SpaceSight24 — Privacy Policy

1. Controller & contact details

2. Short summary (for App Store & first-run)

SpaceSight24 uses your device Location and Camera to show satellites nearby and provide AR overlays. These features are processed on your device by default. If you opt in to location-based notifications, we will store a minimal, encrypted location marker on our servers (coarse by default) solely to deliver those notifications. You may withdraw consent at any time.

3. What personal data we collect, how and why

We only collect personal data necessary to provide features you enable. Categories and purposes are listed below.

A. On-device / live processing

• Precise location (GPS coordinates) — processed on device to compute satellite passes and render AR overlays. Processed in memory while the app runs and not uploaded by default.
• Camera frames / live camera access — used to render AR overlays and align satellite markers. Live frames are processed on-device and are not uploaded unless you explicitly save or share an image.

B. Server-side location storage for notifications (opt-in only)

• What we store (only if you opt in): hashed device push token, timestamp, and a coarse location marker (default). If you explicitly permit precise-location notifications, precise coordinates will be stored only with separate explicit consent.
• Purpose: to target and deliver location-based push notifications (e.g., "satellite pass in your area"). We will not use stored notification locations for advertising, profiling, or sale.

C. Optional / user-initiated data

• Saved AR snapshots: stored on device; uploaded only if you choose a cloud backup or share them.
• Account / subscription metadata: email, subscription status and minimal billing metadata received from Apple for subscription management. Payments are processed by Apple — we do not receive card numbers.
• Technical data / identifiers: app version, device model, and crash logs only if you enable crash reporting. These identifiers are not linked to your identity unless you create an account.

4. Lawful basis for processing

• Location & Camera (on-device): consent through iOS permission system, combined with your informed agreement to use these features.
• Server-side notification location storage: your explicit consent (opt-in). Coarse location is used by default; precise location storage requires separate explicit consent.
• Subscriptions / account metadata: performance of a contract (to provide paid features) and legitimate interest in managing subscriptions.
• Technical data / crash reporting: legitimate interest in improving app stability and performance.
• Legal compliance: where required to comply with applicable law.

5. Retention & where data is stored

• On-device live processing: live location and camera frames are processed in memory only and not stored permanently.
• Local caches: minimal caches (e.g., last-known location, recent pass history) are stored encrypted on-device; default retention: 7 days. Users can clear caches via Settings → Privacy → Clear local data.
• Notification server records (opt-in): coarse location records are retained up to 30 days from last activity; precise location records (only with explicit consent) are retained up to 7 days. Server records are automatically deleted when retention period expires or on consent withdrawal.
• Consent records: consent timestamps and versions are retained for 3 years for legal compliance and audit purposes.
• Subscription records: retained as required to fulfill contracts and meet legal obligations.

6. Recipients / third parties & international transfers

We share personal data with the following categories of recipients:

• Apple Inc. (App Store): Processes payments and subscription data in accordance with Apple's terms and privacy policy. Data may be transferred to the United States under Apple's compliance with applicable data protection laws.
• Push notification services: Apple Push Notification Service (APNs) receives push tokens and routing data to deliver notifications. APNs operates under Apple's privacy commitments and data protection compliance.
• Public satellite data providers: We access public orbital data (e.g., CelesTrak, NASA) that does not involve processing of your personal data.
• Cloud storage providers (optional): Only if you explicitly choose to backup or share content, data may be transferred to your selected cloud provider under their terms.

For transfers outside the European Economic Area, we rely on adequacy decisions where available or implement appropriate safeguards such as Standard Contractual Clauses.

7. Technical & organisational security measures

• Data minimisation: coarse location by default; precise location only with explicit separate consent.
• Encryption of data in transit (HTTPS/TLS) and at rest for server-side notification records and local device storage.
• Access controls and audit logging for server-side notification systems.
• Automatic deletion of notification records based on retention periods.
• Hashing of device identifiers and push tokens where feasible.
• Regular security reviews and dependency updates.

8. Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment has been conducted for SpaceSight24's processing of camera imagery and location data. The assessment identifies potential risks (including bystander capture in camera use, location tracking concerns) and implements appropriate mitigation measures (on-device processing by default, coarse location storage, short retention periods, encryption, clear consent flows). A summary of the DPIA findings is available upon request.

9. Children

SpaceSight24 is rated 4+ and suitable for all ages. We do not knowingly collect personal data from children under 16 without appropriate parental consent where required by applicable law. If you believe we have collected a child's personal data inappropriately, contact info@alpiaal.com; we will investigate and take appropriate action including data deletion where necessary.

10. Your rights

Under applicable data protection law (including the GDPR) you have the following rights:

• Access: obtain confirmation of processing and access to your data
• Rectification: correct inaccurate personal data
• Erasure: request deletion of your personal data
• Restriction: limit how we process your data
• Portability: receive your data in a structured format
• Object: object to processing based on legitimate interests
• Withdraw consent: withdraw consent at any time without affecting prior processing
• Complaint: lodge a complaint with a supervisory authority

To exercise any right contact info@alpiaal.com. We will verify your identity and respond within statutory timeframes (typically 30 days). For notification location records specifically: you can withdraw consent in-app (Settings → Privacy → Notifications) or contact support; we will delete server-side notification records within 30 days.

11. Automated decision-making & profiling

We do not perform automated decision-making with legal or similarly significant effects. Satellite pass calculations and AR overlays are computational features that do not constitute automated decision-making under data protection law.

12. Changes to this policy

We may update this privacy policy to reflect changes in our practices, legal requirements, or service features. We will update the effective date at the top of this policy. Significant changes affecting your rights or the purposes of processing will be communicated through the app or by email where contact details are available. Continued use of the app after policy changes constitutes acceptance of the updated terms.

13. Contact & supervisory authority

For questions, complaints, or to exercise your rights contact info@alpiaal.com.

You also have the right to lodge a complaint with a supervisory authority. In Italy, this is the Garante per la protezione dei dati personali (Italian Data Protection Authority). For EU residents, you may contact your local supervisory authority.