Privacy Policy

Orbit is an AI-native testing platform operated by Sunrise Systems ("we," "us," or "our"). We help development teams automatically test their applications by indexing source code, generating test plans with AI, and executing browser-based tests against staging environments.

For privacy-related questions, contact us at hello@sunrisesystems.co.

Account data

When you sign in with GitHub OAuth, we receive your GitHub profile information: name, email address, avatar URL, and GitHub user ID. We use this to create and manage your Orbit account.

Source code

When you connect a repository, Orbit clones it to parse its structure. We perform AST (Abstract Syntax Tree) analysis to understand routes, components, authentication flows, and business logic. We generate vector embeddings from your code and store them in our PostgreSQL database for semantic retrieval during test planning. Your source code is used solely to provide the testing service and is never shared with other users or sold to third parties.

Browser test data

During test execution, Orbit captures screenshots, video recordings, and DOM snapshots from your staging environment. These artifacts are stored in S3-compatible object storage and are accessible only to members of your workspace.

Secrets and credentials

If you store environment variables or secrets in Orbit's vault (for example, staging URLs or API keys), they are encrypted at rest using AES-256-GCM. Secrets are never logged, never displayed in the UI (shown only as masked values), and are decrypted only at the moment of test execution.

Usage data

We collect standard usage analytics: pages visited, features used, test run counts, and performance metrics. This helps us improve the product and debug issues.

Orbit sends portions of your code and application context to AI providers for analysis. We want to be fully transparent about this:

• Anthropic (Claude) receives code snippets, system map data, and test context for test plan generation, failure analysis, and report writing.
• OpenAI receives code snippets for embedding generation and specific analysis tasks where model routing determines it is the best fit.

Both providers process data under their respective API terms, which prohibit using API inputs to train their models. We send only the minimum context necessary for each task and never send your full repository to any provider in a single request.

We use the data we collect to:

• Provide, maintain, and improve the Orbit testing service
• Generate and execute test plans for your repositories
• Send you service notifications (run results, failures, account alerts)
• Monitor and prevent abuse or unauthorized access
• Comply with legal obligations

We do not sell your personal data or source code. We do not use your code to train AI models. We do not share your data with other Orbit users.

Source code: Cloned repository data is retained while your project is active. Embeddings and system maps persist to enable incremental re-indexing. When you delete a project, all associated code data, embeddings, and system maps are permanently deleted within 30 days.

Test artifacts: Screenshots, videos, and DOM snapshots are retained for 90 days after creation, then automatically purged. Enterprise customers can configure custom retention periods.

Account data: Retained while your account is active. When you delete your account, all personal data is removed within 30 days. Anonymized, aggregated usage statistics may be retained indefinitely.

We use the following third-party services to operate Orbit:

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your account and all associated data
• Export your data in a machine-readable format
• Revoke GitHub access at any time through your GitHub settings

To exercise any of these rights, email hello@sunrisesystems.co. We will respond within 30 days.

Orbit uses essential cookies for authentication (session tokens) and preferences. We do not use third-party advertising cookies or cross-site tracking. We may use privacy-focused analytics to understand product usage in aggregate. You can disable non-essential cookies in your browser settings.

Orbit is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Orbit's infrastructure is hosted in the United States via Railway. If you access Orbit from outside the United States, your data will be transferred to and processed in the United States. By using Orbit, you consent to this transfer. We ensure all sub-processors maintain appropriate data protection measures.

We may update this privacy policy from time to time. If we make material changes, we will notify you via email or a prominent notice in the product. Your continued use of Orbit after changes take effect constitutes acceptance of the updated policy.

For questions, concerns, or requests related to this privacy policy, contact us at hello@sunrisesystems.co.