Last updated 6 November 2026

Privacy Policy

This page explains what Orbit Cloud (api.orbitcosmetics.dev) stores when you use the Orbit mod, and why. Orbit asks you to accept it, and the Terms of Service, the first time you start the game with it.

In short

• Orbit knows you by your Minecraft name and UUID. It never sees your password or your Microsoft account.
• Orbit Cloud deletes messages to friends 30 days after they're seen. Turn on end-to-end encryption in a conversation (the lock) and Orbit Cloud can't read its messages at all.
• There are no ads, no analytics and no tracking, and nothing is sold.

What Orbit Cloud stores

• Your player: your Minecraft UUID and name, and when you first and last used Orbit Cloud. Your friends see when you were last online.
• Sign-in: sign-in uses Minecraft's own check, the same one Minecraft servers use. Orbit Cloud keeps a session for 24 hours, and stores only a hash of the session key.
• What you wear: on a server, the cosmetics and emote you're using and your skin's texture ID, so other Orbit players there can see them. This is deleted about 90 seconds after you stop sending it.
• Your cosmetics and emotes: the files you share, with their name and your UUID. A file nobody has used for 24 hours is deleted.
• Friends: your friends, your friend requests, and the players you blocked.
• Your statistics page: your time played (counted by Orbit), how many screenshots, cosmetics, emotes and body parts you have, and your profile: the page's colour, the description and pronouns you wrote, and the cosmetics of the outfit you chose (their files are uploaded so others can see them). Your friends, and players on the same server, can see it. Turn off Share statistics in Orbit's settings and nobody else sees it; your totals are kept so they follow your account.
• Your wardrobe: the featured items you claimed and your outfits (names and file IDs, not your own files), so they follow your account to another computer.
• Hosted worlds: while you host a world, its address, name and description, so your friends see it in their Multiplayer screen. This is kept in memory only and forgotten two minutes after you stop.
• Your computers: one public key for each computer you use Orbit on, so friends can encrypt messages for it. The private key never leaves your computer.
• Reports and bans: when someone reports a player, the reporter, the reported player, the reason and note, and the cosmetics involved. Reports are sent to Orbit's moderators on Discord, and Orbit Cloud deletes them after 7 days. Bans and blocked cosmetics are kept for as long as they apply. A ban removes what it doesn't allow from your statistics page (your outfit, and with a complete ban your description and pronouns).
• Internet addresses: your IP address is used in memory to limit how many requests one computer can make. Failed sign-ins are logged with their address.

Messages

Each conversation has a lock that turns end-to-end encryption on or off for your new messages in it. It's off at first.

• Encryption on: messages, pictures, shared cosmetics and invitations are encrypted on your computer, for your friend's computers and your own. Orbit Cloud stores only the encrypted message, who sent it to whom, and when. It can't read what you wrote or see your pictures. In the game, these messages have a dashed outline.
• Encryption off: messages travel encrypted over HTTPS, but Orbit Cloud stores them as they are, so any computer you sign in on can read them. Pictures are still encrypted, but the key is in the message, so Orbit Cloud could open them.

A message stays on Orbit Cloud until your friend has seen it, and is deleted 30 days after that, along with its picture. When you edit a message, the new text replaces the old one. When you delete one, its content and picture are deleted at once; only a note that it was deleted stays, so both of you see it as deleted. Your game keeps its own copy of your conversations.

On your computer

Your cosmetics, outfits, screenshots, conversation history and encryption keys stay in your Orbit folder and game folder. They're only sent when you share them yourself.

Other services

• Cloudflare carries the connection between your game and Orbit Cloud.
• Mojang handles sign-in and skins: Orbit asks Minecraft's own services for players' skins.
• e4mc, if you host a world with it, handles that connection under its own terms.
• Discord receives reports, for the moderators. If you leave Discord status on, the Discord app on your computer also shows what you're doing in the game, including the server's address, on your Discord profile.
• GitHub hosts this website.

How long

Sessions last 24 hours, and what you wear is deleted after about 90 seconds. Unused shared files are deleted after 24 hours, and messages 30 days after they're seen. Your player, friends and blocks stay until you ask for them to be deleted. Reports are deleted after 7 days. Bans and blocked cosmetics stay as long as they apply.

Your choices

• Turn off Use Orbit Cloud in Orbit's settings: Orbit then sends nothing to Orbit Cloud.
• Remove friends, or block players, at any time in Social.
• Turn off Share statistics: nobody else sees your statistics page.
• To get a copy of your data, or to have it deleted, open an issue on GitHub and ask for a private way to reach us. Don't post private details there.

Changes

When this policy changes, the date at the top changes too, and Orbit asks you to accept the new version the next time you start the game.