Privacy notice

This notice explains what personal data Orbitpop collects, why we use it, how we protect it and the rights you have under UK data protection law.

Last updated: 8 November 2026.

Who is responsible for your data

Orbitpop Studio runs Orbitpop at orbitpopplay.com and is the controller of the personal data described in this notice. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any question about your data, please email mail@orbitpopplay.com.

We try to collect as little as possible. You can play with a guest pass without giving us any personal data at all, and a free account needs only a nickname, an email address and a password.

Data we collect from guests

A guest pass does not ask for your name, email address or any other personal details. When you take one, you tick two boxes to confirm you are 18 or over and in the UK, and that you accept our terms and this notice. We then use:

a strictly necessary session cookie, so the site knows your guest pass is active for its 2-hour period;
your browser's local storage, which holds your guest wallet of play coins, your game settings and your cookie choice on your own device.

Information kept in local storage stays in your browser. It is not sent to us as part of your guest play.

Data we collect for accounts

If you open a free account, we store:

your nickname, which may be shown in the site interface;
your email address, used to identify your account and to contact you about it;
your password, stored only as a one-way hash;
your game progress, including your play coin balance, level, favourites and settings, so it can be synced to your account;
any self-exclusion, break or reality-check settings you choose, so that we can apply them.

We do not ask for payment details, because nothing on the site can be bought.

How passwords are protected

When you set a password, our server turns it into a one-way hash before storing it. A hash cannot be turned back into your password, so we never see or keep the password itself. If you forget it, we cannot tell you what it was; we can only help you set a new one.

Why we use your data and our lawful bases

UK GDPR requires a lawful basis for each use of personal data. Ours are:

Contract: to create and run your account, sync your progress and provide the games you ask for.
Legal obligation and legitimate interests: to check that players are adults in the UK, to apply player care tools such as self-exclusion, and to keep the site secure and free from misuse.
Consent: to use optional Google Analytics 4 and Google Ads measurement, only if you agree to it.

We do not sell your personal data, and we do not use it to market coins, because there are none to sell.

Analytics and advertising measurement

With your consent, we use Google Analytics 4 to understand how the site is used, and Google Ads measurement to understand whether our own adverts for the site are working. We use Google Consent Mode v2 with every setting denied by default. Until you choose to allow analytics or advertising measurement in the cookie banner, those tags do not set their cookies. You can change your choice at any time, as described in our cookie policy.

Who we share data with

We share personal data only where needed to run the site. This includes our hosting provider, which stores the server and account database on our behalf, and Google, if you have consented to analytics or advertising measurement. We may also disclose data where the law requires it. Google handles measurement data under its own privacy terms, which you can read on Google's website.

How long we keep data

Session cookie: until your browser session ends or your guest pass period is over.
Local storage: on your device until you clear it in your browser.
Account data: for as long as your account exists. When you delete your account, the record is erased immediately.
Analytics and measurement cookies: only if you consent, for the periods listed in our cookie policy.

Your data protection rights

Under UK data protection law you have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to erase your data;
object to, or ask us to restrict, certain uses of your data;
receive your account data in a portable format;
withdraw your consent to analytics or advertising measurement at any time.

To use any of these rights, email mail@orbitpopplay.com from the address linked to your account. We will reply within one month, as the law requires.

Deleting your record

You can delete your account at any time from "My orbit". This erases your account record from our server immediately, including your nickname, email address, password hash and game progress. It cannot be undone. Guest data in local storage can be removed by clearing your browser's site data.

Children's data

Orbitpop is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has opened an account, please contact us and we will delete it.

Security measures

We protect your data with measures suited to the small amount we hold, including one-way hashing of passwords and restricted access to our server. No system is perfectly secure, so please use a password you do not use anywhere else.

Complaints to the ICO

If you are unhappy with how we handle your data, please tell us first at mail@orbitpopplay.com so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at https://ico.org.uk/.

Updates to this notice

We may update this notice when the site changes or the law requires it. The date at the top shows the latest version. If a change significantly affects how we use your data, we will make it clear on the site.