Privacy Policy

This policy explains what Node Coders LLC, a Texas limited liability company that operates Orbgem (“Orbgem”, “we”, “us”), collects when you use orbgem.com and the orb command-line tool, why, and what you can do about it. Node Coders LLC is the controller of that information. Reach us about anything here at support@orbgem.com.

Account details: your email address, a name if you choose to give one, and your password. The password itself is never stored; only a salted PBKDF2 hash of it is kept. Your browser's time zone is saved with the vault so that “today” means your today.

Your content: the notes you write or import, and whatever your own tools send through API tokens and alert webhooks. Notes are stored as the Markdown text you wrote.

Billing details, if you subscribe to Sync: Stripe collects your payment details and processes the payment. We receive and keep only identifiers for your Stripe customer and subscription and the plan you are on. We never receive or store your card number.

Technical records: a record of each signed-in session so you can review and end sessions, when your email address was confirmed, a scrambled form of any confirmation or reset link until it is used or expires (an hour for a reset, seven days for a confirmation), and the request logs our hosting provider keeps for a short time to run and secure the service, which include network addresses. To stop accounts being created in bulk, a scrambled form of the network address a sign-up came from is kept for one hour and then deleted; it is not stored with your account.

Messages you send us, when you write to support.

To provide the service: signing you in, storing, searching, linking and syncing your notes, and applying the limits of your plan. To take payment for paid plans. To keep the service secure and prevent abuse. To email you what the account needs — a link to confirm your address when you sign up, and a link to reset your password when you ask for one. To answer you when you ask for help, and to tell you about important changes to the service or these documents.

For people in the European Economic Area and the United Kingdom, the legal bases are performing our contract with you, our legitimate interest in running a secure service, and compliance with legal obligations such as tax records.

We do not sell your personal information, we do not share it for advertising, we do not send marketing email, and we do not use your notes to train machine-learning models. We read your notes only when you ask us to in order to fix a problem, or when the law requires it.

Orbgem sets one cookie, which keeps you signed in for up to 30 days. It is strictly necessary for the service, so there is no cookie banner. There are no advertising trackers and no analytics trackers.

Cloudflare, Inc. hosts the service: it runs the application, stores the database that holds your account and your notes, and keeps the request logs. Stripe, Inc. processes payments for paid plans, under its own privacy policy. Resend delivers the email the service sends, and so receives your email address and the message. Each processes data on our behalf only to provide those services.

Beyond those providers, we disclose information only if the law requires it, to protect the rights and safety of our users or the service, or as part of a merger or sale of the service, in which case this policy continues to apply to your data until you are told otherwise.

Our providers operate in the United States and other countries, so your information may be processed outside the country you live in. Where the law requires safeguards for such transfers, we rely on the standard contractual clauses our providers offer.

We keep your account and your notes for as long as the account exists. Deleting your account in Settings removes the account, its workspace, every note in it and its API tokens from the live service immediately, and cancels any subscription. Backups are kept for up to 30 days and then deleted, so a deleted account is gone from them within that time.

Stripe keeps payment records for as long as the law requires it to. We keep messages you send to support for as long as needed to handle them.

You can change your name and password, review and end sessions, export a vault as a .zip of plain .md files and delete your account, all from Settings, at any time.

Depending on where you live, you may also have the right to ask for a copy of your personal information, to have it corrected or erased, to object to or restrict how it is used, and to receive it in a portable form. Write to support@orbgem.com from the address on your account and we will answer within 30 days. We will not treat you differently for using these rights. You may also complain to your local data protection authority.

All traffic is encrypted in transit. Passwords are stored only as salted hashes, every request is checked against the workspace it belongs to, and access to production is limited to what running the service needs. No system is perfectly secure; if a breach affects your personal information, we will tell you without undue delay.

The service is not directed to children, and you must be at least 16 to use it. If you believe a child has given us personal information, write to us and we will delete it.

When this policy changes we will post the new version here with a new effective date. If a change is material, we will also show a notice in the app before it takes effect.