Privacy Policy

BlendPixel ("we," "us," or "our") operates Orbit, a Chrome browser extension for organic Instagram growth. This policy explains what information Orbit collects, how we use it, where it is stored, who we share it with, and the choices and rights you have. Orbit's automation runs inside your own Chrome browser through your existing Instagram session; the sections below describe the limited data that leaves your device and the third parties that process it on our behalf.

1. Information We Collect

Account information

When you create an Orbit account we collect your email address and a password. The password is encrypted and stored by our authentication provider (Supabase); we cannot see or retrieve your plaintext password.

Instagram information (stays on your device)

To perform the automation you configure, Orbit reads Instagram data through your logged-in session in your browser: your Instagram handle, the hashtags and accounts you target, and the public profiles and posts it interacts with. This Instagram content is processed locally on your machine to run the features you turn on. We do not receive, transmit, or store your Instagram posts, messages, target lists, or media on our servers, and Orbit never asks for or handles your Instagram password.

Product and usage analytics

To understand how Orbit is used and to improve it, we collect pseudonymous product-analytics events through PostHog, a processor acting on our behalf. These include which features you open, how automation sessions start and finish, counts of actions performed (such as the number of likes or follows in a session), your plan tier (free or premium), the Orbit version you run, and a random identifier generated on your device to count distinct users. See Section 5 for exactly what these analytics do and do not include, and how to turn them off.

Payment information

If you subscribe to Orbit Premium, payments are processed by Stripe. Stripe collects and handles your card details directly under its own privacy policy; we do not receive or store your full card number. We retain your subscription status and billing records needed to manage your plan.

Technical and local data

Orbit stores your settings, automation configuration, and session progress in your browser's local storage. Basic technical information (such as browser and device characteristics and error diagnostics) may be processed to keep the extension working and to fix problems.

2. How We Use Your Information

We use the information we collect to:

• Create and authenticate your account and keep you signed in
• Provide and maintain the Service and execute the automation features you configure
• Display your analytics and growth metrics inside the extension
• Process subscription payments and manage your plan
• Understand feature usage and reliability so we can improve and optimize the Service
• Provide support and communicate with you about updates or service-related matters
• Protect the Service and comply with legal obligations

3. Data Storage and Security

Where your data is stored:

• Your automation settings, configuration, and session progress are stored locally in your browser's storage on your own device.
• Your account (email), settings, queue, and usage records are stored in our cloud database, hosted by Supabase.
• Pseudonymous product-analytics events are stored by PostHog as our processor.
• Subscription and payment records are stored by Stripe as our payment processor.

We protect your data with the following measures:

• Encryption in transit (HTTPS/TLS) for data sent between the extension and our providers
• Passwords are hashed by our authentication provider; we never store plaintext passwords
• We do not have access to, and do not store, your Instagram credentials
• Access controls and appropriate technical and organizational security measures

No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to limit what we collect.

4. Data Sharing and Third-Party Processors

We do not sell, trade, or rent your personal information. We do not share your data with advertising networks, data brokers, or social platforms. We share limited data only with the service providers below, who process it on our behalf under contracts that restrict their use of it:

• Supabase — authentication and cloud database. Stores your account email, settings, queue, and usage records. Privacy policy: supabase.com/privacy
• PostHog — pseudonymous product analytics used to improve the Service (see Section 5). Bound by a data processing agreement that prohibits reuse for its own purposes. Privacy policy: posthog.com/privacy
• Stripe — payment processing for Premium subscriptions. Handles your card details directly. Privacy policy: stripe.com/privacy
• Google (Chrome Web Store) — distributes the extension and provides aggregate install statistics. Privacy policy: policies.google.com/privacy

We may also disclose information when required to comply with a legal obligation or valid legal process, to enforce our terms, or to protect the rights, safety, and property of our users, the public, or BlendPixel.

5. Product Analytics and Your Choices

Our product analytics, processed by PostHog, are separate from the automation itself, which runs entirely in your browser.

These analytics include:

• Product events: which features you open, and how automation sessions start and finish
• Counts of actions performed, such as the number of likes or follows in a session
• Your plan tier (free or premium) and the Orbit version you are running
• A random identifier generated on your device, used to count distinct users

These analytics never include:

• Your Instagram handle, username, or password
• Your Instagram posts, stories, captions, comments, or media
• Your Instagram direct messages or any private communications
• The usernames or accounts you target
• Session recordings, screen recordings, or keystroke logging

You are in control of this data:

• You can turn product analytics off at any time in Settings, under Privacy, using the 'Share usage analytics' toggle. When off, no analytics events are sent and no analytics identifier is used.
• If you are in the European Economic Area, the United Kingdom, or Switzerland, product analytics are off until you agree to them. We ask once, on first run, and send nothing until you choose.
• Everywhere else, analytics are on by default and you can turn them off at any time.

6. Cookies and Tracking

Orbit uses your browser's local storage and authentication tokens to keep you signed in and to remember your settings. We do not use advertising cookies, cross-site tracking, or social-media pixels. The product analytics described in Section 5 are first-party and can be disabled in Settings.

7. Instagram

Orbit interacts with Instagram's platform through your own logged-in session to provide its features. Your use of Instagram is governed by Instagram's own Terms of Service and Privacy Policy, and we are not responsible for Instagram's data practices.

8. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data and account
• Object to or restrict certain processing
• Withdraw consent to analytics at any time (in Settings)
• Export your data in a portable format

To exercise these rights, contact us at [email protected]. We will respond within the timeframes required by applicable law.

9. Data Retention

We retain your personal information only for as long as necessary to provide our services and fulfill the purposes described in this policy. When you delete your account, we delete or anonymize your account data within 30 days, except where we are required to retain it for legal or accounting purposes. Data stored locally in your browser is removed when you uninstall the extension or clear your browser storage.

10. International Data Transfers

Our service providers (including Supabase, PostHog, and Stripe) may process and store data in the United States and other countries. Where data is transferred internationally, we rely on appropriate safeguards and the providers' own compliance mechanisms to protect it.

11. Children's Privacy

Orbit is not intended for use by children under the age of 13, and Instagram itself requires users to be at least 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date above. Please review this policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us:

Email: [email protected]