Privacy

Draft of August 2026 · The Quiet Sky

The Quiet Sky tells you whether tonight is worth setting up for. To do that it has to know where your telescope stands, and where your telescope stands is usually your garden. That makes location the most sensitive thing here, so this document starts with it and is specific about the rest.

Who is responsible for your data

The controller of the data described below is QuietSky, based in the United Kingdom; a postal address is available on request at contact@quietsky.co.uk. Privacy requests go to contact@quietsky.co.uk.

What is collected

Your account

• The name and email address you type into the sign-up form.
• Your password, stored only as a bcrypt hash. It is never stored in a readable form and cannot be recovered, only replaced via the reset link.
• Your plan tier and, for new accounts, the date a free trial ends.
• Whether and when you confirmed your email address. The free trial only starts once you have, so this is what the app checks before opening the premium layers.
• A settings record: the observing site you last used (its coordinates, name and timezone), the target you were looking at, and the rig, Bortle and exposure preferences the app would otherwise keep only in this browser, stored against the account so they follow you between devices. It is the same data as the sites and rigs above, kept once more so a second device opens where you left off.

Observing sites: the sensitive part

Each site you save keeps a name, an IANA timezone, and a latitude and longitude stored to four decimal places. Four decimal places is roughly 11 metres, close enough to identify a specific garden, driveway or field, not just a town. If you save your home as a site, this database holds your home address in all but name.

You can avoid that. Round the coordinates yourself before saving, or name a nearby layby instead. A site placed a few hundred metres away changes essentially nothing in the forecast: the weather models these numbers are sent to have grid cells measured in kilometres.

Rigs

Telescope and camera, whether picked from the catalogue or entered by hand, plus focal length, aperture, pixel size, sensor dimensions, mount type, imaging mode, sub-exposure length, your wind tolerance and whether you have dew control. This is equipment data; it is stored because the scoring depends on it.

The imaging session ledger

Every session you log records the target, the date, total integration minutes, optionally the number and length of subs, free-text notes of up to 200 characters, and its own latitude and longitude, again to four decimal places. That means the ledger is also a dated record of where you were on particular nights. If you image from other people's properties or from sites you would rather not have written down, leave the coordinates off the entry.

Sky reports

When you answer Sky overhead now? under tonight's forecast, we store your answer (clear, partly or cloudy), the time, which of your sites it was for and the cloud figure you were being shown. The report is filed against the forecast grid square around the site, about two kilometres across, not the site's exact position. Your phone decides on its own whether you are near the site and sends only one word: near, far or unknown. Your phone's location never leaves it.

With each report we also keep the height of the sun and moon at that moment, how dark the site's sky is from a light pollution atlas, and, about half an hour later, what our forecast check and the weather satellites said at that time.

Reports are private unless you choose Shared anonymously under Sky reports in your profile. A private report is shown only to you, for 45 minutes, and is never used to check the forecast. A shared report is used, without your name, to measure and improve the forecast for that area; nobody is shown who reported or what they tapped. Undo deletes a report straight away.

The horizon tool

The horizon tool works without an account and runs on your phone. Your location turns the compass from magnetic to true north on the phone itself. To find the Sun or the Moon for the compass check, the page sends your position rounded to 0.1° (about 10 km) with the time; the samples of your trace are sent to be turned into a skyline. Neither is stored. The trace is kept in your browser's storage on that phone until you start again or save it to an account, where it becomes an observing spot like any other. If you type a town instead of sharing your location, the search goes to Open-Meteo geocoding, listed below. The page counts visits with Google Analytics; it never sends your location or your trace to Google.

Technical data

• Login sessions. While you are signed in, a row is kept holding a session identifier, your account id, your IP address, your browser's user-agent string, the encrypted session contents and a last-activity timestamp. It expires with the session and is deleted outright when you change your password or delete your account.
• Server logs. The web server records request lines in the ordinary way, which includes IP addresses. The application log additionally records your email address when you press the "I'd pay for this" button, so that interest can be counted; it records errors, which may incidentally include a request URL containing coordinates.
• Caches. Weather and sky-quality responses are cached by rounded coordinate, shared between everyone asking about the same patch of sky, and expire on their own. They are not tied to your account.
• Forecast accuracy records. Forecasts and matching observations are stored by site so model skill can be scored over time. These are keyed by location, not by user.

Advertising and analytics

The Quiet Sky is advertised on Facebook and Instagram, and the app page loads the Meta pixel to measure whether those adverts bring people who go on to use it. The Meta pixel is loaded on the app page only. The app page also loads Google Analytics to count visits and see which parts of the app are used, and these public pages, How the forecast works, Plan an imaging night, the astronomy weather guides and the horizon tool, load it to count the visits that arrive there. Neither is loaded on this page, the other legal pages, the FAQ, or the page a password reset link opens.

What the Meta pixel sends to Meta:

• Each time the app opens, and as you move between its pages, a page view: the address of the page (which can include a target name, or the internal number of one of your sites in a link), the page you came from, your IP address and your browser's user-agent string.
• Once per browser, an Activated event the first time someone without an account sets a site or picks a target, saying which of the two it was. No coordinates, site names or target names are added to it.
• When you create an account, a CompleteRegistration event. We add neither your name nor your email address to it.
• A browser identifier. A random code is created the first time the app opens and kept in this browser's local storage as qs_anon_id. Meta's script hashes it and sends it with every event, so Meta can tell that visits from the same browser, and a sign-up from it, belong together. We do not store it on our server or link it to your account. A second entry, qs_activated, remembers that the Activated event has been sent.
• Meta's own cookies. The script sets a first-party cookie, _fbp, and, when you arrive from a link in a Meta advert, _fbc.
• What Meta's script adds by itself. Meta's settings for this pixel let its script note which buttons are clicked, and look for an email address or name typed into a form on the page, hash them in your browser and send the hashes. The sign-up form is such a form.

Google Analytics receives the pages viewed, your IP address (which Google uses for an approximate location), device and browser details, and two events of ours: a sign-up, and the same first-site-or-target event as above, with no coordinates or names. It sets first-party cookies named _ga and _ga_…. It is not linked to your account.

The only cookies the app itself needs are the session cookie and the CSRF token, both strictly necessary for signing in. Nothing above is needed for the forecast to work: with a content blocker or your browser's tracking protection turned on, the app works exactly the same. Clearing this site's data in your browser removes the identifier and the cookies. Deleting your account does not remove what Meta or Google already hold; their own privacy policies govern that.

Third parties your data reaches

This app is a front end onto public astronomy and weather services. Some of those are called by our server, which sends coordinates but not your identity or your IP address. Others are called by your browser directly, which means those operators see your IP address and user agent as they would for any website you visit.

Called by our server (coordinates only)

• Open-Meteo (api.open-meteo.com, ensemble-api.open-meteo.com, and customer-api.open-meteo.com where the deployment holds a customer key): forecast and ensemble data.
• Environment and Climate Change Canada, GeoMet (geo.weather.gc.ca): the GDPS and RDPS cloud models.
• 7Timer! (www.7timer.info): astronomical seeing and transparency.
• Centre de Données astronomiques de Strasbourg (simbad.cds.unistra.fr, cds.unistra.fr): SIMBAD and the Sesame name resolver, sent the target names you search for.
• Wikipedia / Wikimedia (en.wikipedia.org): descriptive text for targets, sent the target name. The thumbnail that comes back with it is a upload.wikimedia.org address, which your browser then fetches itself; see the list below.
• The Lorenz light-pollution atlas (djlorenz.github.io, served from GitHub Pages): sky-brightness tiles for your area.

Called by your browser (they see your IP address)

• OpenFreeMap (tiles.openfreemap.org): map tiles. The tiles requested reveal which area of the map you are looking at.
• Centre de Données astronomiques de Strasbourg (alasky.cds.unistra.fr): the hips2fits service that renders target preview images.
• Wikimedia (upload.wikimedia.org): the thumbnail beside a target's description. The URL is chosen by our server, but the image itself is loaded by your browser, so Wikimedia sees your address whenever a resolved target has a picture.
• Open-Meteo geocoding (geocoding-api.open-meteo.com): place-name search, sent whatever you type into the site search box or the horizon tool's town box.
• Meta (connect.facebook.net, www.facebook.com): the Meta pixel described under Advertising and analytics.
• Google (www.googletagmanager.com, google-analytics.com): Google Analytics.
• Buy Me a Coffee: only if you click that link, and only then.

Several of these are outside the country the app is operated from; CDS is in France, ECCC in Canada, Open-Meteo in Germany, and Meta and Google may process what they receive in the United States. Each has its own privacy policy, which governs what it does with the requests it receives. The sources and licences page lists the same services again from the other side: what each one contributes, and under what terms.

What reaches the weather, astronomy and map services is the coordinates or search text of a request, with nothing about your account. The European services are covered by the United Kingdom's adequacy decision for the EU. Canada's adequacy covers only organisations under PIPEDA, which a government weather service is not; what ECCC receives is our server's request for the cloud value of one forecast cell, with nothing that identifies you.

Why it is held, and for how long

• Account details, sites, rigs and the session ledger exist to provide the service you asked for. They are kept until you delete them or delete your account.
• Login session rows expire on their own schedule and are removed when the session ends.
• Sky reports are kept for 13 months, then deleted, unless you undo them or delete your account first.
• The host's server logs are kept for 30 days. The app's own log files are kept as long as the host keeps them.
• Caches expire within hours to a month depending on how quickly the underlying data changes.
• The Meta pixel and Google Analytics measure whether advertising and search bring people who use the app. The browser identifier stays in your browser until you clear it; _fbp lasts about 90 days from your last visit, and Google's cookies up to two years. How long Meta and Google keep what they receive is set by them.
• The closure record described under Deletion below (an old account id, a date and, for subscribers, a payment customer reference, naming nobody) is kept indefinitely, because its whole purpose is to outlive the account.

Your rights, and how to use them

• Deletion. Deleting your account from the app asks for your current password, then in a single transaction erases the account row, every site, rig and logged imaging session attached to it, every live session on every device, the frame observations you uploaded through the ingest token, and any unspent password-reset link for your address. It is immediate and cannot be undone.
  Two things deliberately survive it. A closure record is kept indefinitely: the numeric id the deleted account used to have, the moment it went, and, if you ever subscribed, the payment provider's customer reference (a token of the form cus_… that holds no name, address or card): no coordinates, no email. The reference exists so a late payment can be matched to a closed account and refunded rather than quietly recreating it. The application log also records that same id as closed. Server logs and backups age out separately.
• Correction. Everything the app stores about you is editable in the app.
• A copy of your data. There is no self-service export yet. Ask at the contact address and it will be assembled by hand.
• Objection, restriction and complaint. Write to the contact address. You also have the right to complain to the Information Commissioner's Office (ICO).

Security, honestly stated

Passwords are hashed with bcrypt. Traffic is served over HTTPS. The API refuses cross-site browser requests and is rate limited. Changing your password signs out every other device.

What that does not amount to is a guarantee. This is a small application run by QuietSky, without a security team. Treat the precision of the coordinates you save as a decision you are making, not one that has been made safe for you.

Children

The app is not aimed at children, and no child's account is knowingly held. If one exists, write to the contact address and it will be removed.

Changes

Material changes will be announced in the app before they take effect. The date at the top of this page marks the current version.