Privacy
As of November 2026. This covers the website orbitdaw.com, the account area on it and Orbit's online services (sign-in and AI features). Orbit itself runs on your computer: your projects, recordings and settings stay there and are never sent to us, unless you use one of the AI features described below.
1. Who is responsible
schmalsoft solutions – Josias Yale Fabian Fehsenfeld & Robert Geyer GbR
Angererstr. 4, 80796 München, Germany
Email: robert.geyer156@gmail.com, fehsjo1@gmail.com
We are two people and have no data protection officer. Write to us at either address about anything on this page.
2. Hosting
The website, the account area and the online services run on one server at Railway (Railway Corporation, San Francisco, USA). The server and its database are in Railway's EU region in the Netherlands. When you open a page, your browser sends your IP address, the page address, the time and technical details such as the browser type. The server needs these to answer the request. Our own server does not write request logs, and it keeps IP addresses only in memory, for at most an hour, to limit how often one address can call the service (protection against abuse). Railway, as the hosting provider, records technical connection data to run and secure its platform.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to deliver the website and keep it secure. We use Railway as a processor under Art. 28 GDPR. Railway is a US company, so data may be accessed from the USA. Such transfers rely on the safeguards of Art. 44 ff. GDPR (EU standard contractual clauses).
3. No tracking, one cookie
The website has no analytics, no advertising and no content from other providers. Fonts, images and the demo song are loaded from our own server. If you sign in, we set one cookie that keeps you signed in. It contains a random session key, is not readable by scripts and is deleted when you sign out, or after 90 days at the latest. This cookie is strictly necessary for the account area (§ 25 (2) no. 2 TDDDG), so we don't ask for consent. If you don't sign in, no cookie is set.
4. Your account
You sign in with your email address and a six-digit code we send to it. The same account works in the app and on the website. We store:
- your email address and when the account was created
- the devices and browsers you are signed in on, with their name and when they were last used (you can sign them out in the account area)
- the sign-in code, only as a non-reversible hash, valid for 10 minutes
- your credits for the AI features and how they were used
- a public name, if you choose one
Legal basis: Art. 6 (1) (b) GDPR, as this is needed to provide the account you asked for. We keep the account until you ask us to delete it. Write to one of the addresses above and we will delete it along with everything linked to it, except records we have to keep by law (see section 7).
The sign-in emails are sent through an email delivery service that processes your address on our behalf (Art. 28 GDPR) and only for sending the email.
5. Feature requests, bug reports and comments
In the account area you can post feature requests and bug reports, vote and comment. We store what you write, your votes and when. Other signed-in members see your posts with your public name, or "Member" and a short code if you haven't set one. Your email address is never shown to other members. Nothing you post is visible to people who are not signed in. You can delete your comments, and your posts as long as nobody has started working on them. We may remove posts that break the rules of decency or the law.
Legal basis: Art. 6 (1) (b) GDPR. Posts stay until you or we delete them, or until your account is deleted.
6. AI features in the app
Some podcast features in Orbit (for example chapters, marked passages and show notes) are optional and use an AI model. They only run when you start them. Orbit then sends the transcript text needed for the job to our server, which passes it to Anthropic (Anthropic PBC, USA) to produce the result. Your audio is never sent: the transcription itself runs on your computer.
Our server keeps the transcript and the result only in memory and deletes them 15 minutes after the job ends. They are never written to the database or to logs. For each job we keep its type, its size, the credits used and the cost, so we can count credits and limit use. Anthropic processes the text as our processor under its terms for API customers. As Anthropic is a US company, the transfer relies on the safeguards of Art. 44 ff. GDPR (EU standard contractual clauses).
Legal basis: Art. 6 (1) (b) GDPR, as you asked for the job. Please don't use these features for transcripts containing information about other people that you are not allowed to share.
7. Buying credits
If you buy credits, payment is handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). You enter your payment details on Stripe's page; we never see them. We receive and store the purchase reference, the amount, the currency and the credits bought. Legal basis: Art. 6 (1) (b) GDPR and, for keeping the records, Art. 6 (1) (c) GDPR together with the retention periods of German tax and commercial law (up to 10 years).
8. Contacting us
If you email us, we use what you send to answer you and delete it when it is no longer needed, unless the law requires us to keep it. Legal basis: Art. 6 (1) (b) GDPR if it concerns your account or a purchase, otherwise Art. 6 (1) (f) GDPR.
9. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) (Art. 21). Write to one of the addresses above. You also have the right to complain to a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.