay dock, the theme store, sharing, layout codes and referrals. A layout link or file, and a shortcut sent from another app, are turned away rather than opened.

Parents stay in control. Everything kids mode keeps is on this phone. A parent can turn kids mode off at any time with the code. Reset everything clears kids mode, its code and the choices made for it, and uninstalling Orbital removes them all.

Questions. Parents and guardians with any question about kids mode or a child's privacy are welcome to write to OrbitalLauncher@gmail.com, or use the contact form at orbitallauncher.com/feedback.html.

The website's forms

The feedback form on orbitallauncher.com, and the tester sign-up it had before Orbital was on Google Play, send what you type to forms.orbitallauncher.com, Orbital's own small server. It keeps each submission for up to 90 days and gathers them into a weekly summary that is emailed to the Orbital team at OrbitalLauncher@gmail.com, then deletes them. A sign-up is used to invite you to test Orbital on Google Play; a feedback message is read and answered at the email address you give. You also get a short thank-you email straight away. Submissions are never sold, shared or used for advertising, and your IP address is not stored; a salted hash of it is used for a day to limit how many messages can be sent. To have a submission removed sooner, write to OrbitalLauncher@gmail.com.

Changes

If Orbital starts doing something this document does not describe, this document changes first. The date at the top is when it last changed, and the new version is published before the release it applies to.

Contact

Alid0n — OrbitalLauncher@gmail.com, or the contact form at orbitallauncher.com/feedback.html.

Write for anything: a question about this policy, something in it you think is wrong, or a request about your data. Every message is read by the person who makes Orbital.