Privacy Policy

observerly is operated by observerly Ltd, a company based in the United Kingdom ("observerly", "we", "us", or "our"). We are the controller of the personal data described in this policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what personal data we collect when you use the observerly web application and API (the "Service"), why we collect it, and the choices you have. We have tried to keep it short and honest. If anything is unclear, write to us at hello@observerly.com.

We collect only what we need to run the Service for you:

• Account details — your name, email address, and password. We never store your password itself, only a one-way hash of it.
• Session credentials — the tokens that keep you signed in. We store a one-way hash of each credential together with its expiry.
• Observatory data — the observatories you set up, including their names and geographic locations, your equipment, and the targets, plans, observations, and exposures you create.
• Image data — the frames your observatory captures or that you upload, including FITS files and the metadata in their headers.
• Billing references — if you subscribe, the customer and subscription identifiers our payment provider gives us, and the status and renewal date of your subscription. We never see or store your card details.
• Technical data — your IP address, which we use when a request arrives to apply rate limits and protect the Service, and operational logs that record which part of the Service was called, how long it took, and whether it succeeded.
• Talk registrations — if you register your interest in one of our local astronomy talk series, such as Under Cold Stars, your name and email address. You do not need an account to register.

An observatory location can be precise enough to identify where you live. We treat it as personal data and use it only to calculate what you can observe from that site.

We do not show advertising, we do not use analytics or tracking scripts, and we do not sell, rent, or trade your personal data.

We do not set cookies. To keep you signed in, the Service stores one refresh credential in your browser's session storage. Your browser deletes it when you close the tab or window. The short-lived access credential stays in memory and is never written to storage.

Our hosting provider may set strictly necessary security cookies to protect the Service from abuse. Because all of this storage is strictly necessary to provide the Service you ask for, we do not ask for consent to it.

The Service also keeps a few of your choices in your browser's local storage, so they are still there when you come back: the plan you are drafting, the observatory you selected, how you set up the Sky Viewer, and which talk series you have registered for. This storage holds no name, email address, or credential, never leaves your browser, and you can clear it at any time from your browser settings.

We use your personal data on the following legal bases:

• To perform our contract with you — to create and secure your account, plan and run your observations, store and process your frames, and manage your subscription.
• For our legitimate interests — to keep the Service secure, prevent abuse, diagnose faults, and improve reliability. We balance these interests against your rights and keep the data involved to a minimum.
• With your consent — to tell you whether a talk series you registered your interest in goes ahead. You can withdraw your consent at any time by unsubscribing from any of these emails or by writing to us.
• To meet our legal obligations — for example, to keep records that tax and accounting law requires.

We email you only about your account, your subscription, changes to these policies, or a talk series you registered your interest in. We never use a talk registration for marketing.

We share personal data only with the service providers that help us run the Service, and only as much as they need:

• Cloudflare — hosts the Service, its database, and the object storage that holds your frames, and protects the network that carries your requests.
• Polar — sells our subscriptions as merchant of record. Polar processes your payment and billing details under its own privacy policy and shares only the subscription references described above with us.
• Mailchimp — holds the list of people who register their interest in a talk series and sends the emails about it. It first sends you an email to confirm your address, and your address joins the list only once you confirm it.

Some features look up astronomical data from public research archives. When you use them, your browser contacts the services of the Centre de Données astronomiques de Strasbourg (SIMBAD, Sesame, VizieR, Aladin, and XMatch) directly, and we forward Gaia catalogue queries to the archives that host it, such as the ESA Gaia Archive. These services receive the names or coordinates you look up, and the services your browser contacts also receive your IP address. They never receive your account details.

We may also disclose personal data when the law requires it, or to a buyer or successor if observerly Ltd is reorganised or sold. In that case this policy continues to apply to your data.

Our providers may process your data outside the United Kingdom. Where they do, we rely on UK adequacy regulations or on safeguards that UK law approves, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Account, observatory, and image data are kept for as long as your account is open. When you close your account, we delete them within 30 days.
• Session credentials are deleted after they expire.
• Operational logs are kept for no more than 30 days.
• Talk registrations are kept until the series has finished or been cancelled, and are then deleted. If you unsubscribe, we stop emailing you straight away.
• Billing records are kept for as long as tax and accounting law requires, which is normally six years.

All traffic to the Service is encrypted in transit. Passwords and session credentials are stored only as one-way hashes, every record is scoped to the account that owns it, and requests are rate limited. No system is perfectly secure, but if a breach affects your personal data, we will tell you and the regulator as the law requires.

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• have your data deleted;
• restrict or object to how we use your data;
• receive your data in a portable, machine-readable format; and
• withdraw any consent you have given, at any time.

To use any of these rights, write to hello@observerly.com. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, but we would welcome the chance to put things right first.

The Service is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.

We may update this policy as the Service changes. We will post the new version on this page and update the date at the top. If a change materially affects how we use your data, we will email you before it takes effect.

observerly Ltd, United Kingdom.
hello@observerly.com