Legal
Cookie policy
In plain language
- Some cookies run the site: your sign in, your language, your currency and your cookie choice. They need no consent, and every one is listed below.
- Statistics with PostHog and advertising with the Meta Pixel load only after you press "Allow marketing cookies". Until then, nothing goes to PostHog or Meta.
- "Necessary only" is one tap, the same size as the other button, and the site works exactly the same.
- Change your mind any time under "Cookie settings" at the bottom of every page. Withdrawing stops both at once and deletes their cookies.
- We do not sell personal data.
This summary is not a replacement for the text below, but if the two ever disagree, treat the disagreement as our mistake and tell us.
Two kinds of cookies, and you decide on one of them
Necessary cookies keep you signed in, remember the language and currency you picked, hold a friend's invite code until checkout, remember your cookie choice and keep offer popups from repeating. The site cannot do those things without them, so they need no consent.
Statistics and marketing cookies are different. They show us how the site is used and measure our ads. They are switched on only with your consent, and only in the browser where you gave it.
No necessary cookie carries an advertising identifier, and none is read by anyone but us. Over HTTPS the sign in cookie is named __Secure-better-auth.session_token, which stops a page served over plain HTTP from overwriting it.
Every cookie this site sets
| Cookie | Purpose | Lasts | Category |
|---|---|---|---|
| orb_consent | Your cookie choice | 182 days | Necessary |
| NEXT_LOCALE | The language you chose | Until the browser session ends | Necessary |
| better-auth.session_token | Keeps you signed in | 30 days, renewed every 24 hours | Necessary |
| orbislo_currency | The currency you chose | 1 year | Necessary |
| orbislo_invite | A friend's invite code | 90 days | Necessary |
| orb_pop | Keeps a closed offer popup away | Up to 180 days | Necessary |
| orb_sub | Stops sign up offers after you confirm the newsletter | 180 days | Necessary |
| ph_<project key>_posthog | PostHog visitor id for statistics | 1 year | Statistics, after consent |
| _fbp | Meta browser id for measuring ads | 90 days | Marketing, after consent |
| _fbc | Meta ad click id | 90 days | Marketing, after consent |
Browser storage: orbislo.popups, orbislo.popups.session and orbislo.popups.views (necessary), ph_<project key>_posthog and orbislo_ft (statistics, after consent), and orb_meta_purchase (marketing, after consent).
The cookie banner
On your first visit a banner asks one question, with two buttons of the same size: "Necessary only" and "Allow marketing cookies". Each is one tap.
Before you answer, and after "Necessary only", no statistics or advertising script loads and no request goes to PostHog or Meta. Offer popups also wait until you have answered.
"Allow marketing cookies" switches on two things: PostHog statistics and the Meta Pixel. Your answer is kept in the orb_consent cookie, and we ask again after six months.
"Cookie settings" at the bottom of every page opens the banner again. Choose "Necessary only" there and both stop at once on the same page, and _fbp, _fbc and PostHog's storage are deleted from your browser.
Necessary cookies
These need no consent under section 25(2) TTDSG and Article 5(3) of the ePrivacy Directive, because each one does something you asked for.
For the offer popups we also keep a small record in browser storage: orbislo.popups in local storage, and orbislo.popups.session and orbislo.popups.views in session storage. They count how often an offer was shown, so it is not shown again too soon.
- orb_consent. Your cookie choice, marketing or necessary. 182 days, SameSite Lax, Secure on HTTPS.
- NEXT_LOCALE. The language you picked in the switcher. It outranks the Accept Language header your browser sends, and your IP address is never part of the decision. A session cookie, dropped when the browser session ends. Each of the 12 languages also has its own URL.
- better-auth.session_token. A random session identifier and nothing readable: not your email address, not your name, not your balance. Set when you sign in, it lasts 30 days and is renewed at most once every 24 hours. HttpOnly, Secure, SameSite Lax. Signing out deletes it, on our servers as well as in your browser. Our phone apps keep the session in the device keychain instead.
- orbislo_currency. The currency you picked in the switcher, so prices and checkout match it. 1 year, SameSite Lax.
- orbislo_invite. A friend's invite code from a /promo link, so the discount applies at checkout. 90 days.
- orb_pop. Remembers that you closed or finished an offer popup, so it stays away. Up to 180 days.
- orb_sub. Set when you confirm the newsletter, so we stop offering you the sign up. 180 days.
Statistics: PostHog, after consent
PostHog shows us page views, which pages lead to a purchase, and errors, so we can fix what gets in your way. The provider is PostHog Inc., on its EU cloud with servers in Frankfurt. The data travels through our own domain (/ingest).
It keeps a random visitor id as ph_<project key>_posthog, in a cookie and in local storage, for 1 year. We also keep orbislo_ft in local storage: where your first visit came from, such as a search engine or a campaign, so a later order can be credited to it. If you are signed in, the visit is linked to your account.
Marketing: the Meta Pixel, after consent
The Meta Pixel measures our ads, meaning whether a visit led to a purchase, and helps show our ads to people likely to be interested. The provider is Meta Platforms Ireland Ltd.
It sets _fbp, a browser id, for 90 days, and _fbc, an ad click id, only when you arrive from a Meta ad, also for 90 days. Meta's script also keeps the last outside referrer in local storage (lastExternalReferrer), and it is deleted with the rest when you withdraw.
With this consent, a checkout also carries these ids, your IP address and your browser user agent, and after payment our server reports the purchase to Meta through the Conversions API, with your email address hashed. Session storage keeps orb_meta_purchase so that one purchase is reported once.
Without consent, nothing is sent to Meta, from your browser or from our server.
Third parties, named
None of these sets a cookie on our pages.
- Stripe. Payment is taken on Stripe's own hosted checkout page, where Stripe sets its own cookies on its own domain to detect fraud.
- Google and Apple sign in. Only if you press those buttons, which hands you to their consent screen and their cookie rules.
- Cloudflare, our hosting provider. It keeps short lived server logs containing IP addresses, for security and abuse handling. A log is not a cookie, and the privacy policy covers it.
- Fonts. Our two typefaces are served from our own domain, so loading a page sends nothing to Google.
What breaks if you refuse
Refusing statistics and marketing changes nothing you can do here. Every page, every plan and every checkout works the same.
Block the necessary cookies and you can still read every page, compare every plan, check coverage in 197 destinations and open a support conversation. You cannot stay signed in, so your wallet, orders and eSIM profiles are out of reach, and your language and currency choices stop persisting.
How to clear them, browser by browser
Delete them whenever you like. Doing so signs you out on that device only, and the banner asks again on your next visit. Each browser below also has a per site rule that blocks cookies for one domain permanently, and using it here is supported rather than merely tolerated.
- Chrome on desktop. Settings, Privacy and security, Third party cookies, See all site data and permissions. Search for our domain and delete it.
- Chrome on Android. Settings, Site settings, Data stored. Find our domain and choose Delete data.
- Safari on macOS. Safari, Settings, Privacy, Manage Website Data. Search for our domain and remove it.
- Safari on iPhone or iPad. Settings, Apps, Safari, Advanced, Website Data. Swipe to delete our entry.
- Firefox. Settings, Privacy and Security, Cookies and Site Data, Manage Data. Search for our domain and remove it.
- Edge. Settings, Cookies and site permissions, Manage and delete cookies and site data, See all cookies and site data.
The legal basis, and your rights
Necessary cookies need no consent under section 25(2) TTDSG and Article 5(3) of the ePrivacy Directive. Where they handle personal data, our lawful basis under the GDPR is Article 6(1)(b), performance of the contract you asked for.
Statistics and marketing rely on your consent, under Article 6(1)(a) GDPR and section 25(1) TTDSG. You can withdraw it at any time under "Cookie settings", with effect for the future.
Your rights of access, correction, deletion, portability and objection are in the privacy policy and apply here unchanged. We do not sell personal data, and you can refuse advertising cookies at any time under "Cookie settings".
This page changes when the code changes. If you find a cookie set by this site that is not listed here, tell us. Support answers in under 60 seconds, 24 hours a day.