Controller
The controller for everything described here is the operator named in the legal notice, reachable at hello@orbinauts.com. There is no data protection officer; the law does not require one for a site of this size.
What the site does not do
The site sets no cookies. There are no accounts, no logins and nothing that recognises you: nothing is written to your browser's storage, no identifier follows you from one page or visit to the next, and no page remembers your previous visit. There is no advertising and no third-party tracking.
Hosting and the network: Cloudflare
The site, the API and the domain's name service run on Cloudflare (Cloudflare, Inc., San Francisco), which processes data on the operator's behalf under its data processing addendum. Every request you make passes through Cloudflare's network, which keeps its own aggregate traffic statistics for the domain. Cloudflare's servers in the European Union are used where your connection reaches them; Cloudflare's own privacy policy describes its processing.
Server logs
Each request the site or the API answers leaves one log record at Cloudflare: the address requested, the method, the request's headers, among them your IP address and your browser's identification, the status and timing of the answer, and any error the code raised. These records are kept for seven days and then deleted. They are read only to find faults, and nothing derives a profile from them. The basis is the operator's legitimate interest in running the service and keeping it working (Article 6(1)(f) GDPR).
The rate limiter
The API allows each calling address a number of requests per clock hour. To count them it keeps, per address, the start of the current hour and the number of requests seen in it, and nothing else. The record is overwritten by the next hour the address calls in. This applies to your address when you use the API directly and when a page on the site fetches from it on your behalf, except the Most followed request described below, which it does not count.
The locate button
The live map and the satellite pages offer to find the next pass over your own location. Nothing happens until you press the button; your browser then asks your permission and reports your position. Orbinauts rounds the latitude and longitude to two decimal places, about a kilometre, and the altitude, when the browser reports one, to the metre, and sends them only to its own API, which answers with the passes over that point. The position is not stored anywhere beyond the log record described above, and it never reaches anyone else. The basis is your request (Article 6(1)(b) GDPR): the pass cannot be computed without the point.
Web analytics: Cloudflare's beacon
To know how many people use the site and which pages they read, the pages carry Cloudflare Web Analytics. It is a small script loaded from static.cloudflareinsights.com that sets no cookie, stores nothing on your device and does not fingerprint your browser. It sends to Cloudflare, as the operator's processor, the path of the page, the page it was reached from, the kind of browser and how long the page took to load. Cloudflare discards the IP address it arrives from at the edge, keeps the individual records for seven days and aggregates after that. The basis is the operator's legitimate interest in knowing whether the site is used (Article 6(1)(f) GDPR). Blocking the script with a content blocker costs you nothing on the site.
Most followed: counting Followers
The live map lists the satellites its visitors are following right now. To count them, a map showing a satellite or constellation you chose, by a tap, a search, a list or a link naming it, sends a small request to Orbinauts' own API once a minute while the page is on screen, and so does a map whose Most followed list is open, to fetch the list. A map also sends a single one, naming nothing, the first time it is on screen with room for the list beside it, so that the list is ready when it appears. The request carries two things: a random number the page makes when it loads, held only in the page's memory and gone when you close or reload the page, and the satellite or constellation the map follows, or nothing. Your position is never part of it. The satellite the map opens on before you choose anything is not counted, a map embedded in another site never sends it, and nothing is sent while the page is hidden in a background tab. Nothing is stored on your device.
The API keeps each random number with what it named and when it last named it, and answers every request with the counts, never with the numbers themselves. A map is in the live count for two minutes after its last request, and in the count of the past 24 hours for 24 hours after it last named what it follows; its record is then deleted at the latest ten minutes later. The count keeps no IP address; like every request, this one leaves the log record described under server logs, which holds your IP address and not what the request carried. The basis is the operator's legitimate interest in showing visitors what others follow, counted without knowing who they are (Article 6(1)(f) GDPR).
The API's rate limiter does not count this request. Instead one Cloudflare rule turns away, for ten seconds, an IP address that sends more than ten of these requests in ten seconds, so that no single machine can flood the count. To apply it Cloudflare counts the requests per IP address at its edge, as the operator's processor, as for the server logs above.
Writing to the operator
Mail to hello@orbinauts.com, or to any address at orbinauts.com, is forwarded by Cloudflare's Email Routing, which does not store the messages it passes on, into a mailbox at Google (Google Ireland Limited). Your message and address are kept there for as long as the matter takes and then deleted. The basis is answering your request (Article 6(1)(b) GDPR).
Your rights
You have the right to ask what personal data the operator holds about you, to have it corrected or erased, to have its processing restricted, to object to processing based on a legitimate interest, and to receive the data you provided in a portable form. Write to hello@orbinauts.com. You also have the right to complain to a data protection supervisory authority, in particular the one of the place where you live.
Changes
This notice describes the site as it is; it changes when the site does. This version is from September 2026.