Privacy Policy

This Privacy Policy explains how Astro Arpanet LLC and its operators, including ScutiW AI and ScutiW Superintelligence (“we,” “us,” or “our”), collect, use, share, and protect information when you access or use Orbit Mesh websites, accounts, optional subscription billing, and related relay or agent software (the “Service”). The software license is owned by Astro Arpanet LLC. By using the Service, you agree to the practices described here. If you do not agree, do not use the Service.

Read this Policy together with our Terms of Service. If there is a conflict regarding dispute resolution or liability, the Terms control to the fullest extent permitted by law. This Policy describes data practices only; it is not a warranty, service-level agreement, or promise of security or availability. Liability for the Service is governed exclusively by the Terms (including disclaimers, caps, arbitration, and limitations). References to security or retention here do not expand our liability.

1. Information we collect

• Account portal — name (optional), email, password hash, session identifiers, and plan or billing status when Stripe is enabled. We do not store full payment card numbers (Stripe holds card data). Password reset requests may be fulfilled by email (one-time links; we use our email provider for delivery).
• Contact form — name, email, organization, phone, message, scheduling preferences, and technical metadata needed to deliver and protect the form (for example IP address and rate-limit counters).
• Mesh relay & agents — account identifiers, device names and kinds, capability flags, online presence, join and registration events, and sync or control message payloads routed through the relay. Clipboard and handoff payloads may be end-to-end encrypted when you enable that option; robot control messages may be plaintext by design.
• Billing link tokens — short-lived tokens used to associate a website subscription with a relay account when you complete that flow (metadata only; not your mesh message content).
• Usage & technical data — IP address, user agent, request timestamps, and security logs on hosted website and relay deployments. Local-only use on your machine minimizes what leaves your environment.
• Cookies & local storage — as described in Section 8.

2. Mesh data; operators; self-hosted use

Orbit Mesh is software for connecting devices you control. We do not operate your laptop, phone, robot, or facility. You decide what to sync and which relay to use.

• Website operator — When you use this site for sign-up, login, pricing, or support, Astro Arpanet LLC (or our hosting providers) processes account and contact data as described in this Policy.
• Relay operator — When you run `npm run relay` or host a relay elsewhere, you (or your organization) are the operator for that deployment. You should tell your users what the relay logs, how long sync queues are retained, and how to export or delete data.
• Split deployments — It is common to run the relay locally while using the public website for accounts. In that model, most mesh payloads stay on infrastructure you control; the website may still hold your email, billing status, and support messages.
• Your responsibility — You are responsible for lawful grounds to sync content (including text copied from other apps), join-code distribution, device access, and notices to people affected by your use. We process mesh payloads to route them, not to judge their content.
• No liability for your payloads — To the fullest extent permitted by law, liability for use of the Service, hardware connected to it, and content you sync is governed by the Terms of Service. This Policy is not a warranty.

3. How we use information

• Provide, maintain, secure, and improve the Service.
• Authenticate accounts and devices; enforce plan and device limits where configured.
• Route clipboard, handoff, presence, and control messages through relays.
• Process subscriptions and respond to contact-form and support requests.
• Detect abuse, fraud, and security incidents; enforce Terms.
• Comply with law and protect rights and safety.

We do not sell your personal information. We do not use mesh clipboard content for advertising.

4. Legal bases (where applicable)

Depending on your location, we may process personal data based on:

• Contract — to provide the Service you request.
• Legitimate interests — to secure, improve, and administer the Service and prevent abuse.
• Consent — where required (for example optional marketing or non-essential cookies if we add them later).
• Legal obligations — to comply with applicable law.

5. How we share information

We may share information with:

• Service providers — hosting, database, email delivery (for example Brevo), payment processing (Stripe), and infrastructure needed to operate the website and any hosted relay we run. They process data only to provide services to us and must protect it appropriately.
• Devices on your account — sync and control messages are delivered to devices you register. Anyone with a valid join code or device credentials you issue may join your mesh if you permit it.
• Business transfers — in a merger, acquisition, or sale of assets, information may transfer to a successor subject to this Policy.
• Legal compliance — when required by law, legal process, or to protect rights, safety, or security.
• Aggregated or de-identified data — that does not reasonably identify individuals.

We are not responsible for how self-hosted relay operators, your devices, or third-party providers store or use data once it leaves systems we operate, except as required by law.

5A. Subprocessors (website & hosted offerings)

When we operate the public website or a hosted relay for you, we use the following categories of subprocessors. They process data under their own terms and our agreements with them. We may update this list from time to time.

• Vercel, Inc. — website hosting, serverless functions, and edge delivery (United States and global regions per Vercel).
• Neon Tech, Inc. (or equivalent Postgres) — account and optional relay persistence.
• Stripe, Inc. — payment processing; we do not store full card numbers.
• Brevo (Sendinblue) — transactional email (contact, password reset, operational notices).
• Upstash, Inc. — rate limiting and ephemeral password-reset tokens (Redis REST).
• Cloudflare, Inc. (when configured) — TLS, tunnel, DNS, or WAF for mesh endpoints.

Hosted business customers may also see the Data Processing Addendum (hosted). Requests for a written subprocessor notice: use the contact form.

6. Retention, export & your rights

We retain information as long as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Relay sync queues should use retention limits you configure (for example TTL on queued messages). Signed-in users can download a JSON export of portal account fields from the App dashboard. Portal account deletion is available there with password confirmation; it does not by itself delete mesh data on your relay. Relay export and deletion depend on your relay version and deployment; use the contact form for privacy requests related to the website account.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port certain personal data, or to object to processing. Submit requests via the contact form. We may verify your identity before acting.

We retain billing records as required for accounting, tax, and fraud prevention.

7. Security

We implement reasonable administrative, technical, and organizational safeguards appropriate to the Service. No method of transmission or storage is 100% secure. We cannot guarantee absolute security. Descriptions of safeguards are informational only and do not expand liability beyond the Terms of Service.

You access the Service at your own risk. Protect join codes, device tokens, and relay credentials. Report suspected security issues via the contact form.

8. Cookies & local storage

When you use Orbit Mesh in a browser, we may use:

• Necessary cookies — session and sign-in cookies (for example NextAuth / Auth.js tokens) so you can stay signed in.
• Preferences — local settings the product stores in your browser where applicable.
• Analytics — we do not currently load third-party advertising or analytics scripts on the marketing site. If we add optional analytics later, we will update this Policy and obtain consent where required.

You can clear cookies in your browser; doing so may sign you out of the website.

9. International transfers

Your information may be processed in countries other than where you reside (including the United States). Those countries may have different data-protection laws. By using the Service, you understand that transfers may occur through our providers.

Where GDPR or similar laws apply, you retain rights that mandatory law does not allow you to waive. Exercising those rights does not create extra contractual liability beyond what that law requires.

10. Children’s privacy

The Service is directed to adults and professional or commercial use, not children. We do not knowingly collect personal information from children under 16 (or the equivalent minimum age in your jurisdiction). Contact us via the contact form if you believe a child provided personal information.

11. Changes

We may update this Privacy Policy from time to time. Changes take effect when posted with an updated “Last updated” date. Continued use after changes means you accept the updated Policy.

12. Contact

Privacy questions: use the contact form. See also our Terms of Service.