Privacy policy for What to Image Tonight

1 Controller

The controller for What to Image Tonight (whattoimagetonight.com) is Sebastian Glückselig (GLUECKSELIG.ORG), Goldstraße 7, 42697 Solingen, Germany, email: kontakt@glueckselig.org. Further details are given in the legal notice.

2 In short

What to Image Tonight does all calculations on your device. There is no account, no cookies, no advertising and no third-party analytics. Sites, horizon lines, watchlist and settings are stored only in your browser. Our server delivers the app files, keeps technical access logs with shortened IP addresses and compiles usage statistics from page requests without IP addresses; the app sends nothing extra for this. Your browser connects to no third-party service: the map and the weather forecast run via our server, and the weather forecast is off by default.

3 Using the app and server logs

When you open the app, your browser sends technically necessary data to our server: IP address, date and time, requested address, status code and amount of data, the address of the referring page (referrer) and browser and operating system information (user agent). We process these data to deliver the app, find errors, fend off attacks and compile the usage statistics described in section 4 from the time, requested address and status code. The legal basis is Art. 6(1)(f) GDPR; our legitimate interests are secure and stable operation and improving the app according to actual use.

In the access log we store for each request the shortened IP address (IPv4 without the last octet, IPv6 only the first 48 bits), date and time, the requested address without query parameters, status code and amount of data, the domain of the referring page and the browser information (user agent). In case of serious server errors, an error log may contain the full IP address. Both logs are deleted after 14 days.

The server is operated on our behalf by Contabo GmbH, Munich (Art. 28 GDPR), and located in a data centre in Lauterbourg (France), i.e. within the EU.

4 Usage statistics

To see which pages and sky objects are in demand and whether pages are delivered without errors, our server counts the requests your browser sends to it anyway when you use the app. The app sends nothing extra for this and reads nothing from your device for it. For the statistics the server records only three items per request: the hour of the request, the status code and the page or file requested (for example an object's example photo). Neither the IP address, nor the browser information, nor the page you came from is used. A program on our server combines these entries into daily totals every day; we delete the individual entries after three days at the latest. Neither the individual entries nor the daily totals allow any conclusions about individual persons.

The legal basis for deriving these entries from your request is Art. 6(1)(f) GDPR; our legitimate interest is detecting errors and improving the app according to actual use. You can object under Art. 21 GDPR (section 15).

5 Storage on your device

The app stores in your browser (IndexedDB and localStorage) your sites with coordinates, elevation, horizon line and sky brightness, your watchlist, your own device profiles, settings such as language, red light, minimum altitude, weather and offline mode, and whether you closed a hint. These data stay on your device. Something is sent to our server only if you switch on the weather forecast: the coordinates of your active site, rounded to about 10 km (section 9). Only what is strictly necessary for the functions you use is stored (Section 25(2) no. 2 TDDDG).

If you switch on “Available offline” or install the app on your home screen, a service worker keeps the app files in the browser; this cache contains no information about you.

You can delete all data in the app's settings or via your browser settings (“clear site data”); sites and watchlist are then lost unless you exported them first.

6 Location via GPS

When you tap “Current position”, your browser asks for permission. The position is processed only on your device and copied into the site you save. You can withdraw the permission in your browser settings.

7 Place search

The place search runs entirely on your device. On the first search the app loads a place list from our server (data: GeoNames, CC BY 4.0). Your search term is not transmitted.

8 Map (OpenFreeMap)

When you open the map in the site editor, the app loads map tiles, fonts and the map style via our server. Our server fetches these files from OpenFreeMap (Hyperknot Software Kft., Petőfi Sándor utca 48., 2724 Újlengyel, Hungary; possibly delivered via Cloudflare, Inc., USA). OpenFreeMap and Cloudflare receive only our server's address and the map files requested, not your IP address and no information about you. Our server does not log which map areas are requested; to prevent misuse it briefly limits requests per IP address in memory, without storing the address.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is placing a site precisely on a map at your request. Nothing is requested unless you open the map. Map data: © OpenMapTiles, © OpenStreetMap contributors (ODbL).

9 Weather forecast (optional, off by default)

If you switch on the weather forecast, the app asks our server for the forecast for your active site, with coordinates rounded to 0.1° (about 10 km). Our server fetches the data from the Norwegian Meteorological Institute (MET Norway, Oslo); MET receives only the rounded coordinates and our server's address, not your IP address. Section 3 applies to our server; the coordinates are not written to the access log.

The legal basis is Art. 6(1)(f) GDPR; the feature runs only while you have it switched on. Weather data: MET Norway, CC BY 4.0.

10 Transferring data (export, import, QR code)

Export and import run only on your device. In the QR code your data, including the coordinates of your sites, are placed in the link after the “#” sign. Browsers do not send this part to our server. Anyone who photographs the code can read the data, so use it only between your own devices.

11 Links and example photos

Image credits, licences and sources link to other websites such as Wikimedia Commons, Creative Commons or GitHub. Your browser connects to them only when you tap a link; their privacy policies apply there. We serve the example photos ourselves.

12 Contact by email or phone

If you email or call us, we process your details (such as name, email address or phone number and the content of your message) to answer your enquiry. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries about the app. We delete the details once the enquiry has been dealt with, unless statutory retention obligations apply. Our mailbox is operated on our behalf by Hostinger International Ltd., Larnaca (Cyprus) (Art. 28 GDPR).

13 No cookies, no third-party tracking, no automated decisions

What to Image Tonight sets no cookies, embeds no third-party analytics or advertising services, does not pass on data for advertising and makes no automated decisions within the meaning of Art. 22 GDPR. You are not obliged to provide any data, but without a location the app cannot calculate anything.

14 Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An email to kontakt@glueckselig.org is enough for any request. We do not know data that exist only on your device. Without further details we cannot link shortened logs or statistics to a person (Art. 11 GDPR). If you still want access or erasure, tell us the period, device, browser and the IP address you used at the time; we will then check whether any entries can be linked to you.

You can lodge a complaint with any data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

15 Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You do not have to use the map or the weather forecast.