Computed on your devices.
Approximate when it leaves.

This policy covers both parts of the Planetaria app on Google Play (com.jdcap.planetaria):

• the Wear OS watch app;
• the companion app for Android phones;
• Planetaria's data service, which supplies the weather, tides, cloud imagery and other data the two apps download.

In short

• The only personal data Planetaria collects is the watch's approximate location, if you allow it. It is rounded to about 10 km and sent only to fetch your weather and tides. It goes to Planetaria's data service, which shares it with MET Norway (the Norwegian Meteorological Institute) to get the forecast for that area (sections 02 to 04).
• The phone app never sends its location, and from version 1.4.0 it also keeps it out of backups, so it stays on the phone (section 05).
• No account, sign-in, email address or name.
• No advertising, and no advertising identifier.
• No analytics, telemetry, behavioural tracking or crash-reporting SDK.
• No contacts, photos, microphone, camera, health or fitness data.
• No data is sold, rented, or shared with data brokers or advertisers.

You choose, after it has been explained

Before the watch asks for location, Planetaria explains on its own screens what the location is for and where it goes. It then offers Allow or Not now. Allow leads to the system's permission dialog. You can change your answer at any time in Settings › Location.

Without location, the sky, rise and set times, weather and tides are shown for a default place, 34.0° N 118.2° W (Los Angeles). The Earth, the Moon, the Sun and the planets need no location at all.

Most of it is computed on the watch

The watch calculates these itself, from your approximate place and published orbital data:

• the night sky;
• sunrise, sunset and golden hour;
• moonrise and moonset;
• the Moon and the planets;
• ISS passes, eclipses and meteor showers;
• the sky alerts.

None of these calculations sends your location anywhere.

The place the watch keeps

While the app is open, it takes an approximate location fix and keeps the most recent one as your place, in the app's private storage. Tiles, complications, alerts and the scheduled refresh use that kept place. They never ask the system for your location in the background.

The kept place, and the weather and tides fetched for it, are left out of Android backups and device-to-device transfers.

The kept place is deleted:

• at once, when you choose Not now or turn Settings › Location off;
• the next time Planetaria runs, if you withdraw the permission in the system's settings.

Planetaria's data service, and MET Norway

The rounded place goes to Planetaria's data service, a small program we run on Cloudflare Workers at planetaria-api.jdcap.workers.dev. Cloudflare hosts it for us. The service uses the rounded place only to answer that request:

• Weather: it asks MET Norway (the Norwegian Meteorological Institute, api.met.no) for the forecast for that same rounded place. MET Norway receives the rounded place from Cloudflare's servers, not from your watch.
• Tides: it picks the nearest of 35 NOAA tide stations on U.S. coasts, if one is in range, and asks NOAA for that station's predictions. NOAA receives only a public station identifier, never your coordinates.

When

• When you open the app.
• Again at once, if the location fix it takes on opening puts you in a different area of about 10 km.
• About every three hours in the background: a scheduled refresh, which the tiles can also start. It uses the last place the watch kept while the app was open, and never takes a new location fix.

With location off, the same requests carry the default place instead.

If the data service can't be reached

The data service may be unreachable, or answer with an error or with data the watch can't use. The watch then fetches the same public data directly from each provider, with no server of ours in between:

• MET Norway receives the same rounded place straight from your watch, together with the watch's IP address, at most every 30 minutes.
• Tides are still requested from NOAA by station identifier only.
• The Space Station's orbit comes from CelesTrak (or wheretheiss.at), and recent earthquakes from USGS, with no location and no identifier in the request.

What comes back

The reply to the request that carries the rounded place contains:

• the weather (temperature, humidity and wind);
• the tide predictions for the nearest station;
• the Space Station's published orbit;
• recent earthquakes from USGS.

The orbit and the earthquakes are the same for everyone.

Requests that carry no location

These are fetched with requests that contain no location and no identifier, from the data service or, when it is unavailable, directly from NASA, NOAA, USGS, CelesTrak and wheretheiss.at:

• the cloud imagery (NASA's VIIRS mosaic, through NASA GIBS);
• the Sun's photograph (NASA SDO);
• the aurora forecast (NOAA SWPC);
• on the direct path only, the Space Station's orbit (CelesTrak, or wheretheiss.at) and recent earthquakes (USGS). Through the data service, these two come in the reply described above.

IP addresses

As with any request over the internet, the server that answers sees the device's IP address in order to reply. That is Cloudflare for the data service, and the provider itself on the direct path. Planetaria doesn't use IP addresses to identify, locate or track anyone, and the data service's code doesn't record them.

A forecast per area, for up to 7 days

Each forecast is kept in Cloudflare's cache under its area. The area is the tenth-of-a-degree cell, about 10 km across. A forecast counts as fresh for 30 minutes. It is kept for up to 7 days, so the service can still answer when MET Norway can't be reached.

The cache holds the forecast values and the area they belong to. It does not hold who asked, any device identifier, or any IP address.

Other cached answers, each also kept for up to 7 days:

• tide predictions, by station;
• the orbit, the earthquakes, the imagery and the aurora forecast, once for everyone.

Cloudflare handles requests to the service under its own privacy policy.

Your location is used on the phone, and never sent

If you tap Show tonight where you are and allow approximate location, the phone app uses it to work out:

• sunrise and sunset, and golden hour;
• moonrise and moonset;
• the planets after dark;
• the Space Station's visible passes;
• Tonight hour by hour and the sky chart;
• whether the Moon is up where you are during each coming lunar eclipse;
• your place on the Earth, and each world's place in your sky.

All of it is calculated on the phone. The location is rounded to about a kilometre and kept in the app's own storage on the phone. The app uses it, and so does its "Planetaria Tonight" widget, but only while the permission is held. Planetaria never sends it anywhere.

From version 1.4.0, the kept place is left out of Android backups and device-to-device transfers, so it stays on the phone (earlier versions could include it in the backup). The only thing Android's own backup takes from the phone app is your widget choices (which world each widget shows), so a restored phone keeps its widgets. That backup goes to your Google account, as for other apps; Planetaria has no access to it.

Two downloads, carrying nothing about you

• A recent Earth cloud mosaic, from the Planetaria data service, or from NASA directly when that service is unavailable. It is fetched while the app is open, at most every three hours, and retried every few minutes until a first image arrives.
• The Space Station's published orbit, for its passes once you have shared your location. It comes from CelesTrak or its mirror at wheretheiss.at, when the kept orbit is missing or 12 hours old.

Neither request carries your location or an identifier. As with any request, those servers see the phone's IP address in order to reply.

Widgets

The four home-screen widgets ("Planetaria Tonight", "The Earth, computed", "The Moon tonight" and "A world") are drawn on the phone from what the app keeps. None of them downloads anything.

Sky alerts

Planetaria can tell you about four things:

• a visible ISS pass;
• a strong aurora forecast near you;
• an eclipse in the coming week;
• a meteor shower's peak.

Each alert is off until you turn it on. The watch asks for permission to notify you when you first turn one on. The alerts are worked out on the watch, there is no push server, and turning them on sends nothing about you anywhere.

Reviews

On the phone, after a week of use and several visits, Planetaria may ask Google Play once to show its standard review card. Google Play handles that card under Google's privacy policy. Planetaria isn't told whether you left a review or what it says.

On the watch, a plain card offers to open the app's Google Play page. Nothing is sent.

The counts that decide when to ask (days and visits) are kept by the app and never sent to us (on the watch, Android's own backup may include them; see section 07).

Feedback

If you choose Send feedback, your own email app sends a message to jdcapone@gmail.com. We use it only to reply, and we delete it on request.

Everything below is kept in each app's private storage, so the app works offline.

On the watch:

• your settings;
• the kept place, if location is on;
• the most recently downloaded weather and tides, labelled with the area and station they belong to;
• the most recently downloaded ISS orbit, earthquakes, aurora forecast and images;
• small records that keep each alert from repeating and time the review card.

The kept place and the weather and tides are left out of backups. The rest (settings, images, the aurora forecast, and the alert, review and download-timing records) may be included in Android's own backup to your Google account, as for other apps; Planetaria has no access to that backup.

On the phone:

• your settings;
• the kept place, rounded to about a kilometre;
• the most recently downloaded Space Station orbit;
• the two most recent Earth images.

From version 1.4.0, only your widget choices go into Android's own backup to your Google account and into a device-to-device transfer, as for other apps; the kept place, the orbit, the images and the settings stay on the phone. Planetaria has no access to that backup.

Uninstalling Planetaria from a device removes everything it stored there.

Security

Every request either app makes uses HTTPS, so data is encrypted in transit. On each device, Planetaria's data stays in the app's private storage.

Retention

On our side, two things are kept. The data service's cache holds forecasts by area, tide predictions by station, and the orbit, earthquakes, imagery and aurora forecast, each for up to 7 days and with no identifier. The data service keeps no request log. Emails you send us stay in our mailbox until you ask us to delete them.

MET Norway, NOAA, NASA, USGS, CelesTrak and wheretheiss.at each handle the requests they receive under their own terms and privacy practices.

Deletion

Nothing we hold is linked to you, so there is no record of you to look up or delete. You can still delete what Planetaria keeps:

• On the watch, turn off Settings › Location to delete the kept place at once. The forecast kept for it is replaced at the next refresh.
• On either device, uninstall Planetaria or clear its storage to delete everything it keeps there.
• Cached forecasts on the data service expire on their own within 7 days.
• If you have emailed us, write and we will delete your messages.

• MET Norway: weather forecasts (CC BY 4.0)
• NOAA CO-OPS: tide predictions, by public station
• NOAA SWPC: aurora forecast
• USGS: recent earthquakes
• CelesTrak (and its wheretheiss.at mirror): ISS orbital elements
• NASA (GIBS / VIIRS, SDO): cloud imagery and the Sun's photograph

Planetaria is an independent app, not affiliated with or endorsed by NASA, NOAA, USGS, MET Norway or any agency.

Planetaria is not directed at children, and it collects nothing that identifies anyone of any age.

If this policy changes, the updated version will be posted on this page with a new date above. Material changes will also be reflected in the app's Google Play listing and its Data safety section.

Questions about privacy, or about anything on this page: Jonathan Capone (CAPONE on Google Play), jdcapone@gmail.com.