Privacy

Orbal records, transcribes and keeps your captures on your Mac. Each one is a folder: the audio, the transcript, your marks and their stills. They sit in a folder called Orbal in Documents, or wherever you chose under Save to in Settings. There is no account. Nothing from a capture leaves your Mac unless you choose Shape’s cloud model, and then only its words do.

Transcription runs on your Mac, with Apple’s own speech recognition in macOS 26. The first time you use a language, macOS may download Apple’s speech model for it. Your audio is not sent anywhere.

When you draw a mark during a capture, Orbal saves a still of the window under it, with your ink and without. Just that window, never the whole screen, and never video. A capture without marks saves nothing from the screen.

By default the audio goes to the Trash once its words are written; the Keep audio setting can hold on to it for 30 days or for good. If your Mac keeps Documents in iCloud, the Orbal folder syncs with the rest of it. That is Apple’s sync, not Orbal’s.

Shape cleans up the words of a capture before Orbal pastes them. With no model picked, or with orb-1-mini, that happens on your Mac. The first time you pick orb-1-mini, Orbal downloads it from Hugging Face, and once a day after that it asks orbal.app whether there is a newer version.

Qwen 3.8, the cloud model, needs a key and runs only when you pick it. Then the words of each capture go to orbal.app, with the capture’s language and any names from your Dictionary that appear in them. orbal.app passes the words and names to Cerebras, which runs the model. With Adapt on, the app also sends the name of the app you are pasting into, and Cerebras is told what kind of app that is, such as chat or email.

orbal.app does not keep the words. It counts each key’s requests for the month, and its log notes which options were on and the kind of app.

You get a key by giving your email address in Orbal, and we send the key there through Resend. The address is kept with the key in Upstash, the database orbal.app uses, and used only to send it. For a day after you ask, the address and a scrambled form of your IP address are also counted, so nobody can ask for keys over and over to fill someone’s inbox.

Orbal gives a capture to an agent, such as Claude Code or Codex, only when you send it there. The agent then reads the capture’s files on your Mac. What it does with them next, like passing them to its model provider, is governed by that agent and its terms, not by Orbal. The same goes for anything you paste into another app.

Once a day, Sparkle, the updater built into Orbal, asks orbal.app whether there is a new version. That request carries the app’s build, the macOS version and a rough band for how many captures you have made (none, 1 to 5, 6 to 20, or more), never the exact number. No names, no IDs, no content.

From Orbal 0.12 you can turn that off: Settings › General › Share usage. The check then carries only the app’s build, as updates need it to run.

The site counts those checks, and downloads of the app, in Vercel Web Analytics: the build and macOS version, that band, and for a download, which version and whether the app or a browser fetched it. Nothing there identifies an install. The downloads themselves are stored in Vercel Blob, Vercel’s file storage.

Sending feedback delivers your message to us as a plain email, sent through Resend. The version line goes with it (the app fills it in when you open the page from Orbal), and your address if you leave one. The address is optional: leave it if you’d like an answer. It is not added to any list.

No cookies. Vercel hosts orbal.app and, like any host, sees the IP address each request comes from. The analytics are Vercel’s too, cookieless and anonymous: they count visits, with the country, browser and kind of device, and keep nothing that identifies you.

Email hey@orbal.app. A human reads it.