Privacy Policy / Datenschutzerklärung

This site sets no cookies, runs no tracking scripts, and sends your browser to no third-party server. Fonts, styles, scripts, photographs and the search model are all served from this domain — opening a page here contacts nobody but this site. (The server itself does fetch from other machines, on a schedule nobody’s visit triggers; that is described below.) Nothing that is not strictly necessary is stored on your device or read from it, so there is no consent banner to click away: there is nothing to consent to.

What remains is unavoidable. To send you this page, a server has to receive a request from your device, and that request is logged. The rest of this document explains that, and the three smaller things this site does that a reader deserves to know about: what happens to a search term, what the API rate limiter holds, and what becomes of your location if you offer it.

Viacheslav Shynkarenko
c/o· COCENTER
Koppoldstr.· 1
86·551 Aichach
Germany
Email: slavik@nospam-slavikdev.com

No data protection officer has been appointed. This is a private, non-commercial site processing personal data on a very small scale, so the thresholds in Art. 37 GDPR and § 38 BDSG are not met. The full provider identification is in the Legal Notice.

When you open a page, your browser necessarily transmits technical information, which is processed to deliver the page and keep the service running:

• IP address
• date and time of the request
• the URL requested — including any query string, which matters for search and location
• referring URL, if your browser sends one
• browser type and version, and operating system

PURPOSE

Delivering the site, keeping it stable, and defending against attacks and abuse.

LEGAL BASIS

Art. 6 (1) (f) GDPR. The legitimate interest is operating a functioning, secure website.

RETENTION

Held in the server's and the CDN's own rotating logs under their retention policies. It is not merged with any other data, not used to identify individual visitors, and not analysed to build a profile of anyone.

The server is a rented machine in France, inside the European Union. Serving this site involves no transfer of your data outside the EU at that layer. Art. 13 (1) (e) GDPR asks for the recipients or the categories of recipients, and the category is what is given here: the provider’s name and the origin address are not published, because the origin sits behind a proxy precisely so that it is not directly addressable, and publishing the pair would undo that. If you want the name, ask under Art. 15 and you will be told it.

Cloudflare — Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — sits in front of it and provides DNS, TLS termination, caching and protection against attacks. Your request reaches an edge location near you and, when the page is already cached there, is answered without the origin server hearing about it at all.

Cloudflare is based in the United States, so personal data is transferred to a third country. It is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023, and additionally offers Standard Contractual Clauses under Art. 46 (2) (c) GDPR. Transfers therefore take place on the basis of Art. 45 (1) GDPR.

This is the complete list. It is generated from the same table the code reads, so it cannot fall behind what the site actually writes:

• spacecatalog:equipmentLOCAL STORAGESTRICTLY NECESSARY

  The telescope or binoculars you picked, so the eyepiece view and the observing list do not ask again on every page.

  Until you clear your browser storage.

• spacecatalog:unitsLOCAL STORAGESTRICTLY NECESSARY

  Whether you want measurements in astronomical units, in SI units, or in both, so that every page answers the way you asked once.

  Until you clear your browser storage.

• spacecatalog:hintsLOCAL STORAGESTRICTLY NECESSARY

  Which of the sky map's short introductions you have already been shown, so that the gestures are explained on your first visit and not on every one after it.

  Until you clear your browser storage.

• spacecatalog:sky-chromeLOCAL STORAGESTRICTLY NECESSARY

  Which of the sky map's collapsible readouts you have opened, so that the corner shows you as much or as little as you asked for rather than starting over on every visit.

  Until you clear your browser storage.

None of this requires your consent, and the reason is worth stating rather than assuming. § 25 (1) TDDDG requires consent before information is stored on or read from your device — but § 25 (2) no. 2 exempts what is strictly necessary to provide a service you explicitly requested. Choosing your telescope so the site stops asking on every page is that: a setting you changed on purpose, held on your own machine, never sent to the server, and never used to recognise you. So there is no consent banner here. A banner in this situation would be asking permission to do nothing, and would teach you to dismiss the ones that matter without reading them. If that ever changes, the banner and this paragraph change together — they are driven by the same list.

You can delete anything above through your browser’s settings at any time. The site keeps working; it will simply have forgotten your equipment.

The sky map and the observing list inside it can show the sky from where you are standing, which needs a latitude and a longitude. Asking for one is your decision and only yours: nothing happens until you press the button, your browser then asks you separately, and declining costs you nothing but the convenience — you can pick one of the named observatories, or put ?lat=&lon= in the URL yourself.

What happens to the coordinates matters more than that they are asked for. The precise position never leaves your browser. It is rounded to 0.25° — about thirty kilometres, the same grid the sky itself is cached on — before it is written anywhere, and it is that rounded value which goes into the URL and reaches the server. Thirty kilometres is enough to get your horizon and your sidereal time right and not enough to say which town you are in, let alone which building. It is deliberately coarse for a second reason too: a link to tonight’s sky is a link people send each other, and a shareable URL must not carry a home address.

PURPOSE

Computing which objects are above your horizon, how high, and when it will be dark.

LEGAL BASIS

Art. 6 (1) (a) GDPR — consent, given through your browser’s own permission prompt, which you can withdraw at any time in your browser settings with effect for the future. The coarsened value in the URL is then processed under Art. 6 (1) (f) to answer the request you made with it.

RETENTION

Not stored. No account, no cookie and no database row holds it. The coarsened pair appears in the URL and therefore in the request log, like every other URL.

A search term travels as a query string — /search?q=andromeda — which means it is part of the URL and lands in the request log along with it. That is the honest cost of a search page you can bookmark and link to, and it is worth saying out loud rather than leaving to be discovered. Search terms are not written to the database, not attached to a person, and not analysed to build a profile.

The search itself runs entirely here. Names and catalogue designations are resolved against this site’s own database, and the model that handles searches by meaning is a small one baked into the application image and executed in this server’s own process — there is no API key, no external service, and nothing you type is sent to anyone.

The JSON API needs no key and no account, so it holds nothing about who is calling it. It does count calls, because a runaway script would otherwise take the database down: the caller’s IP address is used as the key of a counter held in memory only, never written to disk, and discarded once the address has been idle for five minutes. It is not logged separately, not aggregated, and not used for anything except deciding whether the next request goes through.

PURPOSE

Keeping one caller from exhausting a small server that everyone else is also using.

LEGAL BASIS

Art. 6 (1) (f) GDPR — a legitimate interest in the availability of the service.

RETENTION

At most five idle minutes, in process memory. A restart erases it.

Every typeface is served from this domain. The font files are downloaded once when the site is built and shipped with it, so opening a page transmits nothing to Google Fonts or to any other font service and opens no connection to one. The same is true of the photographs, which are fetched from their sources at build time and served from here rather than hotlinked, and of the scripts, of which there are no third-party ones at all.

Links to other sites — Wikipedia, Wikimedia Commons, the upstream catalogues, observatory releases — are ordinary links. Nothing is requested from them until you click one, and every outbound link carries rel="noreferrer", so the site you land on is not told which page here sent you.

The claim at the top of this page is about your visit, and it is worth being exact about what it does not cover. This server does talk to other people’s machines — it just never does so because someone is reading a page.

• Every night a job fetches new papers and headlines from 11 sources — arXiv, NASA ADS, NASA APOD and the observatory feeds — each named, with its licence and its last successful fetch, on the about page.
• A second job tells IndexNow which pages of this site have changed, so search engines re-crawl them. It sends URLs from this domain and nothing else.
• The photographs, the font files and the source catalogues are fetched once, when the site is built, and served from here afterwards. That is why a page you open needs nobody else.

None of this is triggered by a reader, none of it carries a reader’s IP address, browser or anything else about them, and all of it would run identically if nobody visited the site at all. What those servers learn is that this site asked them something. They learn nothing about you.

None. There is no analytics service on this site, no page-view counter, no heatmap, no A/B testing and no advertising network. How many people read a page is not measured.

If you email me, your address and the content of your message are processed solely to handle what you wrote about.

PURPOSE

Answering you.

LEGAL BASIS

Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) where your message concerns an arrangement between us.

RETENTION

Until the matter is settled, unless statutory retention periods apply. You can ask me to delete the correspondence at any time.

Under the GDPR you have the right to:

• Access — confirmation of whether I process data about you, and a copy of it (Art. 15)
• Rectification — correction of inaccurate data (Art. 16)
• Erasure — deletion of your data (Art. 17)
• Restriction — limitation of processing (Art. 18)
• Portability — your data in a structured, machine-readable format (Art. 20)
• Objection — to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21)

To exercise any of these, email slavik@nospam-slavikdev.com. Where processing is based on consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of what was done beforehand. There is no automated decision-making or profiling under Art. 22 on this site.

You may complain to a data protection supervisory authority — in the EU member state of your residence, your place of work, or the place of the alleged infringement. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

This policy is updated when the site changes in a way that affects it — if accounts open, or analytics is ever turned on. The version you are reading is the one that applies. Several sections here are generated from the same configuration the running code uses, which is the mechanism that keeps them from drifting apart.