Cookie Policy
Effective date October 18, 2026
This policy explains what cookies and similar technologies Orbital - a product of Constructr, Inc. - uses, what each one is for, who else is involved, and how you can control them.
It covers our website at withorbital.ai, the Orbital web app at work.withorbital.ai, and the Orbital desktop app. It sits alongside our Privacy Policy at /privacy, which explains how we handle personal information generally.
The inventory below applies to all three surfaces, with one difference: the support chat widget is only on the website. The web app and the desktop app load product analytics behind the same consent control.
1. What we mean by cookies
A cookie is a small text file a site stores on your device so it can recognise your browser on later requests. We also use technologies that work similarly:
- Local storage and session storage - key-value stores a site can read and write in your browser.
- Pixels and similar beacons - small requests used to record that something happened.
In this policy, "cookies" means all of these unless we say otherwise.
Cookies are either session cookies, which disappear when you close your browser, or persistent cookies, which stay until they expire or you delete them. They are first-party if our domain sets them, and third-party if another domain does.
2. Who sets cookies here
Most cookies on our site and app are set by us or by a service provider acting on our instructions and only for the purposes in this policy.
We do not use advertising cookies or advertising pixels. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not let advertising networks track you through our site or app.
Two honest qualifications.
- Our site loads some images and logos from a third-party asset host (see Section 4). That host receives your IP address and standard request information because your browser has to ask it for the file. It does not set a cookie and it does not act on our instructions in the way a processor does.
- Our content delivery and security provider, Cloudflare, does not set cookies on our pages in normal use. If it presents a security challenge to suspected automated traffic, it may set a short-lived cookie that remembers the challenge was passed.
3. What we use, and why
3.1 Strictly necessary
These make the Services work. They are set whether or not you accept the others, because the Services do not function without them. They cannot be turned off from inside the product. You can block them in your browser, but then sign-in and parts of the site will stop working.
| Technology | Where | What it does | How long it lasts |
|---|---|---|---|
| Session and authentication cookies | work.withorbital.ai | Keep you signed in, remember which organisation you are working in, and protect against cross-site request forgery | Session, or a fixed period after which you must sign in again |
| Theme preference (local storage) | withorbital.ai, work.withorbital.ai | Remember whether you chose light or dark mode | Until you clear your browser storage |
Cookie consent record (orbital_cookie_consent) | withorbital.ai | Remembers the choices you made in our consent control, when you made them, and which version of this policy you saw | 12 months |
3.2 Analytics
We use product analytics to see which pages and features people use, where sign-up and onboarding break down, and where people get stuck. We use it to improve the product. It is not used for advertising and it is not shared with advertising networks.
These do not load until you accept them - see Section 5.5.
| Technology | Provider | Where | What it does | How long it lasts |
|---|---|---|---|---|
| PostHog product analytics | PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, United States (PostHog US Cloud, processed in the United States) | withorbital.ai, the Orbital web app and the Orbital desktop app | Records page views and feature events, and measures sign-up and onboarding funnels. PostHog stores a pseudonymous identifier in a first-party cookie and local-storage entries whose names begin ph_ (for example ph_<project key>_posthog) so that visits from the same browser can be linked | Identifier: up to 12 months. Event data: see Section 6 |
3.3 Support chat
| Technology | Provider | Where | What it does | How long it lasts |
|---|---|---|---|---|
| Crisp chat widget | Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France. Data is hosted in the European Union | withorbital.ai, once you accept support cookies or open the chat | Powers the chat bubble. Crisp sets a session identifier (a cookie named crisp-client/session/<website id>, plus crisp-client/* local-storage entries) so a conversation follows you between pages and on return visits, and so we can see which page you were on when you asked for help | Up to 6 months |
The chat widget does not load until you accept support cookies - see Section 5.5. Anything you type into a chat conversation is support data and is covered by our Privacy Policy.
4. Third-party content on our pages
Our home page and some other marketing pages load logos for the tools Orbital integrates with from two third-party asset hosts: cdn.brandfetch.io, operated by Brandfetch Sàrl, and logos.composio.dev, operated by Composio. These are the only third-party hosts our marketing pages load assets from; our fonts are served from our own domain, and the chat widget loads its own assets from Crisp only after you accept support cookies.
No cookie is set by this. But because your browser requests the file directly, those hosts receive your IP address, the page you were on and standard browser information. If you would rather it did not, a content blocker will stop it, and the pages still work - the logos simply will not appear.
5. How to control cookies
5.1 Your browser
Every major browser lets you see, block and delete cookies and local storage, for all sites or for ours specifically. Your browser's help pages have instructions. Blocking strictly necessary cookies will sign you out of the app and may break parts of the website.
5.2 Content blockers
A content blocker or privacy extension will stop the analytics script, the chat widget and the third-party asset host. The Services keep working without any of them.
5.3 Analytics opt-out
Decline analytics in the consent control, or to change your choice later as described in Section 5.5.
5.4 Support chat
The chat widget does not load unless you accept support cookies. Opening the chat yourself counts as accepting support cookies, and the widget loads at that point. If you accepted and would rather it did not load, change your choice as described in Section 5.5, or block it with a content blocker. You can always reach us by email at contact@withorbital.ai instead.
5.5 Your consent choice
We ask before we set anything that is not strictly necessary. When you first visit, we show you a consent control. Until you make a choice:
- strictly necessary technologies (Section 3.1) are set, because the Services do not work without them; and
- analytics (Section 3.2) and support chat (Section 3.3) are not loaded and set nothing on your device.
You can accept all, reject all, or choose by category. Rejecting is one action, not a trail of toggles, and we do not treat a failure to choose as acceptance.
Changing your mind. Use the "Cookie settings" link in the footer of any page, at any time. Your new choice takes effect immediately, and where you withdraw consent we stop loading the relevant technology and clear the cookies it set.
How we remember your choice. We store it in a strictly necessary first-party cookie named orbital_cookie_consent, kept for 12 months, which records the categories you accepted, when, and which version of this policy you saw, so we do not have to ask again on every page.
5.6 Global Privacy Control
We honour Global Privacy Control. If your browser or an extension sends a GPC signal, we treat it as a decision to decline analytics and support cookies, and we do not load them. You do not need to interact with our consent control for that to take effect, and we will show you that your choice has been recognised.
GPC is a browser-level signal, so it applies to the browser or device that sends it. If you use several browsers or devices, send it from each.
6. How long we keep the data
Session cookies go when you close your browser. Persistent cookies expire on the schedule in Section 3 or when you delete them.
For the data collected through them: identifiable product analytics are kept for up to 14 months, and support conversations and attachments for up to 12 months after the related support request is resolved, after which they are deleted or aggregated. These periods match the retention table in Section 8 of our Privacy Policy.
7. Changes to this policy
We will post any updated version here and change the effective date at the top. For material changes we will give notice in the Services or by email to account owners before the change takes effect. We keep dated copies of previous versions.
8. Contact
- Questions about cookies or this policy: privacy@withorbital.ai
- Post: Constructr, Inc., 1484 Pollard Rd, #3006, Los Gatos, CA 95032, USA