Privacy, without
the fog.

Scope and privacy roles

This Privacy Policy applies to the Orbyxa website, account experience, and flight-log application. “Orbyxa,” “we,” and “us” mean the organization providing the Orbyxa deployment you use.

For account administration and operation of the service, the Orbyxa deployment operator generally acts as the data controller. If you use Orbyxa through an employer, client, or fleet organization, that organization may control the flight records and other workspace data, while Orbyxa processes that data on its instructions. Direct workspace-data requests to your organization first where appropriate.

This policy does not govern third-party sites linked from Orbyxa or independent tools used to create the source flight log.

Data we handle

Account and workspace data

Name, work email, workspace or organization name, Supabase user identifier, authentication status, account role, workspace approval status, and the policy version and time acknowledged during signup. Passwords are submitted to the configured authentication provider; Orbyxa application code does not store a readable copy.

Email authentication and account recovery

The work email supplied at signup is used as the account identifier. The current deployment does not require a confirmation link before sign-in; instead, the account starts with limited pending access and a superadmin controls access to protected fleet and project data. The authentication provider sends a signed email link when a password reset is requested. Email delivery discloses the destination address and ordinary delivery data to the deployment's configured email provider, which may retain delivery logs under its own terms. Recovery links are time-limited and are managed by the authentication provider, not stored by Orbyxa application code. Orbyxa does not require or collect a mobile number for authentication.

Flight and fleet data

When you confirm an imported record, Orbyxa may sync its exact raw source together with parsed flight metadata, aircraft association, pilot name, timestamps, duration, route or GPS coordinates, altitude, speed, battery samples, modes, messages, findings, file name, file size, and checksum. Flight data can reveal locations, working patterns, or information about other people, so only upload records you are authorized to use.

Mission planning and map providers

Mission plans may contain precise waypoint coordinates, altitude commands, mission settings, descriptions, and timestamps. Saved plans can sync to the shared approved Supabase workspace. The mission map and flight-route replay request OpenFreeMap tiles through MapLibre, and the 3D preview requests Mapterhorn terrain tiles; those requests disclose the viewed map area and ordinary request data such as IP address and browser information to the respective provider. When you request elevation validation, sampled path coordinates and ordinary request data are sent to OpenTopoData to return terrain elevations. Those providers process requests under their own terms and privacy notices.

A deployment can alternatively enable Google Maps Platform. In that case, live map, 3D, and elevation requests send the viewed area or sampled coordinates and ordinary request data to Google. Elevation results from every provider are used transiently in the open page. Orbyxa does not save terrain samples to Supabase or browser storage and does not include them in KML, KMZ, or waypoint exports. Exports contain the mission coordinates and altitude commands authored or imported by you.

Raw .BIN files

The raw DataFlash file is read and decoded on your device. When you confirm a new import, Orbyxa uploads the exact file over encrypted network transport to a non-public Supabase Storage bucket and links it to the protected workspace flight record. Every approved active workspace member can retrieve the source for operational analysis; only a Superadmin can delete it through the protected flight-deletion workflow. Orbyxa also attempts to keep an account-scoped IndexedDB copy on the importing device for faster repeat analysis. Browser eviction, clearing site data, or resetting the local cache can remove that local copy without deleting the protected workspace source. Historical records imported under the earlier local-only policy remain summary-only unless an authorized user explicitly restores and stores the exact SHA-256-matching source.

Technical and support data

The application and its infrastructure providers may process IP address, browser and device information, request time, security events, diagnostics, and session information needed to operate and protect the service. If you contact support, we process the message and information you provide.

Account activity history

Orbyxa records important account actions such as flight imports and deletions, mission and fleet changes, exports, maintenance updates, and access decisions. An activity record can include the authenticated actor's name, email and user identifier, the action and affected record, a short description, limited operational metadata, and the event time. Users can view their own history; a workspace superadmin can view the histories made visible by the deployment's access policies. Cloud activity records are append-only through the application interface.

Browser storage

Orbyxa uses essential browser storage for authentication sessions, user-scoped offline summaries, account-scoped raw-log IndexedDB, resumable-upload state, and interface preferences. The current product does not use advertising cookies. Clearing site data may sign you out, interrupt a pending upload, and remove locally cached summaries and full sources; it does not itself delete a completed protected workspace object.

How and why we use data

• Provide the service: create accounts, authenticate users, administer superadmin approval, parse logs, build records, render maps and charts, synchronize workspaces, and provide exports.
• Secure and maintain Orbyxa: prevent abuse, diagnose failures, preserve availability, and protect users and infrastructure.
• Improve the product: understand product reliability and improve parsing, features, and usability using data available to the deployment operator.
• Communicate: send essential account-recovery, security, support, and service messages.
• Comply and enforce: meet legal obligations, respond to lawful requests, and enforce agreements.

Where applicable law requires a legal basis, we rely on performance of our contract to provide requested features; legitimate interests in operating, securing, and improving the service; compliance with legal obligations; and consent where we specifically ask for it. Acknowledging this policy confirms you have read it; it is not blanket consent for every processing activity.

When data is shared

We share data only as needed for the purposes described here:

• Your workspace: authorized members and administrators of the organization through which you use Orbyxa.
• Infrastructure and mapping providers: configured authentication, database, hosting, email, monitoring, security, and mapping providers. The current deployment uses Supabase services, may use Vercel for web hosting, and uses OpenFreeMap, Mapterhorn, and OpenTopoData for operator-requested live maps, 3D terrain, and elevation profiles. A deployment can alternatively use Google Maps Platform for map, 3D, and elevation views.
• Professional advisers and authorities: when reasonably necessary to protect rights, investigate abuse, comply with law, or respond to valid legal process.
• Business change: in connection with a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice where required.

Orbyxa does not sell personal data. It also does not share personal data for cross-context behavioural advertising in the current product.

Retention and security

Account, cloud flight records, and protected raw source objects are generally retained while the workspace is active, until an authorized Superadmin deletes the flight, or until they are no longer needed for the purposes described here. Limited records may remain in backups, security logs, dispute records, or legally required archives for the relevant provider or legal retention period. Local browser data remains until the user, browser, or device clears it.

Orbyxa uses safeguards designed for the nature of the data, including encrypted network transport, Supabase authentication, explicit approved workspace membership, a non-public Storage bucket, creator-attributed writes, Superadmin-only destructive flight controls, SHA-256 integrity checks, insert-only source objects, and local raw-file parsing. No online service can guarantee absolute security. Use a strong, unique password, control access to your device, and report suspected compromise promptly.

Your choices and rights

Depending on where you live and how you use Orbyxa, you may have rights to know or access personal data, correct inaccurate data, delete data, restrict or object to processing, receive portable data, withdraw consent, or appeal a request decision. You may also have the right to complain to your local data-protection authority. California residents may have rights to know, delete, correct, limit certain sensitive-data uses, and opt out of sale or sharing; Orbyxa does not currently sell or share data for cross-context behavioural advertising.

Send a request to supabase@rchobbytech.com. We may need to verify identity and authority over the relevant workspace. Where an employer or fleet customer controls the data, we may direct the request to that organization. Authorized agents may submit requests where permitted by law.

You can avoid cloud flight-data processing by not confirming an import. You can remove the local cache through Orbyxa or browser site-data controls without removing a completed protected workspace source. Flight and source deletion requires the authorized Superadmin workflow.

International use and younger users

Orbyxa and its providers may process data in countries other than the one where you live. Where required, the deployment operator should use recognized transfer safeguards and provide information about them on request. The exact processing locations depend on the configured Supabase and hosting regions.

Orbyxa is a professional flight-operations product and is not directed to children under 16. Do not create an account if you are below the minimum age required to consent to online services where you live.

Changes and contact

We may update this policy as Orbyxa and its data practices change. The effective date and policy version at the top identify the current version. We will provide additional notice before a material change where required.

Questions, requests, or security reports can be sent to supabase@rchobbytech.com. If you use Orbyxa through an organization, you may also contact its workspace administrator.