Security & where data lives

• On your device: everything, in your browser’s private storage (IndexedDB and the origin-private file system). Permanent user files live exclusively on user devices.
• In the cloud (only with sync): your synced workspace in an EU-hosted database (Supabase, Ireland). Every row is protected by per-workspace access rules — nobody else can read it.
• Shared Spaces: planned for Thread Team and not generally available yet. The data-policy layer already enforces workspace roles and owner-only Never Share records.
• AI tool connections (MCP): tokens are stored only as a one-way hash, can be limited to Spaces and read-only, expire, and can be revoked instantly. Items marked Don’t use with AI are never returned.
• Attachment synchronization (Temporary Relay): Supabase is not the permanent source of truth for attachment binaries. Attachment binaries are stored locally on user devices. Supabase Storage functions as an end-to-end encrypted, temporary synchronization relay: every file has its own key, locked for each receiving device, so the server can’t read it. Relay objects are deleted after verified delivery to the required devices or after expiration.
• Limitation: Orbit Thread’s temporary relay architecture is NOT cloud backup. If every device containing the original binary is lost and the temporary relay has expired, Orbit Thread cannot recover that binary merely from synchronized metadata or extracted text.
• API keys (BYOK) are encrypted at rest on the server and never returned to the browser.
• Content you capture is treated as untrusted and separated from system instructions; tool actions still require their configured policy and authorization.

See the Privacy Policy for details.