Privacy Policy for Sideris

Effective Date: 6 October 2026

This Privacy Policy explains which personal data the Sideris mobile application processes, for what purposes, on what legal basis, for how long, and which rights you have over it. It is provided in accordance with the General Data Protection Regulation (GDPR) and with the requirements of the Apple App Store and Google Play.

Sideris works offline. Plate solving, the sky map, and every tool in the application run on your device. Data leaves your device only in the cases described in Section 3. Your data is never sold, never used for advertising, and never used to track you across other applications or websites.

1. Data Controller

The Data Controller responsible for your personal data is:

Loris BERT EI
Micro-entrepreneur (Code APE 6201Z)
173 rue de Courcelles, 75017, Paris
FRANCE

Contact Email: [email protected]

2. Device Permissions

Sideris asks for as few device permissions as possible and uses each only for the purpose described:

• Location: to show the sky as it appears from where you are. It is used by the sky map, including its real-time and motion-sensor modes and the height of each object in the sky through the night, by the Moon phase calendar, by the automatic switch to night mode after sunset, by the polar-scope tool, and to correct the compass for your position. It is used only while the application is open. This permission is optional: you may instead set your observing location by hand, on an offline map included in the application, and Sideris will then use that position without asking your device for one.
• Camera: on Apple devices, Sideris asks for access to the camera when you choose to take a photograph to plate-solve. On Android devices, the photograph is taken by your device's own camera application and Sideris receives only that photograph, so no camera permission is requested.
• Photos: you choose an existing image with your device's photo picker. Sideris receives only the images you select and has no access to the rest of your photo library.

You can grant or revoke each permission at any time in your device settings. A feature that relies on a permission will not work without it.

3. Categories of Data Processed, Purposes, and Legal Bases

Each category below states what is processed, why, and on which legal basis. Sideris does not use your data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

A. Crash Reports (Firebase Crashlytics)

• Data processed: when the application crashes, or meets certain errors from which it recovers, a report is sent containing your device model, operating-system version, application version, a Crashlytics installation identifier, and the technical state of the application at that moment, such as the sequence of program steps that led to the error and the memory and storage available. Crash reports contain no location, no photographs, and none of the content of your files.
• Purpose: to detect and fix crashes and stability problems.
• Legal Basis: legitimate interest (GDPR Art. 6(1)(f)) in keeping the application working. Crash reporting is on by default, and you can turn it off at any time in the application settings, after which no further report is sent.

B. Usage Analytics (Firebase Analytics)

• Data processed: events describing how the application is used, for example which screens are opened, whether a plate solve succeeded and how long it took, which settings are changed, and whether the free solves or the one-time purchase are in use. If you make the one-time purchase, its price and currency are recorded as one of these events. The events are accompanied by a pseudonymous app-instance identifier, general information about the device and the application such as the operating-system version, the language and the application version, and an approximate country derived from your IP address. City-level and region-level location and detailed device information are disabled. No precise location and no photographs are collected.
• Purpose: to understand how the application is used and to decide which improvements to make.
• Legal Basis: your consent (GDPR Art. 6(1)(a)). Usage analytics is off by default. You are asked whether you agree when you first launch the application, and you can withdraw your consent at any time in the application settings. Collection stops as soon as you withdraw it; data already collected is deleted at the end of the period stated in Section 5.

C. Purchase Data (RevenueCat)

• Data processed: an anonymous App User ID created by the application, the history of your purchase, and the status of the one-time unlock, together with the technical information that accompanies each request, such as the application version, the platform, and your IP address. RevenueCat is contacted each time the application starts with an internet connection, to confirm whether the unlock is active, and whenever you buy or restore the unlock. Payments are processed entirely by Apple or Google; Sideris never sees or stores your payment card information.
• Purpose: to grant access to the paid features, and to restore your purchase when you reinstall Sideris or move to a new device. Sideris is sold as a single one-time purchase and offers no subscription of any kind.
• Legal Basis: performance of a contract (GDPR Art. 6(1)(b)). This data is necessary to complete and maintain your purchase; without it, access to the paid features cannot be granted or restored.

D. Optional Failed-Solve Reports

Sideris performs plate solving on your device, and your photographs do not leave it unless you choose to send a report as described here.

• Data processed: when a solve fails, you may choose to send a report about that image. The report contains two versions of the image: the photograph as you took or selected it, reduced in size if it is very large, and the grayscale version the solver worked on. Every piece of metadata embedded in the file, including any location and date recorded by your camera, is removed before either version leaves your device. The report also contains the settings the solve used (the crop you applied, the camera and lens details you entered, and the object you were aiming at if you named one), technical details of the solve such as the time limit and the number of stars detected, your device model, operating-system version and application version, the date and time the report was created, and a random reference that identifies the report.
• Optional location: if you tick the separate location checkbox, the report also contains your device's current location, rounded to a grid of about 5 kilometres, and whether it came from GPS or from a location you set by hand. This is your location when the report is created, which may differ from the place where the photograph was taken.
• Purpose: to investigate why the solve failed and to improve plate solving.
• Legal Basis: your consent (GDPR Art. 6(1)(a)). A report is sent only when you actively choose to send it, one image at a time, and the location is included only if you tick its checkbox. If your device has no internet connection at that moment, the report waits on your device and is sent automatically once a connection is available. Each report and its status are listed in the application settings, under Submitted reports, together with its reference. You may withdraw your consent for a report at any time by requesting its deletion as described in Section 7.

E. Free Trial Activation

Sideris includes a limited number of free plate solves before a one-time purchase is required. To ensure that the free trial is provided once per device, the application contacts our server when it is first launched. It does so again if the application's data has been cleared or the application has been reinstalled, so that the server can determine whether this device has already received its free trial; in that case, a reduced number of free solves may be granted once. If no internet connection is available, the request is made again the next time the application starts or when you choose to retry, and the rest of the application remains usable in the meantime.

• Data processed: an irreversible cryptographic hash of a device identifier provided by your operating system, together with the platform and the application version. The identifier itself never leaves your device; only the hash is sent, and it is hashed a second time, with a secret key, before it is stored. On Android the identifier is specific to Sideris and cannot be used to recognise you in any other application. On Apple devices the request also carries a token for Apple's DeviceCheck service, with which Apple records two values for your device: whether the free trial has been granted, and whether it has been granted again after a reinstallation. DeviceCheck reveals nothing else about your device. No account, name, email address, photograph, or location is involved.
• Purpose: to grant the free trial once per device and to prevent the same device from obtaining it repeatedly.
• Legal Basis: legitimate interest (GDPR Art. 6(1)(f)) in preventing abuse of the free trial and protecting the paid features of the application.

Once the free trial has been activated, plate solving works entirely offline, and the application does not contact our server again for this purpose unless its data is cleared or it is reinstalled.

F. Verification That a Request Comes From the Genuine Application

The services that receive data from the application, described in Sections 3D and 3E, are protected by Firebase App Check. The application obtains a short-lived attestation token each time it starts, and each request to those services carries one.

• Data processed: a token issued by Google Play Integrity on Android devices, or by Apple's App Attest on Apple devices. It confirms that the request comes from an unmodified copy of Sideris running on a genuine device. Producing it involves your operating system and the platform's own service; the token reaches us carrying no name, no account, no location, and nothing that identifies you.
• Purpose: to keep the free trial and the paid features from being abused, and to prevent anything other than the application from writing to the report service.
• Legal Basis: legitimate interest (GDPR Art. 6(1)(f)) in protecting the application and the services behind it from abuse.

G. Technical Data Accompanying Requests

Whenever the application contacts one of the services described in this Section, the request reaches that service with your device's IP address, as does any connection on the internet. Sideris does not use the IP address to identify or locate you, apart from deriving the approximate country described in Section 3B. Our own server records each free-trial request, with its IP address, in technical logs used for security and to diagnose faults.

• Purpose: to operate the services securely and to diagnose faults.
• Legal Basis: legitimate interest (GDPR Art. 6(1)(f)) in operating secure and reliable services.

H. Messages You Send by Email

If you write to us by email, we receive your email address, your name if it appears in your address or your message, and the content of your message and of any attachment.

• Purpose: to answer you and to handle your request, including a request to exercise your rights under Section 8.
• Legal Basis: legitimate interest (GDPR Art. 6(1)(f)) in answering the messages we receive, and, for a request to exercise your rights, compliance with a legal obligation (GDPR Art. 6(1)(c)).

I. Data Kept on Your Device

Everything else Sideris uses stays on your device and is never sent to us: your location, the photographs you solve, your solve history, your saved observing sites and settings, and the last position obtained from your device. The only exception is the optional location of a failed-solve report described in Section 3D, and only if you tick its checkbox.

Uninstalling Sideris removes this data from your device. On Android, Sideris is excluded from device backups. On Apple devices, your solve history, settings, and any report not yet sent are included in the backups your device makes to iCloud or to a computer, if you use them; those backups are under your control and are governed by Apple's terms.

If you choose to rate Sideris when the application invites you to, the rating and any review are handled by Apple or Google through their own interface and under their own privacy terms. Sideris receives no information about whether or how you rated it.

4. Recipients and International Transfers

We do not sell your personal data. The data described in Section 3 is processed on our behalf by the following service providers, which act as processors under data-processing terms that require them to protect it:

• Google LLC (Firebase and Google Cloud): provides the crash reporting and usage analytics described in Sections 3A and 3B and the App Check service described in Section 3F. It hosts the free-trial service and its record, described in Section 3E, in the European Union, and stores the failed-solve reports described in Section 3D in the United States.
• RevenueCat, Inc.: provides the purchase and entitlement management described in Section 3C.
• Our email service provider: stores the messages described in Section 3H.

The following companies act as independent controllers under their own privacy policies:

• Apple and Google, which distribute the application, process payments, and handle ratings and reviews through their app stores. Apple also operates the App Attest and DeviceCheck services described in Sections 3E and 3F, and Google operates the Play Integrity service described in Section 3F.

Some of this data is transferred outside the European Economic Area, in particular to the United States. Transfers to Google LLC rely on the EU-US Data Privacy Framework, and transfers to RevenueCat, Inc. on the Standard Contractual Clauses adopted by the European Commission, both of which are safeguards recognised under the GDPR.

5. Data Retention

• Crash reports: retained for up to 90 days, then automatically deleted.
• Usage analytics: retained for up to 14 months, then automatically deleted.
• Purchase data: kept for as long as it is needed to restore your one-time purchase, which is for as long as Sideris is distributed, and thereafter as required by financial record-keeping laws.
• Failed-solve reports: retained only as long as necessary to investigate the failed solve, and in any case no longer than 14 months, after which they are permanently deleted. A report waiting to be sent is kept on your device until it is sent.
• Free trial activation record: retained for as long as the application is distributed. This record exists precisely so that a free trial is not granted to the same device twice, and deleting it would defeat that purpose. It consists of the irreversible hash, the number of free solves granted, the date they were granted, whether and when they were granted again after the application's data was lost, the platform and application version reported by the application, on Apple devices whether the application was a test or a published version, and a random value that makes the request safe to retry. It contains no name, account, or contact detail. The two values Apple records through DeviceCheck are kept for as long as the application is distributed.
• Technical logs of our server: deleted after 30 days.
• Emails: kept for as long as needed to answer you and to keep a record of our exchanges, and deleted on request.

6. Data Security

We use appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls that limit who can reach the data, and reliance on established providers that maintain their own recognised security standards. No method of transmission or storage is completely secure, however, and absolute security cannot be guaranteed.

7. User Accounts and Data Deletion

Sideris does not use user accounts. You are not required to register, sign in, or provide your name, email address, or any other identifier to use the application, and no user profile is created for you.

You can stop usage analytics and crash reporting at any time in the application settings, and uninstalling the application removes the data it holds on your device. Data held on servers can be deleted as follows, by writing to the email address in Section 1:

• Failed-solve reports: quote the reference of the report, shown in the application settings under Submitted reports, and the report will be deleted.
• Free trial activation record: this record survives uninstalling the application, which is what allows the free trial to be limited to one per device. Because it is stored as an irreversible hash, it cannot be found from your name or email address. To find it, open About in the application settings, tap the version number seven times, and send the code that appears. On Apple devices, this code changes each time the application is reinstalled, so a record made before the last reinstallation cannot be found. The values Apple records through DeviceCheck cannot be read or deleted by us.
• Purchase data: the record held by RevenueCat can be deleted on request. Your purchase itself remains attached to your Apple or Google account and can still be restored.
• Usage analytics and crash reports: these are stored under random identifiers that the application does not display, so they cannot be linked to you or deleted individually. You can stop their collection at any time in the application settings, and they are deleted automatically at the end of the periods stated in Section 5.
• Emails: deleted on request.

8. Your Rights Under the GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: to obtain a copy of the data we hold about you.
• Right to Rectification: to have inaccurate data corrected.
• Right to Erasure: to have your data deleted.
• Right to Restriction of Processing: to have the processing of your data limited in certain circumstances.
• Right to Object: to object to processing based on our legitimate interests, described in Sections 3A, 3E, 3F, 3G and 3H. Crash reporting can be turned off directly in the application settings.
• Right to Withdraw Consent: to withdraw your consent at any time, without affecting the lawfulness of processing carried out before. For usage analytics, turn it off in the application settings; for a failed-solve report, request its deletion as described in Section 7.
• Right to Data Portability: to receive the data you provided to us in a structured, machine-readable format.
• Right to Lodge a Complaint: with a data protection supervisory authority, in particular in the country of your residence or workplace. In France, this authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

To exercise any of these rights, please write to the email address in Section 1. You will receive an answer within one month. Because Sideris has no accounts, a request can only be carried out for data that can be linked to you through the identifiers described in Section 7. Where that is not possible, you will be told so, in accordance with GDPR Art. 11.

9. Children's Privacy

Sideris is not directed at children. We do not knowingly collect personal data from a child below the age of digital consent that applies in their country. If we become aware that we have collected personal data from a child below the applicable age without the required parental or guardian consent, we will take steps to delete that information promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any change is reflected in the Effective Date at the top of this document. The current version is always available inside the application, under Settings, and on our website. Where a change means we would rely on your consent for processing we do not carry out today, we will ask for that consent before the new processing begins, rather than treating a change to this text as your agreement to it.