Privacy policy

Starclear shows, for each place and each hour, the chance of a clear night. This policy explains which data the app and our server use, what for, and for how long. It applies to the app on iOS and Android, which is called Heldere Nacht in Dutch and Sternklar in German.

In short: you do not need an account. There are no ads, no analytics and no tracking, and the app does not read an advertising ID. The server keeps only what Pro and the notification need.

Who is responsible

Lodevane, a sole proprietorship in the Netherlands (Chamber of Commerce number 42144638), is the controller. Privacy questions: privacy@helderenacht.com.

Which data we use

• Your place, for the forecast. For the forecast and for Clear skies nearby, the app sends the coordinates of a place to our server, rounded to about 1 km. The server uses them to calculate the answer and does not store them. There is no location history, and the app does not track you in the background.
• Your location on the device. Only when you choose Use my location, and after you give permission, does the app ask the system for an approximate location. You can also search for a place yourself. You can withdraw permission in your device settings.
• Searching for a place. Searching by place name, and looking up the name of your location, go through your device's own service: Apple's on iOS, and on Android the device's location service (usually Google's). That service receives the search term or the coordinates. We do not receive the search term.
• Your places and settings. They stay on your device. iOS and Android may include them in your own backup with Apple or Google.
• The notification (Pro). When you first turn on a notification, the app registers your device with our server, and again at every start after that. The server stores: a random installation ID, a hash of a secret from the app, your device's push address at Apple or Google (encrypted), your language, the app version, the places with the notification turned on (name and rounded coordinates), your notification choices and custom thresholds, and a reference to your purchase. For each night, the server remembers whether a notification went out.
• Pro. Apple or Google handles the payment; we receive no name, email address or payment details. The app sends the proof of purchase to our server, which checks it. The server stores Apple's transaction number or Google's purchase token, the product (monthly or yearly), whether it is a test purchase, the end date, and whether the purchase was refunded or revoked. Apple and Google tell us about the renewal, cancellation and refund of that purchase.
• Technical data. Every request arrives with your IP address. Our proxy only holds it briefly in memory to limit abuse. The logs contain no IP addresses, no request addresses (so no coordinates) and no headers. An error message from the server may contain an installation ID or a reference to a purchase.

Why we may do this

• To provide the service you ask for (Article 6(1)(b) GDPR): the forecast, Pro and the notification.
• For our legitimate interest (Article 6(1)(f) GDPR): keeping the server secure and available, with the abuse limit and the error logs.

The app uses location and notifications only after you allow them in the system. We do not build profiles and make no automated decisions about you.

Who else processes the data

• OVHcloud hosts our server in a data centre in Frankfurt (Germany), on our behalf.
• Apple runs the App Store, handles payment and the subscription, and delivers the notification on iOS (Apple Push Notification service).
• Google runs Google Play, handles payment and the subscription, checks a purchase for our server, and delivers the notification on Android (Firebase Cloud Messaging). Firebase creates its own installation ID for this, sometimes as soon as the app first starts.

Apple and Google are themselves responsible for what they process in their stores and services. For that, the Apple Privacy Policy, the Google Privacy Policy and the Firebase privacy information apply. They may process data outside the European Economic Area, with the safeguards the GDPR requires. We do not sell data and do not give it to anyone else, unless the law requires us to.

How long we keep data

• Coordinates of a request: not at all; only while the server calculates.
• The notification registration: until you ask us to delete it, or until Apple or Google reports, when a notification is sent, that your device can no longer be reached. If you turn all notifications off, the app removes the places from your registration. Whether a notification went out on a given night is deleted after 3 nights.
• A purchase: as long as the subscription runs. After that, the record is kept, without a name or payment details, until you ask us to delete it.
• Logs: they rotate automatically, at most 3 files of 10 MB per service. How long a line stays depends on how busy the server is.
• Backups: OVHcloud backs up the server automatically. Deleted data may remain in a backup until that backup is replaced.

Your rights

You have the right to access, correct and delete your data, to restrict processing, to data portability and to object. If you turn all notifications off in the app, the app removes your places from your registration on the server. For anything else, including deleting the registration completely, email privacy@helderenacht.com. The app has no account, so we cannot simply tell which data is yours. We will ask you for an identifier; if we find nothing, we will tell you.

If you disagree with how we handle your data, you can complain to the data protection authority in your country or to the Dutch Autoriteit Persoonsgegevens.

Changes

If what the app or the server processes changes, we update this policy. The date at the top shows when that last happened.

This website

This website uses no analytics, advertising pixels, cookies or local storage. Fonts and scripts are served from the website itself. When you visit, hosting provider Netlify processes technical connection data, such as your IP address and the requested file, to deliver and protect the page. This is based on our legitimate interest in a safe, available website. Technical data may be processed outside the EEA. Netlify describes the applicable safeguards in its Data Processing Agreement. Hosting logs are subject to the hosting provider’s retention policy. Contact us for information or a deletion request. Netlify Data Processing Agreement.