Privacy notice

What the app keeps

• Your name, so the group knows who said what.
• Your email address, if you give one. It is always optional, and it does two things and nothing else. It signs you back in on a new phone or a cleared browser, so you come back as yourself instead of as a second copy of yourself, and it sends you reminders about your own group.
• What you write in the group chat, kept for as long as the group exists.
• Your answers to plans: whether you are in or out, and how you voted on an idea or on a change to a time.
• Your group's details: its name, the description the founder first wrote about it, the days and times it meets, its time zone, and its meeting spot, including the street address if the founder gave one.
• When you last opened the group, and when you joined it. Where you got to is what stops a reminder telling you about chat you have already read. It does not stop every email: if something is still waiting on your answer, like an idea you have not voted on, a reminder can still arrive.

Your information is never sold, never rented, and never used to advertise anything to you.

Who can see it

• The people in your group see your name, your messages, and your answers to plans.
• Your email address is never shown to your group. You are the only member who can see the address the app holds for you, on your group's info page. The two exceptions are not members: I can read it, and the service that sends the email has to be handed it.
• I can read the database. That is true of every app you have ever used, and I would rather say it than let you assume otherwise. There is no technical wall between me and your group's messages, so this rests on a promise rather than on software: I look when something is broken, or when somebody reports a problem in their group and I have to work out what happened, and not for entertainment.
• Asking to be deleted is not one of those times. Deleting somebody is mechanical: a script, then a dashboard, and none of it involves reading what you wrote. Asking does not invite me into your conversation.
• Nobody else, apart from the services below.

Outside services

• Anthropic runs the model behind Orbit, the assistant in your group. Every message sends a picture of your group to Anthropic so Orbit can work out what was meant: the last twenty messages with the names attached, the next few plans with their days and times, any idea the group is voting on right now, any open question about moving a plan, including the name of whoever asked, and any day Orbit is still waiting to hear back about. Your group's description goes too: once when you first describe your group while starting one, before the group itself exists, and again with every answer you give to Orbit's follow-up questions, since each answer is sent alongside the description it is clarifying. This is the one most people would not guess, which is why it is first.
• Resend sends the email. It handles your email address, and a reminder email quotes recent lines from your group chat, so those go through it too.
• Supabase stores the database and handles signing in.
• Vercel runs the site. Like any web host, its logs record the ordinary details of a request, including your IP address.
• Better Stack watches whether the site is broken. What it gets is the error, not your information. I will not promise it never sees a scrap of one, because an error sometimes repeats back the thing that broke it, and that could be yours. Nothing I wrote sends your information there.

Cookies and your device

The app stores a few things on your device: what keeps you signed in, a note that you were asked for your email so it waits a day before asking again, which version of the app this tab has updated itself to and how many times, and an unsent message until you close the tab. No analytics, no tracking, no advertising, and nothing that follows you around other websites.

Getting deleted

Email privacy@interplanetarygroups.com and ask. I do it within seven days, with a script and then a dashboard, and it is not a read of your messages. There is no button for it yet, and I would rather say so than pretend there is.

What goes:

• your account and your name;
• your email address;
• every answer you ever gave: in or out of a plan, and every vote on an idea or on a change to a time, on past plans as well as upcoming ones;
• the line the group saw when you joined, in every group, including ones you have already left. This one is a judgement call rather than a lookup, and you should know that: the app never recorded who those lines were about, so they are found by matching your name and I confirm each by hand. One in a group you joined, never posted in, and then left can be missed;
• any group you started that nobody else is left in.

What stays, which is the part most notices leave out:

• Your chat messages stay in the group, and they stop carrying your name. Where your name used to be, the group sees “Former member” instead. Taking one half of a conversation away leaves everybody else's messages making no sense.
• Your name stays wherever somebody wrote it into a sentence. If another member typed your name in a message, or Orbit said “Sam and Jordan are in so far,” those words belong to the conversation and they stay. Nothing goes hunting through everybody's messages for your name, and I would rather say so than promise a clean sweep I cannot deliver.

One thing first. If you started a group other people are still in, it has to be handed to one of them before your account can go, so their group does not disappear with you. Email the address above and we will sort it out.

Children

This is not built for children under 13, and is not meant for them to use.

Changes to this notice

This notice can change. When it does, the date at the top changes with it. I will not email you about it, so if this matters to you, have a look back here now and then.