Privacy Policy for Sideris

Effective Date: July 2026

Welcome to Sideris. This Privacy Policy explains how your personal data is collected, used, and protected when you use the Sideris mobile application to unlock the wonder of the night sky and facilitate your celestial discovery.

This policy is designed to strictly comply with the General Data Protection Regulation (GDPR) and the requirements of the Apple App Store and Google Play Store.

1. Data Controller

The Data Controller responsible for your personal data is:

Loris BERT EI
Micro-entrepreneur (Code APE 6201Z)
173 rue de Courcelles, 75017, Paris
FRANCE

Contact Email: [email protected]

2. Device Permissions

Sideris requests a small number of device permissions and uses each only for the purpose described:

• Camera: to photograph your telescope's camera screen for plate-solving. The image is processed on your device and is not transmitted, except through the optional upload described in Section 3D.
• Photos: to let you choose an existing image to plate-solve. Sideris accesses only the specific images you select, not your whole photo library.
• Location: to orient the sky map, night mode, and the polar-scope tool. As described in Section 3E, this location remains on your device.

You can grant or revoke each permission at any time in your device settings. Some features will not work without the permission they rely on.

3. Categories of Data Collected, Purposes, and Legal Bases

Sideris is built as an offline-first application. However, to maintain app stability, process optional purchases, and improve plate-solving accuracy, we may collect limited data under the specific conditions set out below. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

A. Crash Reports (Firebase Crashlytics)

• Data collected: device model, operating-system version, app version, a Crashlytics installation identifier, and the technical state of the app at the time of a crash. No location is collected.
• Purpose: To detect and fix crashes and stability problems.
• Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) in keeping the app working. Crash reporting is on by default; you can turn it off at any time in the app settings.

B. Usage Analytics (Firebase Analytics)

• Data collected: which screens and features are used, plus a pseudonymous app-instance identifier. An approximate country is derived from your IP address; city and region-level location is disabled, and no precise location and no photos are collected.
• Purpose: To understand how the app is used and prioritise improvements.
• Legal Basis: Your explicit consent (GDPR Art. 6(1)(a)). Usage analytics is off by default; you are asked to opt in when you first launch the app, and you can withdraw consent at any time in the app settings.

C. Purchase and Subscription Data (RevenueCat)

• Data collected: an anonymous App User ID, purchase history, and subscription status. All payment processing is handled securely by Apple or Google; Sideris never sees or stores your payment card information.
• Purpose: To grant access to paid features and synchronise your purchases across devices.
• Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)). Providing this data is necessary to complete and maintain your purchase; without it, we cannot grant or restore access to the paid features.

D. Optional Failed-Solve Image Uploads

Sideris performs plate-solving locally on your device, and your photos do not leave your phone by default.

• Data collected: if a solve fails and you choose to help, you may voluntarily send that specific image, together with the solve settings and your device model and app version. You may additionally choose, via a separate checkbox, to include where and when the photo was taken, which helps show how the sky looked at the moment of capture.
• Purpose: Debugging and improving plate-solving.
• Legal Basis: Your explicit consent (GDPR Art. 6(1)(a)). You must actively trigger the upload for each individual image, and location and time are included only if you tick that checkbox.

E. Data Processed Solely on the Device

Sideris uses your device location for the sky map, night mode, and the polar-scope tool. This location is processed solely on your device and is never transmitted to us. The only exception is the optional image upload described in Section 3D, and only if you tick its location checkbox.

4. Data Sharing and International Transfers

We do not sell your personal data. The data described in Section 3 is shared only with the third-party processors required to operate the app. These processors are contractually obligated to protect your data and to comply with applicable privacy standards.

• Google LLC (Firebase): provides the crash-reporting and analytics services described in Sections 3A and 3B. Data may be transferred to servers in the United States under the EU-US Data Privacy Framework.
• RevenueCat, Inc.: provides the subscription and entitlement management described in Section 3C. Data may be transferred to the United States under Standard Contractual Clauses.
• Apple and Google: process payments and distribute the app through their respective app stores.

Where data is transferred outside the European Economic Area, it is protected by one of the transfer safeguards recognised under the GDPR, as indicated above.

5. Data Retention

• Crash Reports (Crashlytics): Retained for up to 90 days, then automatically deleted.
• Usage Analytics (Analytics): Retained for up to 14 months, then automatically deleted.
• Subscription Data: Kept for the duration of your active subscription and for a limited period thereafter as required by financial record-keeping laws.
• Uploaded Images: Retained only as long as necessary to resolve the specific debug issue, and in any case no longer than 14 months, after which they are permanently deleted.

6. Data Security

We take the security of your data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls that limit who can reach the data, and reliance on established providers (Google Firebase, RevenueCat, Apple, and Google) that maintain their own recognised security standards. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

7. User Accounts and Data Deletion

Sideris does not use user accounts. You are not required to register, sign in, or provide your name, email address, or any other identifier to use the app, and no user profile is created for you.

Because there is no account, there is nothing to sign in to or delete. The limited data described in this policy can be removed as follows: you can disable usage analytics and crash reporting at any time in the app settings, and uninstalling the app removes all data held on your device. For any image you chose to upload (see Section 3D), you may request its deletion by contacting the email in Section 1.

8. Your Rights Under the GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the data we hold about you.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure (Right to be Forgotten): Request the deletion of your data.
• Right to Restriction of Processing: Request that we limit how we process your data in certain circumstances.
• Right to Object: Object to processing that we carry out on the basis of our legitimate interests, in particular crash reporting, which you can also disable at any time in the app settings.
• Right to Withdraw Consent: You can disable analytics and crash reporting at any time within the Sideris app settings.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Lodge a Complaint: Lodge a complaint with a data protection supervisory authority, in particular in the country of your residence or workplace. In France, this authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

To exercise any of these rights, please contact the email provided in Section 1.

9. Children's Privacy

Sideris is not directed at children. We do not knowingly collect personal data from a child below the age of digital consent that applies in their country. If we become aware that we have collected personal data from a child below the applicable age without the required parental or guardian consent, we will take steps to delete that information promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Any changes will be reflected in the "Effective Date" at the top of this document, and significant changes will be communicated via an in-app notification.