Everything Orbit does, one page

Orbits — your family's private space

Every family on Orbit lives inside an Orbit: a private container that holds the parents, their children, any other family members you bring in, and the connections between them. Usernames only need to be unique inside an Orbit, so your child can pick a name they like without fighting the entire internet for it.

An Orbit can hold three kinds of people:

• Parents — adults with full approval power: they can add children, invite co-parents, set safety rules, and approve who their kids chat with.
• Children — accounts created by a parent. Children don't have email addresses; they sign in with a one-time code.
• Other family members — non-parent adults like grandparents, aunts, uncles, or older siblings. They join the family chat without inheriting parental approval power.

Co-parents and other family members join by invitation, so the whole family sees the same conversations and shares the same private space.

Parent sign-up

Parents register with email, password, username, and an optional display name. Before the account is created, we send a six-digit one-time code to the email address to make sure you own it. Enter the code, and the account is live.

• Email-verified. No code, no account. Emails are globally unique.
• Passwords hashed with Argon2id. We never store your password in the clear.
• Tokens rotate. Short-lived access tokens plus a refresh token, signed with Ed25519.
• One device at a time, or many. Each device registers itself and gets its own encryption session.

Orbit onboarding — create or join

After sign-up and email verification, the very next screen asks the parent one question: are you starting a new family Orbit, or joining one?

Create

Pick a name for your Orbit (it doesn't have to be unique — we use a random ID under the hood). Submit, and you're in. You can now add children and invite co-parents from the dashboard.

Join

A co-parent already in the Orbit generates a one-time invite code and shares it. Paste the code on the Join tab, submit, and you're placed in the same Orbit. The code is single-use and expires in 30 minutes.

Invite deep links

Invite codes work two ways:

• Type it in. Eight characters, easy to read out over the phone.
• Tap a link. The code is also encoded as a deep link of the form orbit://join?code=XXXXXXXX. Tap it on a phone that has Orbit installed and the Join screen opens with the code already filled in.

Deep links work on both iOS and Android. On iOS we register the orbit URL scheme; on Android, a matching intent filter. The code is displayed as a QR in the dashboard, so co-parents can scan with any camera app and the phone opens Orbit straight to the join screen.

Child accounts

Children don't sign up themselves. A parent creates the profile from the dashboard (username, display name, optional avatar) and Orbit generates a one-time login code the child can type in on their own device. The code is shown as plain text and as a QR code — whichever suits the child's age best.

• No email address required for the child.
• The login code expires in 24 hours and becomes invalid after first use.
• If the code expires before the child logs in, the parent can re-generate one from the child-detail screen.
• Once logged in, the child device registers itself and gets its own encryption keys.

Other family members — grandparents and beyond

Not every adult in a family is a parent. Grandparents, aunts, uncles, an older sibling, a partner without children — they can all join an Orbit as a family member.

• Family members register with email + password, just like parents, and join via an invite code from anyone already in the Orbit.
• They show up in the family chat, can be added to any conversation in the Orbit, and see the people in their Orbit.
• They don't have parental approval power — they can't add children, set safety rules, or approve cross-family chats. That stays with the parents.
• They get the same end-to-end encryption as everyone else.

This means the kid's grandparents can be in the family group chat without you having to give them a "parent" role they didn't ask for.

Parent-approved child logins

By default, once a child is logged in on a device, they stay logged in. But for extra control, parents can turn on require login approval per child. When it's on:

• Every new device that tries to sign the child in is quarantined.
• The parent sees a "Login requests" card on the dashboard with the device label, the time, and the approximate location (from the request IP).
• The parent taps Approve or Reject. The child's phone shows a "waiting for approval" screen in the meantime.
• Approved devices are trusted — they skip the prompt next time.

This is resolved most-restrictive-wins across co-parents: if either parent requires approval, it's required. Rejecting a device immediately ends any session it had.

Your Orbit dashboard

The dashboard is the parent's home screen. It shows:

• Orbit header with the Orbit name and member count.
• Invite button that generates a fresh one-time code (shown as both text and a QR).
• Children cards — one per child, tap to open the child-detail screen.
• Login-request cards when approved-login is on and a child is waiting.
• Add menu — add a child, or link another parent.

Per-child controls

Each parent-child link carries its own set of toggles. When a child has two parents, we resolve every setting most-restrictive-wins — if either parent turns something off, it's off for the child. This way, co-parents never cancel each other out.

Open any child card to reveal:

• Security — require login approval on/off, list of trusted devices, regenerate login code.
• Chat features — audio / image / video / emoji toggles, plus autocorrect, read receipts, typing indicators, and avatar permissions (see below).
• Screen time — per-hour message limits and daily quiet hours (see below).
• Mack — on-device AI moderation: mode (Off / Hold for approval / Block), per-label toggles, watchlist (see below).
• Device controls (Premium) — block specific apps, set bedtime / school-hours schedules on the child's phone (see below).

Meet Mack — on-device AI moderation

Mack has got your back. Mack is our custom AI safety agent — and Mack lives on your child's phone, never in the cloud. Every outgoing message is analysed by Mack locally before it is encrypted and sent. No message text ever leaves the device for moderation. End-to-end encryption is not weakened, not bent, not "scanned around". This is the fundamental difference from server-side scanners such as Bark: we never see your child's plaintext, full stop, and Mack doesn't phone home with what was said.

Mack is trained on a kid-tone corpus (synthetic and curated public datasets) to catch paraphrase and slang that simple word lists miss. Mack covers the following categories:

• Bullying and harassment
• Hate speech
• Sexual content and sexual solicitation
• Scams and phishing
• Doxxing (sharing personal identifying information)
• Self-harm ideation
• Suicidal ideation

Each parent-child link tells Mack how to behave:

• Off — Mack still runs locally (crisis labels always fire), but no other labels trigger any action.
• Hold for approval — a flagged message is held on the device. The parent receives a push notification and approves or rejects from the child-detail screen. Pending requests expire in 24 hours.
• Block — Mack refuses flagged messages on the device, before encryption. The child sees a clear explanation and the message is never sent.

Per-label toggles

Within whichever mode you choose, you can tell Mack to ignore individual categories. If your child plays games where "free Robux" scam phrases are familiar banter rather than a genuine threat, you can turn off the scam label without affecting the others. Crisis labels — self-harm and suicidal ideation — cannot be disabled. Mack will always trigger a crisis card for the child and an alert to the parent regardless of the overall mode setting.

Crisis safety net

When Mack fires either crisis label, three things happen simultaneously:

• The child's screen shows a crisis card with UK helplines: Childline 0800 1111 and Samaritans 116 123.
• The parent receives a high-priority alert.
• The message is sent to the recipient. Orbit does not silence a child who is reaching out for help. This is an intentional product decision, not a gap in the filter.

Feedback loop

If a parent believes Mack got it wrong, they can flag the alert from the child-detail screen and optionally add a written note. There is a separate opt-in to share the message text to help train the next version of Mack; this is off by default and is a per-message decision. Any text shared is anonymised on the server before it enters the training corpus — no parent ID, child ID, or conversation ID is stored alongside it.

Watchlist

Mack covers the universal categories. The Watchlist lets you add custom words or phrases on top — a friend's name, an app you're concerned about, a phrase like "vape" or "Snapchat". When a watchlisted term appears in your child's outgoing or incoming messages, you receive a notification. The watchlist is notification-only: it never blocks or holds a message. Think of it as a heads-up for conversations you might want to have. Like Mack, watchlist matching happens locally on the device.

Chat-feature toggles

Text is always allowed. Everything else is opt-in, per child, per parent. Each toggle has a separate send and receive setting where it applies:

• Audio messages. Voice notes — send and receive independently.
• Image messages. Photo sharing — send and receive independently.
• Video messages. Short video clips — send and receive independently.
• Emoji & reactions. Both emoji-only messages and tap-to-react reactions, send and receive.
• Read receipts. Whether the child's reads are surfaced to peers (and vice versa).
• Typing indicators. Whether the child sees and emits "typing…" bubbles.
• Autocorrect. Suppress the keyboard's autocorrect to encourage your child's spelling practice.
• Profile photo permissions. Whether the child can change their own avatar, and whether they see their friends' avatars (initials shown instead).

Disallowed message types are blocked two ways:

• On send. The child's app refuses to send a blocked type, with a friendly message explaining why.
• On receive. If a blocked type slips in from a different family, the child sees a blurred placeholder — they can tell a message arrived, but they can't view the content.

Changes apply immediately to open sessions — the child doesn't need to relaunch.

Screen time & quiet hours

Two simple knobs to slow things down without ending the conversation entirely:

• Per-hour message limits. Cap how many messages a child can send and receive each hour. Once they hit the cap, further messages pause until the next hour rolls over — the child sees a friendly "paused until {time}" banner in the chat, and so does whoever is talking to them, so nobody thinks they're being ignored.
• Daily quiet hours. Pick a start and end time. During quiet hours, push notifications to the child are silenced — messages still arrive, they just don't ping the phone in the middle of the night.

The "ping the phone" master switch is also per-child: notifications stay off by default on a new child account, and a parent has to flip them on. Children only see the "turn on notifications" prompt once a parent has enabled it.

Device controls Premium

Sometimes the right answer is bigger than chat. Device controls let a parent restrict the child's phone itself — not just Orbit. This is a Premium feature.

• App blocks. Pick which apps the child can't open. On iPhone, you choose them from Apple's standard picker (which means app names never leave the phone — Apple keeps that list private even from us). On Android, you pick by app name from the installed list.
• Time-window schedules. Set bedtime, school hours, or any window where chosen apps are off-limits. Outside the window, the apps work normally.
• Content-filter VPN. An optional on-device filter that blocks adult content across the whole phone, not just inside Orbit.

If the subscription lapses, restrictions pause but your settings are kept — re-subscribe and everything turns back on with no re-setup.

Alerts feed

Everything Mack flags, every approval the parent owes, every login request, every avatar a child changes — it all rolls up into a single Alerts feed for the parent. Open it from the dashboard.

• Aggregated across every child you're linked to.
• Read state is per-parent — marking it read on your phone marks it read on your tablet too.
• You choose how each kind of alert reaches you: in-app toast, push notification, email — or just the feed.

Chat experience

Once a conversation is open, Orbit behaves like a modern messaging app — with everything running over end-to-end encrypted sessions.

• Typing indicators show when someone on the other end is writing.
• Read receipts tell you when your message has been seen.
• Reactions — tap and hold to drop an emoji reaction.
• Per-device sessions. If someone has an iPhone and an iPad, each device has its own session. A lost phone doesn't compromise the others.
• Offline delivery. Encrypted messages queue on the server until the recipient's phone comes back online.
• Sign-out wipes local crypto state. A re-login starts fresh — no cached plaintext, no old keys.

Cross-family chat

Children want to chat with children in other families, and Orbit supports that — through a deliberate, parent-gated flow:

• Parent contacts. Parents add each other first. Either parent sends an invite; the other parent accepts.
• Chat requests. Once two parents are connected, parent A picks their own child and sends a request to parent B. Parent B reviews the request and assigns one of their children to the other end.
• Conversation created. Only after both parents sign off does Orbit open a conversation between the two children.

Nothing about this flow is one-sided. Every cross-family chat has two parents' approval behind it. Either parent can end the connection at any time and the conversation closes.

Chat protection — when something goes wrong

If something does cross a line, Orbit has two backstops beyond what an individual parent can do:

• Conversation under review. If a chat is reported, our safety team can place that single conversation under review while they investigate. Both sides see the same neutral "Chat under review" label in place of the composer — neither party is told who reported what or why. Other conversations carry on as normal. Once the review ends, the chat resumes and any messages held in the meantime are delivered.
• Account suspension. An account that violates our community rules can be suspended for a fixed window or permanently. The account is kept intact — chat history, family links, settings — so a mistaken suspension can be lifted with no data loss. Parents can see "Suspended" status on their own children at a glance.

Avatars & themes

Two small things that make the app feel like home:

• Avatars. Anyone can set a profile photo. Parents can also set one on a child's behalf. Two per-child toggles let you decide whether your child can swap their own photo, and whether they see other people's (initials shown instead). When a child does change their photo, every linked parent gets an alert — no quiet swaps.
• Themes. Five built-in colour palettes — Default, Ocean, Blossom, Ember, Forest — picked from the Appearance row in Profile. Available to parents and children; the choice is per device.

End-to-end encryption

Every conversation on Orbit is end-to-end encrypted. The sender's phone encrypts one ciphertext per device in the family trust circle — the other child(ren) in the chat and every parent on both sides. The server relays the ciphertext and never sees plaintext.

That means parents see their child's messages on their own device (decrypted locally), not via the server. When a parent adds a new phone, their other devices re-encrypt history for the new device over WebSocket — no re-login from scratch, no lost conversations.

For the full technical detail — X25519 ECIES envelope, Curve25519, per-device fanout, planned upgrade path to Double Ratchet — see the Security page.

Free and Premium

Orbit has a generous free tier that fits most one-child families. Premium lifts the caps on how many people can be in your Orbit, and unlocks Device Controls.

• Free tier. Up to 1 child, 2 parents, and 1 other family member in your Orbit, plus 2 cross-family parent contacts per parent. End-to-end encryption, Mack on-device AI moderation, watchlist, screen time, alerts, themes, and chat-feature toggles are all included — none of those are Premium.
• Premium. Unlimited children, parents, and other family members in your Orbit. Unlimited cross-family parent contacts. Plus Device Controls (app blocks, schedules, content-filter VPN — see above).

Premium is a single subscription that covers the whole family Orbit — any parent can buy or restore it, and every member benefits. We won't quote a price here while we're in early access; you'll see the current price in-app at the point of purchase.