This policy covers the Space Guardian mobile app for iOS and Android. It explains what data the app uses, why, how long we keep it and what you can do about it.
1. Who we are
The data controller is Space Guardian d.o.o.. For anything about your data, email info@spaceguardian.eu.
The app is distributed on the App Store and Google Play by Indigo Labs d.o.o.
2. Your account
You sign in with Google, Apple or email. We store your email address, your name and profile picture link (if the sign-in provider shares them), your Firebase user ID and the ID of the Google or Apple account you used. We also keep when the account was created and a few account flags we set ourselves, such as whether you are in the beta programme. Sign-in runs on Google Firebase Authentication, which processes this data for us.
Your account also stores your app profile so it syncs between devices: favourites, saved locations, units, alert settings and privacy settings.
Purpose: signing you in and syncing your settings. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR). We keep this data until you delete your account.
Sky works without an account; the other features need one. Location is optional: without it, pass predictions and location-based alerts are not available.
3. Location, camera and motion sensors
Sky AR, satellite positions, pass predictions and near-miss look angles are computed on your phone. The camera image and motion sensor readings never leave your phone.
Your location reaches our server only in these cases:
- Saved locations. If you save a location, its name and coordinates (rounded to 4 decimal places, about 10 m) are stored with your account so they sync between your devices. Delete a saved location to remove it.
- Location-based push alerts. If you turn on “Only above me” or “Re-entries near me” alerts, we store your approximate location (rounded to 0.1°, about 11 km) and your time zone with your account, so we can decide which alerts to send you. Turn both location-based alerts off and we delete the stored location.
We process location only to provide the features you use (Art. 6(1)(b) GDPR).
4. Notifications
Pass reminders are scheduled on your phone and do not involve our server. If you turn on push notifications, we store your device's push token, its platform (iOS or Android) and when we last saw it, together with your account, plus a record of which alerts we have sent you so you don't get the same one twice or too many. Push messages are delivered through Google Firebase Cloud Messaging and, on iPhone, Apple Push Notification service. Turn push off or delete your account to remove them.
5. Analytics and crash reports
We collect analytics and crash reports only with your consent (Art. 6(1)(a) GDPR), via Google Firebase Analytics and Crashlytics. This covers screens opened, app events, crash reports and device diagnostics: device model, operating system and app version, an app-instance identifier, and your approximate country or region (derived from your IP address). We do not collect the advertising ID, do not use any of this data for advertising, and do not link it to your account.
Your choice is saved with your account and applied on each device you sign in on. Retention: Analytics 2 months (as configured in our Firebase project), Crashlytics 90 days. You can withdraw consent at any time in More › Settings › Privacy.
6. Podcasts and the home-screen widget
Podcast audio is streamed from our storage. Favourite episodes sync with your account; your playback position stays on your phone.
The home-screen widget shows upcoming passes and near misses, stored on your phone only. It contains no location.
7. Server logs
Our reverse proxy records the IP address and the requested URL of every request the app makes to our servers. We use these logs only to run and secure the service (legitimate interest, Art. 6(1)(f) GDPR). They are kept in rolling logs of limited size that are overwritten automatically, typically within a few weeks.
8. No ads, no selling, no tracking
The app never shows advertising. We do not sell your data and we do not track you across other apps or websites.
9. Service providers and transfers
These companies process data for us:
- Google (Firebase Authentication, Cloud Messaging, Analytics and Crashlytics).
- Hetzner Online GmbH, which hosts our servers in Germany.
- Apple, for Sign in with Apple and push notifications on iPhone.
Google and Apple may process data outside the EU. These transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
10. Your rights
You can ask for access to your data, correction, erasure, restriction of processing and a portable copy, and you can object to processing. Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal. Email info@spaceguardian.eu. You can also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, IP RS, ip-rs.si).
We do not make automated decisions about you.
11. Delete your account
In the app: More › Settings › Sign out or delete account, type DELETE and tap Delete account. This deletes your account immediately.
Without the app: email info@spaceguardian.eu from the address you signed in with and ask us to delete your account. We do it within 30 days and confirm by email.
Deleting the account removes your sign-in, profile, saved locations, favourites, settings, alert preferences, push tokens and push record from our servers and from Firebase Authentication. Copies in our backups are overwritten within 14 days, and server logs as described above. Analytics and crash data are not linked to your account and expire on their own (2 months and 90 days).
If your account is also an operator (business) account on app.spaceguardian.eu, delete it from the dashboard or email us.
12. Children
The app is not directed at children under 15. If you are under 15, ask a parent or guardian before turning on analytics or crash reports.
13. Changes
If we change this policy, we update the date at the top. Last updated: 2026-11-01.