SkysSense

Privacy policy

Version 2.1 · 27 September 2026 · Previous versions: 2.0, 1.0

This policy explains what personal data SkysSense (the website skyssense.com and the Android app) uses, why, on what legal basis, who receives it, how long it is kept and what you can do. The first table is the summary; the rest goes into detail.

Basic information

ControllerSkysSense, a personal project run from Spain. [email protected]
PurposesShow the aircraft around you; run your optional account, photos and community features; send the emails you ask for; statistics only if you accept them; keep the service secure.
Legal basesThe service you ask for (terms of use), your consent for the optional choices, our legal obligations and our legitimate interest in security.
RecipientsOnly the providers that host and run the service, and the data sources that answer each search. Nothing is sold or used for advertising.
TransfersSome providers are in the United States or the United Kingdom, covered by adequacy decisions (EU-US Data Privacy Framework, UK) or standard contractual clauses.
Your rightsAccess, rectification, erasure, restriction, objection, portability and withdrawing consent, plus complaining to the AEPD.
MoreIn the sections below.

In short

  • Your exact position never leaves your device: it's rounded to about 1 km first, used only to find the aircraft and weather around you, and not saved. You can also choose a zone by name instead.
  • You can use SkysSense without an account. An account is only needed to sync your lists, share photos and join the community.
  • Everything public (profile, ranking, search, newsletter, statistics) is off until you turn it on, and you can turn it off at any time.
  • You can download all your data and delete your account from the app.

1. Controller

The controller of your data is the owner of SkysSense, a personal project run by a private individual resident in Spain. For anything about your data, write to [email protected]. SkysSense has not appointed a data protection officer because the law doesn't require one for this service.

2. What we process and why

ActivityDataLegal basisHow long
Radar around youPosition rounded to about 1 km and search radius; or the zone name you typeService you ask for (art. 6.1.b GDPR), after you allow location on your deviceNot stored
AccountEmail, alias, language, password (only as a hash), sign-in method, dates, accepted terms version, last activityTerms of use (6.1.b)Until you delete it, or 24 months without use
Sign-in with Google (optional)Name, email address and profile photo sent by Google, and the id of your Google accountPerformance of the contract, the terms of use (6.1.b), when you choose to sign in with GoogleUntil you delete the account
Synced listsWatchlist, favourites, aircraft type collectionTerms of use (6.1.b)Until you delete them or the account
PhotosImage, aircraft details, date, optional credit handle, review statusTerms of use (6.1.b)Until you delete them or the account
Public profile and rankingAlias, join date, photo and type counts, approved photosYour consent (6.1.a)Until you withdraw it
Being findable in SearchAliasYour consent (6.1.a)Until you withdraw it
Likes and followsWhich photos you like, who you followTerms of use (6.1.b)Until you undo them or delete the account
Account emailsEmail, languageTerms of use (6.1.b)Sending logs of the provider only
NewsletterEmail, language, request and confirmation datesYour consent, confirmed by email (6.1.a)Until you unsubscribe
Consent logAccount or random device id, what was accepted or refused, text version, date, web or Android, languageLegal obligation to prove consent (6.1.c and 7.1 GDPR)3 years after the consent stops applying
Reports and owner requestsEmail, reported content, reason, details, decisionLegal obligation (Digital Services Act, 6.1.c)12 months after the decision
Issue reportsMessage, optional email, page, browser, language, accountLegitimate interest in fixing problems (6.1.f)12 months
Usage statisticsPages, device and browser, approximate area, Analytics cookiesYour consent (6.1.a)2 months in Google Analytics
Server logsIP address, date, requested address (with the rounded search area), browserLegitimate interest in security (6.1.f)30 days
Administration logWhich administrator looked up or changed which account, and whenLegitimate interest in security and accountability (6.1.f, art. 32 GDPR)2 years

No decisions with legal or similar effects are taken about you by automated means, and no profiles are built for advertising.

3. Your location

When you open SkysSense, a notice first explains what your location is used for. Your browser or phone only asks for permission when you press Allow location, and if you already allowed it on an earlier visit, scanning starts straight away. If you prefer, you can choose a zone manually instead (the name you type is sent to Open-Meteo's place search).

4. Account and sign-in

The account is optional. We store your email, the alias you choose (it doesn't need to be your real name), your language, the version of the terms you accepted and when you last used SkysSense. Your password is handled by our authentication provider (Supabase), which stores it only as a salted hash (bcrypt); nobody can read it, us included. If you sign in with Google, Google sends us your name, email address and profile photo. We use the email to identify your account; the name and photo are kept with the account by our authentication provider but are never made public: your profile, the ranking and the search only show the alias you choose, and avatars are your initials. The sign-in itself happens on Google, which is responsible for it under its own policy.

5. Photos and community

Photos are re-encoded on your device before uploading, which removes hidden data such as the camera's GPS position. They are reviewed before publication. Once approved they are public, with your credit handle if you add one, and the number of likes.

Your profile and position in the ranking are public only if you choose it, and you can separately choose whether other spotters can find you by alias in Search. The people you follow are visible only to you and to them; like counts are public but who gave each like is not.

If you report content or ask us to hide an aircraft, we use your email to answer and to tell you the decision.

6. Emails and newsletter

7. Providers and recipients

Providers that process data on our behalf (processors) do so under a data processing agreement. Data sources receive only what each search needs, as independent controllers of their own services.

ProviderWhat forWhere and safeguards
Supabase Inc.Accounts, database, photo storage, server functions (processor)Data hosted in the EU (Frankfurt, Germany); possible support access from the US under standard contractual clauses
Resend (Plus Five Five, Inc.)Sending account emails and the newsletter (processor)United States; EU-US Data Privacy Framework and standard contractual clauses
DigitalOcean, LLCServer that hosts skyssense.com and forwards the aircraft searches (processor)Server in London, United Kingdom (UK adequacy decision, valid until 27 December 2031); company certified under the Data Privacy Framework
Cloudflare, Inc.Delivery, DNS and protection of skyssense.com (processor)Global network; Data Privacy Framework and standard contractual clauses
Google Ireland Ltd. and Google LLCGoogle Analytics, only with your consent (processor); sign-in with Google, if you use it: Google sends us your name, email and profile photo (independent controller)EU and United States; Data Privacy Framework
jsDelivrDelivering a software library (receives your IP address)Global network
adsb.lol, adsb.fiLive aircraft positionsReceive the rounded search area, normally from our server
Open-MeteoWeather and place searchReceives the rounded position or the place name, and your IP address
adsbdb.com, hexdb.io, planespotters.net, pics.avs.ioRoutes, aircraft details, photos and airline logosReceive only aircraft identifiers, plus your IP address when your device loads them
corsproxy.io, codetabs.com, corsfix.com, cors.eu.org, allorigins.winBackup relays, only if the services above can't be reachedReceive the same request as the service being relayed

We may also have to disclose data to courts and authorities when the law requires it.

8. International transfers

When a provider handles data outside the European Economic Area, it is covered by an adequacy decision of the European Commission (the EU-US Data Privacy Framework for certified US companies, and the decision for the United Kingdom) or by the standard contractual clauses approved by the Commission. We check the certification of each US provider in the official Data Privacy Framework list. You can ask us for a copy of the safeguards at the contact address.

9. How long we keep data

10. Your rights

You can ask to access, rectify or erase your data, to restrict or object to its use, to receive it in a portable format, and withdraw any consent at any time without affecting what was done before. Much of it you can do yourself:

For anything else write to [email protected] from the email of your account (or tell us how to confirm it's you). We answer within one month; if the request is complex it can be extended by two more months, and we'll tell you why within the first month. You can also complain to the Spanish Data Protection Agency (aepd.es) or to the authority of the country where you live.

11. Deleting your account

Deleting your account from the app erases, straight away: the account and sign-in, your profile and settings, synced lists, your photos with their files, the likes you gave and the ones your photos received, your follows in both directions, and your subscription to the newsletter with the email provider. What stays: the consent log entries (for 3 years, to prove what was consented to), reports you sent, until their 12 months are over (without your account), and issue reports (without your account or email).

12. Minimum age

You need to be at least 14 years old to create an account, which is the age of digital consent in Spain. The radar can be used without an account. If we learn that an account belongs to someone younger, we delete it.

13. Security

All connections use HTTPS. The database uses row level security so each account can only change its own data; photos are stored in a private space and shown through links that expire; passwords are only stored as hashes; the server is only reachable through Cloudflare; and every administrator lookup or change is logged. If a security breach puts your data at risk, we will notify the AEPD within 72 hours and tell you when the law requires it.

14. Changes

Each version of this policy has a number and a date, and previous versions stay available. If a change is important we'll let you know in SkysSense or by email before it applies, and ask you to review it when you next use your account. Cookies are explained in the Cookie policy.

Contact
[email protected]

← Back to SkysSense