Guardian data and privacy.

Real Guardian pages read Bungie data when the integration is configured. Orbit is an independent fan project, not affiliated with or endorsed by Bungie.

Public lookup

Searching sends the Bungie name you enter to Bungie. Public profile pages request anonymous profile, character, equipped item, and recent activity data according to Bungie visibility settings. Public snapshots are saved in PostgreSQL and refresh in the background when stale; item definitions can be cached for a day. Public share links contain membership identifiers, never credentials. Search uses a short-lived, process-local limiter keyed by a hash of the client address supplied by the hosting environment.

Connected accounts

Signing in stores the Bungie membership identifier, linked Destiny memberships, encrypted OAuth credentials, and a hashed server session. The passwords are entered on Bungie’s authentication pages and are never received by Orbit. Tokens may be refreshed to read the account. OIM reads private inventory and performs transfers, equipment changes and free socket changes only when requested by the signed-in player.

Public and private information

The account page may show data visible only through the authorization. Those responses are not placed in the shared public cache. The public profile link independently fetches anonymous data and may show less information. Connecting an account does not publish private inventory.

Automatic public tracking and rankings

Looking up a real public Guardian automatically registers their public profile for site-managed activity tracking. Connecting an Orbit account is not required. Orbit stores public raid and dungeon instance identifiers, dates, completion evidence, timings and combat totals, alongside bounded recent PvP matches and current-character public PvP totals. Ops completions are stored as compact category totals. Temporary instance receipts prevent duplicate XP; receipts older than seven days are removed after the initial scan finishes. Background jobs resume independently of the browser and make recently viewed profiles eligible for refresh after five minutes. Open profiles and My Guardian navigation also schedule refreshes; unattended scheduler execution can be delayed. Missing or restricted Bungie data can leave coverage incomplete. Complete raw reports are not stored. Anonymous profiles not viewed for 90 days are pruned; connected accounts retain their history. Public snapshots use a bounded database cache and refresh in the background. A confirmed public-visibility restriction invalidates the saved public snapshot.

Profile customization

Saved themes and widget layout use one compact preference record per membership. An optional preferred-equipment showcase and earned-rank frame use a separate bounded record. Saving a showcase explicitly publishes its selected equipment names and Bungie images on the public profile. XP and levels are calculated from verified stored full clears and recorded Ops completion totals, without a separate XP history.

Orbit Item Manager and loadouts

Private inventory is fetched from Bungie with the connected account and is not saved to the public profile cache or stored in the database. Orbit stores up to 12 compact loadout plans per membership, including equipment references, socket choices, artifact targets, descriptions and stat priorities. These plans are private until the player publishes a Preferred Build. Publishing shares a separate snapshot of the selected plan, without private inventory instance identifiers. Editing a private draft does not change that snapshot. Deleting account data also removes saved loadouts.

Notifications

Signed-in accounts have a private inbox for new ranks, level gains and activity milestones. An initial progress baseline prevents old history from generating repeated alerts. Read state persists per account. Up to 50 personal notifications are kept, with messages older than 90 days removed during subsequent progress checks. News is stored once for the site with a separate read timestamp per account. Account deletion removes this notification data.

Disconnecting

The account menu Settings popup provides a delete-account action that removes the stored Orbit account, credentials, memberships, sessions, saved appearance, tracked runs, and import jobs. Public data already available from Bungie can still be looked up and cached independently of account linking. Revoke application authorization and adjust public visibility in Bungie.net settings as needed.

External services

Fonts and local artwork are served by this site. Real item and emblem images are requested from Bungie, so the browser connects to Bungie for those images. Bungie handles authentication and game-data requests, the database provider stores account records, and the hosting provider may process access logs. A complete production privacy, retention, and deletion policy must be finalized before public launch.