SkyFlux
Privacy policy
Last updated 11 October 2026 · applies to the SkyFlux app and skyflux.app
SkyFlux has no accounts, no ads and no tracking or analytics code of our own. Your exact position stays on your phone: our servers and the data services we use receive at most a location rounded to an area about 11 km from north to south. The one exception is a Google map that you open yourself (see below). Crash reports and aurora alerts are off until you switch them on.
What leaves your phone
| Data | Goes to | Why | Kept |
|---|---|---|---|
| Your location rounded to one decimal place (an area about 11 km from north to south), and the app language | Our server in an EU data centre, which asks Open-Meteo (Switzerland) for the weather (if needed MET Norway or, for places in the USA, the US National Weather Service) and Geoapify (EU) for the place name. They receive only the rounded coordinates (Geoapify also the language), never your IP address. | Weather forecast and the name of your town | Request logs 7 days; place names 180 days (stored per place, not linked to you) |
| A less precise area (whole degrees, about 110 km from north to south) | Our server, which fetches cloud-map tiles from MET Norway and Open-Meteo | Cloud map | Request logs 7 days |
| The map region you look at | NASA GIBS (USA), directly from your phone | Satellite image | Not kept by us |
| Only if you switch on aurora alerts: a random ID created by the app, a push token, the rounded location, your alert level, the night hours when no alerts are sent, whether you use a 12- or 24-hour clock, your language and time zone, and whether your phone is Android or iPhone | Our server; alerts are delivered by Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iPhone). On Android, Google’s Firebase software also sends Google a Firebase installation ID, the app version and the device type; the ID is stored on the phone until you uninstall the app. | Alerting you while the app is closed | Until you switch alerts off, or 35 days after you last opened the app, whichever comes first |
| Only if you buy SkyFlux Plus on Android: the purchase token that Google Play gives the app (a code that identifies the purchase; it does not tell us who you are, but Google can link it to the Google account that made the purchase) | Our server, which passes it on to Google (Google Play Developer API) and returns only a short verdict to the app: whether Plus is paid for, which plan and until when | Confirming that the purchase is real and still paid for. The token is sent when you buy, when you tap Restore purchases, and when you open the app and the last check is more than a day old or your paid period ends within a day | Our server does not store the token; your phone keeps it together with the verdict. Server request logs are kept 7 days and do not contain it |
| Only if you buy SkyFlux Plus on iPhone: the transaction that the App Store signs and gives the app: product, transaction number, time of purchase and of renewal or expiry, store country, price and currency (it does not tell us who you are, but Apple can link it to the Apple Account that made the purchase) | Our server, which checks Apple’s signature and may ask Apple (App Store Server API) about the transaction by its number, and returns only a short verdict to the app: whether Plus is paid for, which plan and until when | Confirming that the purchase is real and still paid for. The transaction is sent when you buy, when you tap Restore purchases, and when you open the app and the last check is more than a day old or your paid period ends within a day | Our server does not store the transaction; your phone keeps it together with the verdict. Server request logs are kept 7 days and do not contain it |
| Only if you switch on crash reports: the error, where in the code it happened, the name of the screen and your last few actions in the app (no screenshot), app version, operating system version, language and screen size. No location and no ID. | Our server | Fixing faults | 180 days after the fault was last seen |
| If you e-mail us (including through Send feedback in Settings): your address, what you write and any attachments. The button only opens a draft in your mail app with the app version and device details filled in; nothing is sent until you press Send. | Our e-mail provider | Answering you and fixing problems | Until it is no longer needed to answer you or fix the problem you reported |
Every internet request shows your IP address to the server it reaches. Ours use it only to keep the service running: a per-hour request count (deleted after 24 hours) and our host’s request logs (deleted after 7 days). Vercel, which hosts this website, keeps its request logs for at most 30 days. The app also downloads public astronomy and space-weather data (NASA, NOAA, CelesTrak and similar) directly; like any website, those services see your IP address and what is requested (for NASA GIBS, also the map region being displayed; see above). When you tap Check for updates on iPhone, your phone asks Apple’s App Store directly for the latest version of SkyFlux, telling it your country.
Google Maps and Google Calendar. When you open a Google map in the app (to pick a landmark or a place for a trip), the map opens at your exact position. Google, which draws the map, receives the map area shown and the information your device normally sends to Google Maps, such as its IP address and device details. Google’s own privacy policy applies. The Add to calendar button on Android sends the event details to Google Calendar.
What stays on your phone
Your precise GPS position, the camera image of the AR view, compass and motion data, your settings (apart from those sent with place names and aurora alerts, above), saved places, sky journal and reminders. Any location the app sends or links to is the rounded location or a coarser area, except a Google map you open yourself.
Legal basis
Providing the features you use (GDPR Art. 6(1)(b)): location, place names, astronomy and space-weather data, maps, calendar entries, aurora alerts and, if you buy Plus, confirming your purchase. Your consent (Art. 6(1)(a)): crash reports; you can withdraw it at any time with the same switch. Withdrawing it does not make earlier processing unlawful; reports already sent are deleted on the schedule above. Our legitimate interest (Art. 6(1)(f)): keeping our servers and this website secure and running (IP addresses in logs and rate limits), and answering your e-mails.
Location, aurora alerts and crash reports are optional: without location you can pick a place by hand, and without alerts or crash reports the rest of the app works the same. Your IP address, however, is sent whenever the app or this website connects to the internet.
Service providers and transfers
- Supabase hosts our servers in an EU data centre (Stockholm); any access to them from outside the EU/EEA (for example by Supabase support staff) is covered by the EU standard contractual clauses.
- Google (Firebase Cloud Messaging, Google Maps) and Vercel (hosts this website) are in the USA and certified under the EU–US Data Privacy Framework. For Google Play purchases, Google is a separate controller (see SkyFlux Plus).
- Apple (push notifications) uses the EU standard contractual clauses. For App Store purchases and update checks, Apple is a separate controller (see SkyFlux Plus).
- Our e-mail provider is in the USA; the transfer is covered by the EU standard contractual clauses.
- Geoapify (EU), MET Norway (EEA) and Open-Meteo (Switzerland, which has an EU adequacy decision) receive only rounded coordinates from our server (Geoapify also the app language).
- The US National Weather Service receives only rounded coordinates from our server, never your IP address or any ID.
- NASA, NOAA and similar public services in the USA: your phone downloads public data from them directly. Our servers send them nothing about you; like any website, they see your IP address and what is requested.
Our service providers that process data on our behalf are bound by data processing contracts (GDPR Art. 28) to use your data only on our instructions and to keep it secure. You can ask us for a copy of the safeguards that cover transfers outside the EU/EEA.
Security
The app and this website send data over an encrypted connection (HTTPS), and our servers keep only what is described above.
SkyFlux Plus
Plus is sold only through your phone’s app store: Google Play on Android and the App Store on iPhone. The store handles the payment under its own privacy policy; we never see your card or store account. Google and Apple are each a separate controller of your purchase data, also when our server checks a purchase with them (or, on Google Play, acknowledges it), as described below.
On Android, to know that a purchase is real, the app sends our server the purchase token it received from Google Play. Our server asks Google whether the purchase is valid and still paid for, and returns a short verdict to your phone. Google also requires every purchase to be acknowledged within three days; our server does that if the app has not already done so. On iPhone, the app sends our server the transaction signed by the App Store; our server checks Apple’s signature, may ask Apple about the transaction, and returns the same short verdict. The phone keeps the token or transaction and the verdict so that the app works offline. We keep no record of the token or the transaction, or of who bought what: there are no accounts, and our server checks afresh each time. If you reinstall the app or switch phones, the app finds your purchase again when it starts, through your Google account on Android or your Apple Account on iPhone; Restore purchases does the same on demand.
Your rights
You may ask to access, correct or delete your data, restrict or object to its use, and, where the law provides, receive it in a portable form. Write to support@skyflux.app. Because there are no accounts, the only data we can usually link to you are e-mails you have sent us. You can delete the aurora alert record yourself by switching alerts off in the app; other data expire as described above. You may complain to the Estonian Data Protection Inspectorate (aki.ee) or the authority in your country.
You can object at any time to our use of your data based on legitimate interest (IP addresses in logs, e-mails). We make no automated decisions about you and build no profile of you.
Children
SkyFlux is for a general audience and asks no one for a name, e-mail address or age. If you are younger than the age at which the law where you live lets you consent to online services yourself, crash reports may be switched on only with the consent of a parent or guardian. In the EU/EEA that age is 13 to 16 depending on the country: for example 13 in Estonia, Finland, Sweden, Norway and Portugal, 14 in Spain and Italy, 15 in Denmark and France, and 16 in Germany, the Netherlands and Poland. Outside the EU/EEA, the age set by your local law applies, or 13 where the law sets none.
Changes
If we change what data the app collects, why we use it or who receives it, we will update this page before that version is released.
Who we are
Täisühing Nordic Moonlight (registry code 11234439), Sääse tn 14-10, 12918 Tallinn, Estonia, is the controller of the personal data described here. Contact: support@skyflux.app.