What Trajectory keeps, and how to get rid of it.

You can sign in with Google, with Apple (on an iPhone), or with an email address and a password. With Google or Apple, the email address and starting display name come from that account; if you hide your email from Apple, Apple gives us a private relay address instead. With an email and a password, Firebase Authentication holds the address and a scrambled form of the password, never the password itself. The display name is yours to change, under Account, then Profile.

Nothing else is kept. The app does not collect your contacts, your files, an advertising ID, or any record of what you look at inside it. Location is covered below, and that is all of it.

You can use the app as a guest. A guest tracks missions, gets alerts and reads everything, with the list kept on the phone: no account is made and nothing is sent to Firebase. Signing in is what carries your list to a second device, and the app only asks when there is a reason to.

The app may ask for your approximate location, only for things about your own sky:

• the Earth globe opens facing the country you are in
• the Sun's space weather card and the Home page say whether an aurora is likely where you are
• the Home page shows when the space station next passes overhead, how bright the Moon is and how cloudy tonight will be
• pass alerts, if you turn them on, warn you before a station crosses your sky

It asks for coarse location only. Saying no is fine: nothing else in the app changes, and the globe opens where it always did. You can change your mind at any time in your phone's settings.

Your position is not stored and is not sent to us. It is read on the phone and turned into a country name. There are two exceptions:

• The town name on the Sun's weather card. A phone cannot name a town by itself, so the approximate position goes to the geocoding service built into your phone (Google's on most Android phones, Apple's on an iPhone) and a place name comes back. Nothing is kept. A phone without that service shows the country instead.
• Tonight's cloud cover comes from the Norwegian Meteorological Institute (MET Norway, api.met.no), which is asked for the forecast at your position rounded to about a kilometre. Nothing else goes with it: no account, no name, no device ID. See the MET Norway privacy policy.

Station passes, the Moon and the aurora are worked out on the phone itself.

As a guest, your settings stay on the device and never leave it. If you sign in, the settings listed above are copied to your account so they follow you; the rest, such as when you last sent an enquiry, stay on the phone. Your phone's own permission choices, for notifications and location, are never copied. Uninstalling removes what is on the phone, and deleting your account removes what is in it.

Mission alerts are made by your own phone, and no record that you were sent one goes anywhere. On an iPhone, our server also sends a silent wake-up so the phone can check for new alerts. It goes to every iPhone copy of the app at once, carries no words and is not addressed to anyone. To receive it, the iPhone registers with Apple and with Firebase Cloud Messaging (run by Google), which give it a device code that we never see.

Google, through Firebase Authentication and Cloud Firestore, stores the items listed above for us. See the Firebase privacy documentation and the Google privacy policy. The data may be held on servers outside your country.

Your account can be read and changed only by you. Google's servers enforce that, not just the app. The one exception is Trajectory+: our server reads your receipt to check it, and writes a note you can read but not change.

To show mission data, the app fetches from the places below. Like any website, they see the request and your device's IP address. They are never told who you are.

Most of these are only asked when you open the screen that needs them. Links you tap, such as news articles or Wikipedia pages, open in your browser, and those sites' own policies apply there.

The app shows how many copies are open right now. Nothing is sent to make that number: the data service counts the different IP addresses that asked it for an update in the last three minutes, from its own access log, and publishes the total. No account, ID or cookie is involved.

The addresses are looked up in an offline country database on the same machine, so the count can be split by country. The result is a tally of countries with no row for any one person.

Like any web server, ours keeps an access log with the IP address of each request. It is used only to keep the server running and for this count, and it is written over once it fills a fixed space, which today is about six weeks.

The country database is IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 International Licence.

The enquiry form hands your message to your own mail app; nothing is sent from Trajectory itself. If you send it, it arrives at info.trajectoryapp@gmail.com and we see what you wrote and the address you wrote from. The app adds a few lines to help us answer: the app version, your phone's model and system version, and the email you are signed in with, if any. You can see and change all of it before you send. Messages are kept while the question is open and deleted after.

Trajectory+ is an optional subscription, bought through Google Play on Android and the App Store on iPhone. Google or Apple handle the payment entirely; the app never sees or stores card details.

If you are signed in when you subscribe, the subscription follows your account and not just one phone:

• The purchase carries a scrambled code made from your email address. It is one-way, so your address cannot be read from it.
• The app saves the store's receipt to your account, and our server asks Google or Apple whether it is real and still active. Google Play also tells our server when a subscription starts, renews or ends.
• Our server then writes a short note to your account: whether Trajectory+ is active, until when, and whether it came from a purchase or free access we gave.

Cancel in Google Play or in your Apple account settings.

Everything the app sends or receives goes over HTTPS. Account details are held by Google's sign-in service and we keep no other copy.

Your account, tracked list, pinned tabs, settings and receipts are kept until you delete them. Deleting your account removes them all at once, and our server removes its Trajectory+ note for that account within a few minutes. Nothing is kept afterwards.

You can ask what we hold about you, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Email info.trajectoryapp@gmail.com and we will answer within 30 days. If you are in the UK or the European Economic Area you can also complain to your national data protection authority.

We hold this data so the app can do what you asked it to: keep your mission list for you.

Trajectory is not aimed at children under 13 and does not knowingly collect anything from them. If you think a child has given us their details, email us and we will remove them.

When this policy changes, the date at the top changes with it. Big changes are announced in the app before they take effect.

Trajectory, Melbourne, Australia.
info.trajectoryapp@gmail.com