Verifiable privacy

Don't trust us.
Test us.

Orbit is closed-source for now — but a privacy promise you can't read the code for, you should be able to prove with your own eyes. So here's exactly what Orbit connects to, how to watch it do so, and how to confirm your download is genuine. Nothing here is a claim you have to take on faith.

01 · Watch it yourself

See every connection Orbit makes

You don't need our source code to see what leaves your machine — you need a network monitor. Two ways, easiest first.

Easiest — Windows Resource Monitor (built in, nothing to install). Press Win + R, type resmon, open the Network tab, and watch the rows for Orbit Browser.exe. Every address it talks to shows up live.

Most thorough — Wireshark (free, the industry standard). Capture your traffic, then filter to Orbit. You'll see every packet, to every host.

Now use Orbit for an hour — browse normally. Then cross-check every connection against the list below.

The challenge: the only background chatter you'll see is the four connections in §02 — plus the sites you chose to visit. If you spot anything we didn't list, tell us on the feedback form — we'll explain it or fix it. That offer is the whole point.

02 · The complete list

Exactly what Orbit connects to

Every connection Orbit initiates on its own. This is the falsifiable part — if reality doesn't match, the claim is wrong, not fuzzy.

Orbit's own background connections — all four of them

updates.orbit-browser.comevery 4 hours

Checks whether a newer version exists. Sends nothing but the request (your IP, like any download). Downloads the installer only if there's an update. Hosted on Cloudflare R2.

orbit-telemetry.…workers.dev/pingonce per day

A headcount, nothing more. Sends your platform (e.g. "win32"), version (e.g. "1.3.8"), and four yes/no flags (first-ever / first-today / first-this-week / first-this-month). No identifier, no UUID, nothing about how you use the browser. The server counts distinct IPs with a daily-rotating salt, so even it can't link you across days.

easylist.to · ublockorigin.github.io · pgl.yoyo.org · raw.githubusercontent.comfirst run + refresh

Downloads the ad & tracker block lists — the exact same public lists uBlock Origin uses — then caches them locally. Sends nothing but the request. This is the shield fetching its ammunition, not reporting on you.

your DNS resolverwhen you load a site

Turns site names into addresses — normal DNS, the domain you're visiting. Uses your system/OS resolver by default (no Orbit endpoint involved). Optionally, you can switch on encrypted DoH to a provider you choose (Cloudflare, Quad9, Mullvad, NextDNS, or custom).

Only when you act

The sites you visit and their favicons — that's just browsing. · Your search engine (DuckDuckGo by default, your pick) — only when you search. · The update download — only when a new version actually exists. · Translation models — the first time you translate a language, Orbit downloads the offline model once (Mozilla's open-source Bergamot models, hosted on Google Cloud Storage), caches it, and translates on-device after that. The model comes to you — your text never leaves.

Never leaves your device

Passwords — encrypted, sealed by your OS keychain

What you translate — your text is never sent; it's translated on your device

Recall — encrypted full-text index, on disk only

File tools — PDF & image tools run on your device

Your history & habits — there's no account to tie them to

No cloud sync to us, no analytics, no profile, no AI

03 · Confirm your download

Make sure the file is genuinely ours

Orbit isn't code-signed (no commercial certificate yet), so instead we publish the hashes — so you can prove the installer is byte-for-byte the one we released.

Every download's SHA-256 is printed on the download page, with a one-line check you can paste into PowerShell:

if((Get-FileHash .\Orbit-Browser-Setup-1.3.8.exe).Hash -eq 'PASTE_HASH'){'✓ Verified'}else{'✗ Mismatch — do not run'}

And every release also publishes a signed-style provenance record:

SHA256SUMS — hash of each file SHA256SUMS.asc — GPG signature build-manifest.json — version, hashes, commit, build date

Cross-check the hash on the download page against SHA256SUMS, verify the signature, and you've confirmed the file end-to-end — no trust required.