Orbit VPNLast updated: 1 October 2026
The short version
- We do not record the websites you visit, the content of your traffic, or your DNS lookups.
- We do not store the IP address you connect from.
- We keep a small connection record (which server, when, and how much data) so the free plan's time limit and the device limit can work. It is deleted after 30 days.
- You can use the free plan without giving us an email address.
- We do not sell your data.
Who we are
Orbit VPN is run by Orbit Tech Lab ("we", "us"). We are the controller of the personal data described here. You can reach us at .
What we never record
Our VPN servers are set up to keep no activity logs. On every server, the proxy's access log is switched off, the DNS resolver does not log queries, and WireGuard connection details are held in memory only while you are connected and are not written to disk. This means we have no record of:
- the sites, apps or services you use through the VPN;
- the content of your traffic;
- your DNS lookups;
- the IP address you connected from.
What we do record
| Data | Why we need it | How long we keep it |
|---|---|---|
| Device record. A random ID we create when the app is first opened, the type of app (extension, Android, website), and the date. | To recognise the app without an email, and to count the free plan's daily time. | Until you ask us to delete it. |
| Account. Your email address and a scrambled (hashed) copy of your password. We cannot read your password. | To log you in, share Premium across your devices, and send account emails. | Until you delete your account. |
| Connection record. Which server you used, when the connection started and ended, the total amount of data, and the temporary credentials for that connection. | To enforce the free time limit and the limit on devices connected at once. | 30 days. |
| Plan and payments. Your plan, when it ends, and reference numbers from Stripe or Google Play. | To give you Premium and handle renewals, cancellations and refunds. | While you have an account, and afterwards for as long as tax and accounting law requires. |
| Ad rewards. The number of rewarded ads credited to a device each day. | To add free time and cap it per day. | 30 days. |
| Failed log-ins. A one-way hash made from the email and IP address used. We cannot turn it back into either. | To block password guessing. | 15 minutes. |
While a request to our website or API is being handled, our systems see the IP address it came from, as every internet service does. We use it in memory to limit abuse (for example, too many sign-ups from one address) and do not store it.
Card and payment details
We never see or store your card number. On the website, payments are handled by Stripe: you enter your card on Stripe's page, and Stripe tells us only that the payment succeeded. In the Android app, payments are handled by Google Play. Both companies process your payment details under their own privacy policies.
Other companies involved
- Stripe processes website payments and shows you invoices.
- Google Play processes purchases made in the Android app.
- Google AdMob shows ads in the Android app to people on the free plan. AdMob may use your device's advertising ID. Where the law requires it, the app asks for your consent first, and you can change your choice in the app's settings. Premium has no ads, and the browser extension never shows ads.
- Hosting providers rent us the servers that run the VPN, the website and our database.
- An email delivery provider sends our account emails (confirming your address, resetting your password).
Some of these companies are outside your country. Where data leaves the European Economic Area or the United Kingdom, we rely on the safeguards those laws accept, such as standard contractual clauses.
Storage on your device
The website and the extension keep a login token in your browser's storage so you stay signed in. We do not use advertising or tracking cookies on the website.
Why we are allowed to use this data
- To provide the service you asked for (your account, your plan, your connections).
- Our legitimate interest in keeping the service secure and preventing abuse of the free plan.
- Legal obligations, such as keeping payment records.
- Your consent, for personalised ads in the Android app. You can withdraw it at any time.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to limit that use. To delete your account yourself, open My account, then Security, then Delete account. This removes your email, password and plan, and logs every device out. To delete a device record that has no account, email us from the app's support link. If you believe we have handled your data wrongly, you can also complain to your local data protection authority.
Requests from authorities
We answer valid legal requests. Because we keep no activity logs and do not store connecting IP addresses, we cannot tell anyone what a user did through the VPN.
Children
Orbit VPN is not meant for anyone under 18, and we do not knowingly collect their data.
Changes to this policy
If we change this policy in a way that matters, we will update the date above and email account holders before the change takes effect.