Privacy Policy for Sideris

Effective Date: August 2026

Welcome to Sideris. This Privacy Policy explains how your personal data is collected, used, and protected when you use the Sideris mobile application to unlock the wonder of the night sky and facilitate your celestial discovery.

This policy is designed to strictly comply with the General Data Protection Regulation (GDPR) and the requirements of the Apple App Store and Google Play Store.

1. Data Controller

The Data Controller responsible for your personal data is:

Loris BERT EI
Micro-entrepreneur (Code APE 6201Z)
173 rue de Courcelles, 75017, Paris
FRANCE

Contact Email: [email protected]

2. Device Permissions

Sideris requests a small number of device permissions and uses each only for the purpose described:

• Camera: to take a photograph for plate solving, whether of your camera's screen or of the sky itself. The image is processed on your device and is not transmitted, except through the optional upload described in Section 3D.
• Photos: to let you choose an existing image to plate-solve. Sideris accesses only the specific images you select, not your whole photo library.
• Location: to orient the sky map, night mode, and the polar-scope tool. As described in Section 3F, this location remains on your device.

You can grant or revoke each permission at any time in your device settings. Some features will not work without the permission they rely on.

3. Categories of Data Collected, Purposes, and Legal Bases

Sideris is built as an offline-first application. However, to maintain app stability, process optional purchases, and improve plate-solving accuracy, we may collect limited data under the specific conditions set out below. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

A. Crash Reports (Firebase Crashlytics)

• Data collected: device model, operating-system version, app version, a Crashlytics installation identifier, and the technical state of the app at the time of a crash. No location is collected.
• Purpose: To detect and fix crashes and stability problems.
• Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) in keeping the app working. Crash reporting is on by default; you can turn it off at any time in the app settings.

B. Usage Analytics (Firebase Analytics)

• Data collected: which screens and features are used, plus a pseudonymous app-instance identifier. If you make the one-time purchase, its price and currency are recorded as one of those events. An approximate country is derived from your IP address; city and region-level location is disabled, and no precise location and no photos are collected.
• Purpose: To understand how the app is used and prioritise improvements.
• Legal Basis: Your explicit consent (GDPR Art. 6(1)(a)). Usage analytics is off by default; you are asked to opt in when you first launch the app, and you can withdraw consent at any time in the app settings.

C. Purchase and Subscription Data (RevenueCat)

• Data collected: an anonymous App User ID, purchase history, and subscription status. All payment processing is handled securely by Apple or Google; Sideris never sees or stores your payment card information.
• Purpose: To grant access to paid features and synchronise your purchases across devices.
• Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)). Providing this data is necessary to complete and maintain your purchase; without it, we cannot grant or restore access to the paid features.

D. Optional Failed-Solve Image Uploads

Sideris performs plate solving locally on your device, and your photos do not leave your phone by default.

• Data collected: if a solve fails and you choose to help, you may voluntarily send that specific image. Two versions of it are sent: the photograph as you took it, and the grayscale version the solver worked on. Every piece of metadata embedded in the file, including any location and date your camera recorded in it, is removed before either version leaves your device. Sent alongside them are the settings the solve used (the crop you applied, the camera and lens details you entered, and the object you were aiming at if you named one), your device model, operating-system version and app version, the date the report was created, and a random reference that identifies the report. You may additionally choose, via a separate checkbox, to include where and when the photo was taken, which helps show how the sky looked at the moment of capture.
• Purpose: Debugging and improving plate solving.
• Legal Basis: Your explicit consent (GDPR Art. 6(1)(a)). You must actively trigger the upload for each individual image, and location and time are included only if you tick that checkbox.

E. Free Trial Activation

Sideris includes a limited number of free plate solves before a one-time purchase is required. To ensure that this free trial is provided once per device, the app contacts our servers a single time, when it is first launched.

• Data collected: an irreversible cryptographic hash of a device identifier provided by your operating system. The identifier itself never leaves your device; only the hash is sent, and it is hashed a second time before it is stored. On Android the identifier is specific to Sideris and cannot be used to recognise you in any other application. On Apple devices, once Sideris is available for them, the same check will use Apple's DeviceCheck service, which records only that a free trial has been used and reveals nothing else about your device. No account, name, email address, photograph, or location is involved.
• Purpose: To grant the free trial once per device and to prevent the same device from obtaining it repeatedly.
• Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) in preventing abuse of the free trial and protecting the paid features of the app.

This request happens once. After it completes, plate solving works entirely offline and the app does not contact our servers again for this purpose. If your device has no internet connection when the app is first launched, the free trial cannot be activated until a connection is available; the rest of the app remains usable in the meantime.

F. Data Processed Solely on the Device

Sideris uses your device location for the sky map, night mode, and the polar-scope tool. This location is processed solely on your device and is never transmitted to us. The only exception is the optional image upload described in Section 3D, and only if you tick its location checkbox.

G. Verifying That a Request Comes From the Genuine App

The two features above that use the network, the optional image upload in Section 3D and the free-trial activation in Section 3E, are protected by Firebase App Check. Each of those requests carries a short-lived attestation token, and the app also obtains one when it starts so that an upload is not held up waiting for it.

• Data collected: a token issued by Google Play Integrity on Android devices, or by Apple's App Attest on Apple devices. It confirms that the request comes from an unmodified copy of Sideris running on a genuine device. Producing it involves your operating system and the platform's own service; the token reaches us carrying no name, no account, no location, and nothing that identifies you.
• Purpose: To keep the free trial and the paid features from being abused, and to prevent anything other than the app from writing to the upload service.
• Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) in protecting the app and the services behind it from abuse.

4. Data Sharing and International Transfers

We do not sell your personal data. The data described in Section 3 is shared only with the third-party processors required to operate the app. These processors are contractually obligated to protect your data and to comply with applicable privacy standards.

• Google LLC (Firebase): provides the crash-reporting and analytics services described in Sections 3A and 3B, hosts the free-trial activation record described in Section 3E, and operates the App Check and Play Integrity services described in Section 3G. Data may be transferred to servers in the United States under the EU-US Data Privacy Framework.
• RevenueCat, Inc.: provides the subscription and entitlement management described in Section 3C. Data may be transferred to the United States under Standard Contractual Clauses.
• Apple and Google: process payments and distribute the app through their respective app stores. Apple additionally operates the App Attest service used on Apple devices, as described in Section 3G.

Where data is transferred outside the European Economic Area, it is protected by one of the transfer safeguards recognised under the GDPR, as indicated above.

5. Data Retention

• Crash Reports (Crashlytics): Retained for up to 90 days, then automatically deleted.
• Usage Analytics (Analytics): Retained for up to 14 months, then automatically deleted.
• Subscription Data: Kept for the duration of your active subscription and for a limited period thereafter as required by financial record-keeping laws.
• Uploaded Images: Retained only as long as necessary to resolve the specific debug issue, and in any case no longer than 14 months, after which they are permanently deleted.
• Free Trial Activation Record (Section 3E): Retained for as long as the app is distributed. This record exists precisely so that a free trial is not granted to the same device twice, and deleting it would defeat that purpose. It consists of an irreversible hash, the date the trial was granted, the number of free solves granted, the platform and app version the app reported at the time, and a random value that makes the request safe to retry. It holds nothing else, and nothing in it identifies you.

6. Data Security

We take the security of your data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls that limit who can reach the data, and reliance on established providers (Google Firebase, RevenueCat, Apple, and Google) that maintain their own recognised security standards. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

7. User Accounts and Data Deletion

Sideris does not use user accounts. You are not required to register, sign in, or provide your name, email address, or any other identifier to use the app, and no user profile is created for you.

Because there is no account, there is nothing to sign in to or delete. The limited data described in this policy can be removed as follows: you can disable usage analytics and crash reporting at any time in the app settings, and uninstalling the app removes all data held on your device.

Two exceptions are worth stating plainly. For any image you chose to upload (see Section 3D), you may request its deletion by contacting the email in Section 1. The free trial activation record (see Section 3E) is held on our servers rather than on your device, and it therefore survives uninstalling the app; that is what allows the free trial to be limited to one per device. It is stored as an irreversible hash that we cannot connect to you, so we are unable to locate it from your name or email address alone. If you wish it deleted, contact the email in Section 1 and you will be told how to obtain the identifier needed to find it.

8. Your Rights Under the GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the data we hold about you.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure (Right to be Forgotten): Request the deletion of your data.
• Right to Restriction of Processing: Request that we limit how we process your data in certain circumstances.
• Right to Object: Object to processing that we carry out on the basis of our legitimate interests, in particular crash reporting, which you can also disable at any time in the app settings.
• Right to Withdraw Consent: You can disable analytics and crash reporting at any time within the Sideris app settings.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Lodge a Complaint: Lodge a complaint with a data protection supervisory authority, in particular in the country of your residence or workplace. In France, this authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

To exercise any of these rights, please contact the email provided in Section 1.

9. Children's Privacy

Sideris is not directed at children. We do not knowingly collect personal data from a child below the age of digital consent that applies in their country. If we become aware that we have collected personal data from a child below the applicable age without the required parental or guardian consent, we will take steps to delete that information promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Any change is reflected in the "Effective Date" at the top of this document. The current version is always available inside the app, under Settings, and on our website, so that you can read for yourself what it now says. Where a change means we would rely on your consent for something we do not do today, we will ask for that consent before the new processing begins, rather than treating a change to this text as your agreement to it.