Local work.
Clear boundaries.

ORBITARIUM is a local three-dimensional gravity sandbox and collection of eight orbital experiments. This policy covers version 1.0.0: the toolbar action, packaged observatory page, simulation controls, local archives and checkpoints, portable system files and the privacy page included with the extension.

The publisher identified on the Chrome Web Store listing distributes the software. This build has no player account, online universe, server-side simulation, multiplayer service or global leaderboard. A planetary system is calculated in your browser rather than submitted to a remote physics engine.

Information can be handled without leaving the device. Body names, masses, coordinates, experiment status and checkpoint records are all processed by the application. This policy explains those local records as well as the absence of automatic transmission to the publisher.

The observatory works from packaged code and procedural graphics. It does not fetch textures, star catalogs, remote scripts or model updates while a simulation runs. It includes no advertisements, analytics SDK, account registration, payment system, cloud backup or automatic sharing workflow.

When persistent browser storage is available, the current workspace is saved on that device. When storage is unavailable or a save fails, the interface says so. Work in a memory-only tab has not been confirmed as a saved browser record; export a system file before closing it.

You can choose to share an exported file using another application. That action may disclose names and model values to its recipient. The observatory does not secretly send a second copy to the publisher when you create, edit, archive or export a system.

The extension’s toolbar action opens observatory.html, a page packaged inside the extension, in a new browser tab. A small Manifest V3 background service worker handles that click. It does not run the gravity solver when the observatory page is closed.

ORBITARIUM does not replace your New Tab page. It can coexist with a separate New Tab extension without declaring a competing New Tab override. The action does not read the address, title or content of the website that happened to be open when you clicked the toolbar icon.

No host permissions or browser API permissions are declared in the production manifest. The service worker requests creation of the extension’s own page without requesting access to your browsing history or an inventory of your open tabs.

A system record contains a schema version, its name, simulation time, interacting bodies, recent events and an intervention count. Each body has an internal identifier, name, type, mass, physical collision radius, three-dimensional position, velocity, display color and decorative-ring setting.

While an experiment is active, the world can also contain its experiment identifier, initial body references, target-checking state, completion or failure status, and explanatory outcome text. These fields support the local challenge rules; they are not a server submission or a public score.

The supplied starting systems and experiments are packaged examples. They are not generated from your location, interests, previous websites or search history. Renaming a body or a system can introduce personal information of your own choosing, even though the default names do not require it.

IndexedDB stores the workspace in a database named orbitarium-v1 when the browser makes that storage available. The workspace contains the current system, up to twelve archived systems, up to ten recent checkpoints, and the identifiers of experiments completed locally.

Writes are browser-managed transactions with a revision number. User edits schedule saves after a short delay, and running simulations periodically schedule a snapshot rather than writing on every integration step. A visible world and a successfully committed local record are not necessarily identical at every instant.

The extension does not use cookies or localStorage to maintain an online identity. It does not upload its database, synchronize it through a browser account, or maintain a publisher-held player directory. Internal identifiers and revisions organize this workspace rather than identify you across unrelated websites.

Multiple observatory tabs can otherwise compete to save different versions of the same local workspace. The application uses the browser’s Web Locks API to reserve editing for one tab. A second tab shows a read-only state and can retry after the editing tab closes.

The writer also checks the revision recorded in the database before committing a replacement. A newer revision causes the save to fail rather than silently accepting a stale overwrite. If the browser cannot provide the editing lock while persistent storage is available, the application does not pretend that simultaneous writes are coordinated.

This coordination is local to the product’s browser storage context. It is not a network login or a collaboration session. A memory-only page is a separate working copy, not an automatically synchronized view of another tab, archive or device.

The gravity solver uses the bodies in the open world to compute new positions and velocities. Its CPU budget, adaptive time steps and visible compute-limited status are runtime controls. They do not upload a performance trace or report your hardware to the publisher.

Camera position, zoom, follow selection, display quality, open panels, current speed selection and temporary path forecasts are session controls. Recent path trails and rendering buffers are derived from the current system. This version does not promise to restore all of those presentation details after closing the tab.

WebGL creates graphics resources through the browser and graphics driver. The application does not assemble a device fingerprint, query a hardware identifier for advertising, or send shader errors to an online crash collector. An interrupted graphics context pauses the simulation and displays feedback while preserving the world in page memory.

Up to thirty-two bodies participate in pairwise gravitational interaction. Background stars, rings, halos and procedural surface patterns are visual elements, not additional entries in an invisible physical or behavioral dataset. No image-generation service is contacted to produce those surfaces.

The model is an educational approximation in normalized units. It uses softened Newtonian gravity and inelastic sphere merging, not a complete astronomical simulation of climate, life, relativity or stellar evolution. Displayed sphere sizes are enlarged independently of their physical collision radii.

These modeling choices matter to interpreting your records, but do not introduce new categories of personal information. The application does not infer educational performance, scientific expertise or personal characteristics from the systems you make or the experiments you complete.

A checkpoint stores the complete world state at a particular moment, including bodies and their velocities. Checkpoints are created on request and before certain changes so you can try another branch. Restoring one replaces the working model; it is not a request to a server to reconstruct a past universe.

An archived system is a named local snapshot that remains separate from the current world. Deleting an archive does not remove a downloaded export, and restoring an archive does not automatically publish it. The interface keeps these actions distinct so an experiment can be saved without starting a sharing workflow.

The world retains up to 160 recent event messages for interventions and mergers. Those messages can contain body names you entered. They are local explanatory history, not analytics telemetry. Old messages and checkpoints can be dropped when their documented count limits are reached.

The eight experiments evaluate finite conditions in the running local model. Completing one adds its identifier to the workspace’s local completed list. There is no account synchronization, remote achievement verification, ranking service or automatic notification to a teacher, parent or publisher.

A downloaded system file may include passive experiment state that was part of its world. Import intentionally opens a sandbox and removes the active challenge status instead of awarding progress from a file. This prevents a portable model from being treated as an authenticated achievement record.

An individual system export is not a complete backup of every archive, checkpoint and completed-experiment flag. Export each important system separately. The current release does not provide an online recovery account from which the publisher can restore deleted progress.

The standard file picker reads only a file you choose. The importer accepts a bounded JSON system format and reconstructs supported fields after validating types, numeric ranges, vector dimensions, body counts and event lengths. Invalid imports are rejected instead of silently replacing the current world.

An imported system can contain user-written names and event text. Those strings are displayed as text rather than evaluated as HTML or JavaScript. The extension does not execute commands contained in a file, fetch external body definitions or follow an embedded URL to complete an import.

File selection does not grant general disk-scanning access. The application does not enumerate neighboring folders, search documents, monitor your downloads directory or retain a separate record of the file’s original full path. Only the parsed system data becomes part of the working model.

Export creates a .orbitarium JSON file from the current system. The record contains the names and values needed to reproduce that model, along with its recent event messages and available passive experiment fields. It is a readable file, not an encrypted container or a password-protected archive.

The browser receives a locally created Blob for its ordinary download workflow. A temporary object URL is revoked later. The extension does not control the exact folder selected by browser settings, nor can it guarantee when the operating system reclaims temporary memory or disk resources.

Once you send the file through email, messaging, a cloud drive or a public website, that destination and its recipients can handle the contents according to their own rules. Check names and event text before sharing. ORBITARIUM does not retract copies that have already left your computer.

The extension has no content scripts and requests no host access. It does not inspect webpages, forms, search results, messages, documents, shopping activity or video playback in other tabs. The universe is not personalized using the webpage beneath the toolbar action.

There are no requests for microphone, camera, location, notification, contacts, cookies, password, clipboard or browser-history access. The observatory does not record microphone sound, take screenshots of other pages, or maintain a system-wide keyboard listener.

Pointer and keyboard input inside the observatory controls camera movement, selection, velocity editing and playback. The application uses these events for the open interface; it does not save a complete behavioral recording or transmit keystrokes for profiling.

The packaged application contains no fetch, XMLHttpRequest, WebSocket, beacon or external telemetry endpoint. Scripts, icons and styles are local, and the content security policy blocks application network connections and remote executable code. Running a longer or faster simulation does not activate an online calculation fallback.

Your browser separately communicates with its own services for installation, extension updates or other browser functions according to your settings. Those processes are not controlled by the gravity solver. The absence of application network calls is not a promise that your entire browser never connects to the internet.

This privacy document is bundled for offline reading. The publisher may also host a public copy for the store listing. Visiting that website is a separate request to its hosting infrastructure, which may receive ordinary connection information even though the installed observatory does not upload system records.

This build does not include advertising, tracking pixels, an analytics SDK, a subscription service or a behavioral-marketing integration. It does not send usage counts, simulation configurations, experiment attempts or model files to the publisher for sale, profiling or advertising.

No online third party is chosen by the application to render a planet, store an archive, process a file, moderate names or compute an orbit. The browser’s graphics, storage and download facilities operate as local platform services within the limits of the browser and operating system.

Independent software may still copy information according to your settings. Examples include operating-system backups, a shared browser profile or a cloud-synchronized downloads folder. ORBITARIUM does not control those services, and their separate policies govern copies they create or receive.

Saved systems and local progress are retained until deleted through the observatory, removed with relevant browser data, or otherwise removed by the browser. There is no publisher-side retention schedule for universe files because this application does not create publisher-held online copies.

Application limits on bodies, archives, checkpoints, event counts and imported file sizes do not remove the browser’s own storage quota. The manifest does not request unlimitedStorage. A rejected or interrupted transaction can leave newer work only in the current page, which is why the save indicator and portable exports matter.

Closing the observatory stops active simulation. It does not intentionally advance a world in the background or delete all previously saved models. Browser cleanup, uninstalling, profile corruption or a device failure can nevertheless make local records unavailable. Keep independent copies of important systems.

The Archive dialog lets you delete an individual archive after confirmation. Erase all local ORBITARIUM data clears the saved workspace, including archives, checkpoints and local experiment progress, and opens a fresh default system. A later save can create a new default record, not a recovery of the erased history.

Removing a body from the current universe is a modeling operation, not complete deletion of all prior copies. An earlier checkpoint, archive or exported file may still contain that body and its name. Remove those separate copies when your intention is broader data deletion.

The extension cannot erase files already downloaded to disk or shared elsewhere. Manage those through the operating system and destination services. Browser-managed record deletion is not a guarantee of forensic erasure from hardware, backups or another person’s copy.

Import validation checks supported records and reconstructs expected fields rather than evaluating arbitrary file contents. User-supplied names are inserted as text. The runtime package contains no remote-code loader, private signing key, account credential or analytics secret.

The workspace is not encrypted by ORBITARIUM. Another person with access to your unlocked profile, operating-system account, backups or exported files may be able to inspect it. Local-only processing reduces transmission but does not replace device security, access controls or careful sharing decisions.

When a saved record cannot be read safely, the application avoids overwriting it automatically and offers a recovery route where possible. A raw recovery export can contain the complete damaged workspace and should be treated as potentially private. Software validation and recovery cannot guarantee restoration after every crash, disk problem or malformed record.

The observatory has no registration, public chat, public gallery or mechanism designed to ask children to submit identifying information to the publisher. It does not request an age, school, parent email address or real name to run an experiment.

Users can still type identifying information into a system or body name and later share a file. Adults supervising children should explain that a readable export can include those names and local event messages. A shared device can expose one user’s saved worlds to another user of the same browser profile.

The extension does not provide parental monitoring, classroom reporting, identity verification or age-verification services. A local experiment-completion mark is not sent to an instructor or parent. External sharing and support channels remain separate from this offline application.

You can use the supplied systems without entering a real name, decline imports, export a model, delete archives, erase the local workspace, or disable and remove the extension. There is no telemetry opt-out hidden behind the view settings because this build has no application telemetry upload.

For access to a locally held world, use the observatory and its export control. For deletion, use the local controls and relevant browser settings. The publisher cannot search an online user account to find your universe, because the application does not create that account or send it a model directory.

For privacy rights concerning information separately supplied to the publisher, such as a support email, contact the publisher through the store listing. Prefer a minimal, non-sensitive example when reporting an issue. Do not send an entire browser profile or unrelated private files as a troubleshooting step.

This policy is dated 6 September 2026 and describes version 1.0.0. Future releases may change data behavior. A release introducing network services, new permissions or additional data handling should be accompanied by corresponding policy and product disclosures. This document does not authorize unimplemented online behavior in the current code.

For questions about this version, use the developer contact or support channel on the ORBITARIUM Chrome Web Store listing from which you installed it. Include the product name, version and a short description of the concern. The application itself has no support chat or automatic diagnostic-upload button.

A message or review that you deliberately send through a separate service is processed by that service and the publisher who receives it. Remove private names from screenshots and system files where possible. This bundled document does not invent a publisher email address; the product listing must identify the actual distributor and its contact channel.