The short version
Play signed out and your flights never reach our server: sandbox is your device’s own solar system.
Play signed in and we store your email address, an account identifier, and your progress in the shared world — your ships, credits, tech, crew and flights — because that progress has to survive your phone.
Either way the game sends play statistics — how long you play, which screens you use, what you launch — to PostHog, so we can see what to improve. They never include your email or your ship designs, and there is no switch for them in the game. We do not run ads, we do not track you across other apps, we do not know where you are, and we never sell your data.
You can delete all of it from inside the game at any time: Settings → Account → Delete account. Or ask us at the deletion page.
Who this is
Orbital Frontier is an independent game, made and operated by one developer. This policy covers the Orbital Frontier app on Android, iOS, macOS and Windows, and the world server it talks to at orbital-frontier.world.
Questions about anything here go to [email protected].
What is collected, and why
Your progress is collected only when you sign in, and the game is fully playable signed out. Play statistics are collected either way, and the game has no switch to stop them — if you object to them, write to us and we will delete what we hold about you.
| What | When | Why |
|---|---|---|
| Your email address | When you sign in with an email and password, with Google, or with Apple | It is how your account is identified, so the same progress reaches you on a new phone |
| An account identifier | At sign-in | A random string that links your sign-in to your saved game. If you sign in with Apple and choose to hide your email, this is all we get |
| Your progress in the shared world | While you play signed in | Ships and their orbits, credits and discovery, tech unlocked, buildings, crew, contracts, achievements and science readings. This is the game; without it there is nothing to come back to |
| Ship designs you save | When you save a rocket in the hangar | So your designs are on every device you sign in on |
| Play statistics | While the game is open, signed in or not | How long each session lasts, which screens you use and for how long, and flight events such as a launch, an orbit reached or a crash, with the app version and the kind of device. They are tied to a random number the app makes when it is installed and, when you are signed in, to a one-way scrambled form of your account identifier — never your email. They show us which parts of the game people use and where they get stuck |
What is never collected
- No location. The app never asks for it and never reads it.
- No advertising identifiers. There is no ad network in the app and no advertising ID is read. The only identifier is the random one the app makes for play statistics.
- No crash reporting and no advertising analytics. Play statistics never include your email, your ship designs or anything you type, and are never used to track you across other apps.
- No contacts, photos, files, microphone or camera. The app requests none of those permissions.
- No payments. There are no purchases in the game, so there is nothing financial to hold.
- No chat, no profiles, no player-to-player messages. The world is shared, but you only ever see your own fleet, so there is nothing for other players to learn about you.
Server logs
Like any web server, the world server writes a line per request that includes the caller’s IP address. Those lines exist to keep the service up and to spot abuse, they are not joined to your account, and they are discarded on a short rolling window.
Permissions the app asks for
- Internet. To reach the world server when you are signed in, to fetch the part catalogue, and to send play statistics.
- Notifications, and on Android alarms and run at start-up. These are the reminder feature: you choose a moment in the game — an apoapsis, a burn, a sphere-of-influence crossing — and the phone tells you when it arrives. Reminders are scheduled by the app on your own device. Nothing about them is sent anywhere.
Who else touches it
Four companies are involved, and none of them is an advertiser:
- Google (Firebase Authentication) verifies your sign-in and tells the world server that the sign-in is genuine. Google’s handling of that is covered by the Firebase privacy documentation.
- Apple, if you use Sign in with Apple. If you choose Hide My Email, we never see your real address.
- Cloudflare sits in front of
orbital-frontier.worldand passes traffic through to the world server. - PostHog stores the play statistics for us, in its EU region. PostHog’s handling of them is covered by its privacy policy.
The world server itself runs on a virtual machine rented from a commercial hosting provider and is operated by the developer alone. If you are in the EEA or the UK, note that your data may be stored and processed on servers outside your country.
Your data is never sold, never shared for advertising, and never handed to a data broker. The only circumstance in which any of it would be disclosed to anyone else is a valid legal demand.
How long it is kept
Your account and its progress are kept for as long as the account exists. Delete the account and the record goes with it. Server logs roll off on a short window as described above. Play statistics are kept at PostHog for the retention period of our plan and then deleted.
Deleting your account and your data
In the game: Settings → Account → Delete account. The button asks once to be sure, and then the account, its sign-ins, its ships, its crew and its whole record are removed from the world server. It cannot be undone, and there is no separate copy kept. Play statistics already sent to PostHog are not tied to your email, so deleting the account does not reach them on its own — write to us and we will remove them too.
If you cannot open the app any more, ask us instead — the deletion page says how, and we do it by hand.
Your rights
Wherever you live, you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to [email protected] from the address on the account and we will answer within 30 days. If you are in the EEA or the UK, the legal basis for holding this data is the performance of our agreement with you — running the game you signed in to play — and, for play statistics, our legitimate interest in seeing how the game is played, which you can object to at any time by writing to the address above. You may complain to your local data protection authority if you think we have got it wrong.
Children
Orbital Frontier is not directed at children under 13, and the store listing is rated accordingly. We do not knowingly collect anything from a child under 13. If you believe a child has signed in, write to us and we will delete the account.
Security
Everything between the game and the world server travels over HTTPS. Sign-in tokens are never stored on our side in a readable form — only a one-way hash of a session token is kept, so a copy of our database does not let anyone sign in as you. We never see or store your password: that stays with Google’s authentication service.
Changes to this policy
If this policy changes in a way that matters, the date below changes with it and the new version appears here. Continuing to play after that means the new version applies.
Last updated: 11 September 2026 · [email protected]