Skysta Privacy Policy, what changed

Three things changed, and two of them are material. This entry says exactly what, because thirteen people accepted the previous version of these documents and deserve to be able to check what moved.

The age question is gone. Skysta no longer asks anyone how old they are. Until today the app asked the month and year you were born before it would let you in, worked the answer out on the phone, threw the answer away and kept two yes-or-no values on the device. All of that is removed: the question, the two stored values, and every mention of them in this policy. Nothing about it was ever sent anywhere, so there is nothing collected in the past to delete, and there is nothing new collected in its place. This is not a claim that Skysta verifies age. It never did, it said so in those words, and now it does not ask at all. The Terms of Use now require you to be 18 or over, which is a condition you accept rather than something the app tests. §12 is the whole of the children position and it is shorter than it was.

“Show on the map” now starts OFF, for everybody, on every photograph. The switch used to start on for adults and for anyone whose age the old gate did not know, and off only for someone it knew was under 18. It now starts off with no condition on it at all. Nothing seeds it: not your age, which the app no longer knows, not your last answer, and not where you are. It is still decided per photograph and one tap turns it on. This change reduces what is published rather than increasing it, and it means the exact capture pin is now published only when somebody deliberately switches it on. §4.1, §4.2, §2, §10, §12 and §13 all moved with it.

These documents are now written for the United States only. Skysta will be available on the United States App Store and is not directed to people elsewhere. Everything that existed only to satisfy European and United Kingdom law has been removed from this policy: the lawful-basis analysis, rights framed as GDPR rights, the Article 27 representative boxes, the transfer machinery, and the children’s-code reasoning. Not one disclosure about what the app does with data was removed. The field-by-field lists in §1, §2, §3.2, §4, §8, §8.1, §8.3, §9 and §9.1 are all still here, in full. What went was legal apparatus, not substance. §13 now offers the same rights to everybody, whether or not a law requires them, and says honestly that Skysta almost certainly does not meet the thresholds that would make those rights mandatory.

What did not change. Everything else. The journal backup, the seven days in the feed and permanence afterwards, the ~5.5 km locality cell on every shared sky, the two diagnostics answers and what each one collects, the retention windows, and what deleting your account does and does not reach are all exactly as they were.

“Show on the map” starts ON again. The entry above, written earlier today, records the switch moving to off for everybody. That was reversed the same day. It now starts on for everyone, on every photograph, and you turn it off on the share screen when you would rather not publish the pin.

Both entries stay here because both happened. A change log that quietly tidies itself up is worth less than no change log. So if you set your account up this morning and read that the switch started off, this paragraph is how you find out that it does not any more.

Nothing was republished and no sky already on the feed changed. This only changes how the switch is set when you next open the share screen. A sky you already shared carries whatever you shared it with, and Remove the place (§7) still takes the pin, the town name, the spot tag and the ~5.5 km cell off it together.

What did not change, and this is the part people ask about. Every shared sky still carries the ~5.5 km locality cell whether the pin is on or off. Turning the switch off has never taken a sky out of its Local area and it does not now. The cell is still never drawn on a map and it still never becomes a place name. The switch is still per photograph, still one tap either way, and still never remembered from one post to the next. A sky you keep in your journal still publishes nothing at all. §4.1 has both states side by side.

The age floor in the Terms of Use goes back to 13. §16.1 records it moving from 13 to 18 earlier today; that was reversed, so §12 above now says 13 in both places and the Terms and this policy agree again.

Nothing about what is collected changed with it. Skysta still does not ask your age, still does not estimate it, and still has no age question anywhere in the app. Skysta remains not directed to children under 13, and we still do not knowingly collect personal information from anyone under 13.

One thing was added in the app, and it belongs in this policy because it is about what gets published. “Show on the map” still starts on. The first time you share a sky with it on, Skysta stops once, says plainly that an exact pin is about to be published and who can see it, and offers to share without the pin instead. After you answer once it never appears again. It records a single yes-or-no on your own phone so it knows not to ask twice, and that answer is never sent anywhere.

“Show on the map” starts OFF again, and this is the third setting of one switch in one day. §16.1 records it moving to off. §16.2 records it moving back to on. This entry records it moving to off once more, and that is where it stands for the public launch. All three entries stay above this one because all three happened. A change log that quietly tidies itself up is worth less than no change log, so nothing earlier in this section has been edited to look like it always said this.

This change reduces what is published. It does not increase it. That is the direction, and it is the sentence to hold on to if you are wondering whether you have been publishing more than you thought. Nothing new is collected, nothing new is published, and no field was added to anything. A sky you shared earlier today carried a pin only if the switch was on when you pressed Share, and the share screen said in words what that meant, beside the switch, before you pressed it.

Nothing was republished and no sky already on the feed changed. This only changes how the switch is set when you next open the share screen. A sky you already shared carries whatever you shared it with, and Remove the place (§7) still takes the pin, the town name, the spot tag and the ~5.5 km cell off it together, and still cannot be undone.

So here is the switch as it is now. It starts off, for everyone, on every photograph. One tap turns it on for that one photograph, nothing remembers the answer, and the next photograph starts off again. With it on, the sky you share carries the exact coordinate the shutter fired at and the name of the town. Left off, it carries neither, and no field on the record says where you stood. §4.1 has both states side by side, and §4.2 says just how precise the pin is.

The one-time notice from §16.3 is still there, and what it is for has shifted. The first time you turn the pin on and share, Skysta stops once, says plainly that an exact pin is about to be published and who can see it, and offers to share without the pin instead. After you answer once it never appears again. When the switch started on, that sheet interrupted a default nobody had chosen. Now it confirms a decision you made on purpose. It is still a disclosure rather than a setting, it still changes no default, and the answer it records is still a single yes-or-no on your own phone that is never sent anywhere.

What did not change, and this is the part people ask about. Every shared sky still carries the ~5.5 km locality cell whether the pin is on or off. The pin has never been what puts a sky in its own area, and turning the pin off has never taken a sky out of the Local feed of people near where it was taken. It does not now. The cell is still never drawn on a map and it still never becomes a place name. The trusted spot tag still appears on its own near a trusted spot and still comes off with one tap (§13.3). A sky you keep in your journal still publishes nothing at all. The age floor is still 13 (§16.3), Skysta still does not ask your age, and nothing about what is collected moved with this change.

Nothing new is collected, and nothing in the app changed. This entry is a correction to what §1 and §9 said about the online-status record. The words were checked line by line against the code that writes that record, and two of them did not match.

The reason given for it was wrong, so it has been replaced with the true one. §9 said the record was there “so the service knows an account is currently active”. Nothing in Skysta asks that question. No screen shows your online status or anybody else’s, and there is no code on the server that reads the record at all. The only things that read it are the part of the app that clears away your own stale connections, the account deletion that removes it, and the developer’s tool that sweeps up whatever a deletion left behind. §1 and §9 now say that plainly, including the part where nothing uses it. The record is still written, exactly as it always was.

The list of what is in it is now complete. §1 named the connection time, the heartbeat, and the app version and build. The record also carries a random name for that one connection, and three fixed values that are the same on every record ever written. All of them are now listed, field by field, and §1 now says how often the heartbeat is rewritten and when a connection counts as gone. Nothing was added to the record to make that list longer. It has held these fields since the feature shipped, and this policy had described four of them.

What did not change. Where the record lives, who may read it, how long it stays, and what deleting your account does to it. It is still under your account identifier in a separate Google database, still readable by your account alone and by nobody else, still kept until you delete your account, and still removed at step 9 of §11. Nothing about your photographs, your location, the feed, the journal backup or diagnostics moved with this change.

A shared sky now leaves the public Moments feed after three days instead of seven. That is the only number that moved. §6 and the short version at the top both say three days now, counted from the moment the sky was published, off the same field feed membership always used.

Nothing about the life of the photograph changed, and this is the part to be exact about. A sky that leaves the feed is not deleted and never was. It moves, and it stays where it moves to, indefinitely: on your profile, where anyone who taps your byline sees everything you have ever shared, however old, and on the page of the trusted spot it was tagged at, if it carries a tag. A shorter feed window means a sky is news for a shorter time. It does not mean the photograph lasts a shorter time. No server in Skysta deletes anything on its own, there is still no scheduled cleanup job and nothing that wakes up on a timer, and the only two people who can take a shared sky down are still you, from the ⋯ menu, and the developer, on moderation.

The seven days that belong to Google Cloud Storage did not move. A photograph you delete, and every photograph that goes when you delete your account, is still kept by the storage service in a recoverable state for seven days before it is destroyed. That window is Google’s, it is about destroying a deleted picture rather than about how long a sky is in the feed, and nothing here touches it. The one hour Firestore keeps a deleted record readable did not move either, and neither did the thirty days the developer’s own dated copies live on a laptop. §6 has all three of these and they read exactly as they did.

What this does to a sky you already shared. A sky more than three days old leaves the feed sooner than the earlier wording said it would. It goes exactly where it was always going to go, and it stays there for good: on your profile, and on the trusted spot’s page if it carries a tag. Nothing was republished and nothing was deleted. No field was added to or taken off any record.

What did not change. Everything else. Nothing new is collected and nothing new is published. The journal backup, the ~5.5 km locality cell on every shared sky, “Show on the map” and how it starts, Remove the place, the two diagnostics answers and what each one collects, the retention windows above, and what deleting your account does and does not reach are all exactly as they were.

Three corrections, made by walking the code again, field by field. One is a field this policy had not disclosed, and two are places where the app had become better than this document said. Nothing in the app changed today; the words caught up with it.

Your block list holds a name, and §1 now says so. When you block somebody, the entry keeps their display name as it stood at that moment, alongside their account identifier and the time. It is there because the record holding a person’s current name is readable by its owner alone, so without a copy the list in Settings → Blocked could not tell you who anyone on it is. A rename after the block does not update it. The entry is still readable by one account, yours, and unblocking deletes it, name included, as does deleting your account. The field has been written since the blocked list learned to show names; this policy had described the sub-collection without naming what an entry holds, and now it does.

Your profile picture is screened before it is accepted, and §3 and §3.3 said it was not. On 28 August the avatar path was given the same on-device check the share path has: it runs only when Sensitive Content Warning is on in iOS Settings, the picture is never uploaded to be judged, a refusal happens before anything is stored, and nothing about a refusal is recorded. This document still called the unscreened avatar a gap, which stopped being true two days ago. The table in §3.3 now has the right answer in it.

A person can be reported, and §3.3 said there was nothing to press. Also since 28 August, tapping somebody’s name or picture on a sky they shared opens their page, and its ⋯ menu has Report this person and Block. An account report records the display name the account was showing when the report was filed, for the same reason the block list does: a name can be changed the minute somebody objects to it. §6 now sets out what each kind of report holds. The limit that remains is stated where it was: somebody who has never shared a sky cannot be reached from any screen in the app, and the answer there is still hello@skystaapp.com.

What did not change. Everything else. Nothing new was collected by any of this today, no field was added to any record today, and the three-day feed, the ~5.5 km locality cell, “Show on the map” and how it starts, the retention windows, and what deleting your account reaches are all exactly as the entry above left them.

One change, and it is to a surface this policy already warned you about: the Lock Screen card.

The card has its own switch now, and it starts on. It is at Settings → Lock Screen card, directly under the two reminder switches. Until today the card read those reminder switches instead of having one of its own, and the morning switch ships off, so a sunrise window put nothing on the Lock Screen for anybody who had not also asked to be woken before dawn. That was not a decision anybody made about the card; it was a card borrowing a switch that answers a different question. A reminder makes a noise at you. A card sits quietly on a screen you chose to look at.

So the card now appears at sunrise as well as sunset, for everybody, without anyone turning anything on. That is more of your information on a locked screen than yesterday, in the mornings, which is why it is written here rather than left as an improvement nobody was told about. What the card shows has not changed: the place or the planned spot, the Sky Score and its short verdict, and the window’s times. It is still drawn on your phone, still sent by no server, and still readable by anybody holding your phone without unlocking it.

Turning it off. Skysta’s own switch is the new one above. Your iPhone’s Settings → Skysta → Live Activities still turns it off too, and that one wins whatever Skysta’s switch says. The card also still keeps to the days you picked and to your quiet hours.

What did not change. Nothing new is collected, no field was added to any record, nothing new leaves the phone, and the reminder switches still control reminders exactly as they did. §10 and §13 have been corrected: both said there was no switch for the card inside Skysta, which was true when it was written and is not true now.

One change, to the Lock Screen card again, and it is the one the owner had been asking for: the card no longer needs the app to be open to appear.

On iOS 26, iOS starts the card itself. While Skysta is open it hands iOS the next four light windows, evening and morning alike, and iOS holds each one and starts it at the minute its window opens, with the app closed. The system plays its alert sound as the card lands, which is iOS’s rule for a card that starts this way and not a choice Skysta gets to make. On earlier versions of iOS nothing changes: the card starts only while the app is running.

What that means for your information. Nothing new is collected and nothing leaves the phone. The four windows are solar geometry worked out on the device and handed to iOS on the device. There is still no Skysta server, no push notification and no notification server. The card that starts this way carries no Sky Score until you next open the app, because a number worked out days early is not a reading of the sky it would be shown under.

Your switches still decide. A card is never scheduled for a window that would open inside your quiet hours or on a day you did not pick, and the Lock Screen card switch turns all of it off. Turning Live Activities off for Skysta in your iPhone’s Settings still wins over everything. Changing your watched place withdraws the cards scheduled for the old one.

What did not change. §10 and §13 now describe the card starting on its own; everything else in them stands.

This policy was split into a short version and a full text. The page at skystaapp.com/privacy/ is now a document of ordinary length, about three thousand words, and the text that used to be there, about twenty-five thousand, is at skystaapp.com/privacy/full/. Every section of the short version points to the same numbered section of the full one, so §8 means the same thing on both, and the full one is the one to trust where they differ. This page, the record of every change, moved to skystaapp.com/privacy/changes/.

Nothing about your data moved. Nothing new is collected, nothing new is sent, and no default, window, number or recipient changed. The Lock Screen entry above (§16.9) is still the most recent change to what the app does.

Why. The policy had become long enough that the short version at its top was the only part anybody read, and the short version sat on the same page as twenty-five thousand words. Now the short version is the page. The full text is one link away and still checked against the source code, sentence by sentence.

The website can now show a Sky Score. The home page at skystaapp.com lets you type a city, pick one, or press Show my sky, and shows the same Sky Score the app works out. The number is computed in your browser; the page fetches the forecast through a small server of our own at the site’s own address, which asks Apple WeatherKit and Open-Meteo and returns their answers. §2, §9 and §15.1 now describe what leaves your browser when you do this: the place you named, or your position rounded to about 5 km, and nothing about you. The website also draws the trusted spots on a map whose tiles come from OpenStreetMap. None of it is stored and none of it is linked to an account.

What this replaces. §15.1 used to say the website shipped no JavaScript at all. It ships its own now, and nobody else’s. It still sets no cookies, runs no analytics and loads no third-party scripts.

What did not change. Nothing about the app. No default, window, number or recipient in the app moved.

The website’s map of spots now comes from OpenFreeMap. Until today the map on the home page was drawn with picture tiles from OpenStreetMap. It is now drawn from OpenFreeMap (tiles.openfreemap.org), a free project run on its own servers behind Cloudflare, which sends your browser the pieces of map on your screen and the fonts for the labels. Each request carries your network address, the map area you are looking at, and the name of our site, which is how any map on any website works. OpenFreeMap sets no cookies and asks for no key or account. We send it nothing about you. If your browser cannot draw this kind of map, the older OpenStreetMap map is used the same way as before. §2, §9 and §15.1 now name both hosts.

What did not change. The map’s own code is served from our site, not from anyone else, so the website still sets no cookies, runs no analytics and loads no third-party scripts. Nothing about the app. No default, window, number or recipient in the app moved.

The website can now send us a spot suggestion. Until today the only way to suggest a viewing spot was from inside the app, signed in. The page at skystaapp.com/spots/suggest now takes one without an account: the name you give the place, its town and two-letter state or country if you fill them in, why the sky is good there, whether it is better at sunrise or sunset, the exact point you mark on the map, and an email address if you choose to leave one. It goes to our own server and into the same review queue the app’s suggestions go into, with no account identifier on it. §2, §6, §9, §11 and §15.1 now say so, and §6 says how long each part is kept: the suggestion until a person has reviewed it, and the email address only until we have replied about that one place, then deleted by hand.

What this changes. §15 used to say the map’s tiles and the forecast were the only things the website fetched from anyone. That is still true of what it fetches; a spot you choose to suggest is now the one thing it sends. The website still sets no cookies, runs no analytics and loads no third-party scripts, and the server keeps no record of who asked.

What did not change. Nothing already collected is affected. Nothing about the app. No default, window, number or recipient in the app moved.

The Lock Screen card can now start on a phone that has not opened Skysta for days. Until today the card started only while the app was running, or, on iOS 26, for the next four windows after the app last ran. Now, while Settings → Lock Screen card is on, the app keeps one small record on our own server: your watched place rounded to about 1 km, its time zone and name, the card’s own settings, the app version, and the token Apple issues your phone for starting a card. A job on our server works out the light times from that place and asks Apple’s push service to start the card at the opening minute. The card carries times only; nothing about the forecast or your Sky Score is sent. The record is deleted when you turn the switch off, unset your place, sign out, or delete your account, and on its own after three days if the phone stops answering. §2, §6, §9 and §10 now say so.

What did not change. The card’s own settings still decide: quiet hours, the days you picked, and the switch itself. Nothing is sent while the switch is off. No default in the app moved.

The Lock Screen card no longer appears before the light does. Until today it could go up as much as seven and a half hours ahead of a window and sit there, so opening the app in the afternoon put tonight’s card on your Lock Screen for the rest of the afternoon, and opening it after midnight put the next morning’s there overnight. Now the card exists only while the window is actually open. What tells you a session has begun is the alert the card makes as it lands, at the opening minute.

A card is no longer scheduled for a light you switched off. A card that starts itself has to make a sound: iOS requires an alert on a scheduled start and offers no silent one. Sunrise reminders ship off, and until today the morning card was still scheduled for everybody, so a phone on the shipped settings could make a sound before dawn for a light its owner had never asked for. From today the Sunset and Sunrise switches decide whether a card is scheduled at all, on your phone and on our server alike. The card that appears while you have the app open is unchanged and still silent.

Every shared sky now names its town, and you are asked about it once instead of every time. The answer lives at Settings → Location & units → Name the town and ships on; onboarding’s location screen says what it does. Turned off, no place name is published and no point is sent to Apple to be named.

Every shared sky now names its town, and you are not asked about it per photo. It used to be published only if you turned Show on the map on. Two things about that are worth knowing. The name is worked out from a point rounded to about 5.5 km, never your exact one, so less about you goes to Apple to get it than the old behaviour sent. And that rounded cell was already published on every shared sky, for the Local feed, so the town was already there to be looked up; the app says it out loud now instead of leaving it implied. Show on the map still decides one thing and only that: whether your exact position is published as a pin. It still starts off. §2.1 has the detail.

“Show on the map” can be set to start on. It still starts off for everyone, and it is still a switch on every photograph that one tap decides. What is new is Settings → Location & units → Show on the map, which ships off and, turned on, changes where that switch starts. It is a decision made once, not a memory of your last answer, and the first-pin sheet now tells you which rule applies to you. §4.1.

Sharing your own sky is one tap now. The screen that asked what goes on the card, and whether to name the place, is gone. The card is drawn from what is already public on that sky: the photograph, your name and profile picture, the light and the Sky Score, and the place’s name only when the sky already has one. A sky with no place name still says nothing about where you stood, and a card still cannot carry a coordinate at all. §10 has the detail.

And when the light is over, the card now stays for one more hour. It was fifteen minutes. The card says the light is done and offers to show you what other people caught near you, and an hour is long enough to come back to it. Your phone removes it on its own at the end of that hour, whether or not Skysta is ever opened.

Nothing new is collected, nothing new is sent, and no record, recipient or retention changed. This is the app putting less on your screen and making fewer sounds, not more. §2 and §10 already describe the record behind the card and still do.

Three more rows on Apple’s privacy label, and two more lines in the app’s privacy manifest. None of them is new collection. They are things Skysta was already doing that the label had not named: the online-status record and the date you last opened the app, which now sit under Other Data; the diagnostic telemetry the Firebase libraries inside the app declare for themselves, under Other Diagnostic Data; and the identifier Google and Crashlytics generate when you turn diagnostics on, under Device ID.

Nothing you send us changed. What changed is that the label now names all of it. Tracking is still No on every row, and there is still no ATT prompt, because there is still nothing to ask you for.

Town-only skies are on the map, as areas. A sky shared with the map switch off now appears on the map as a town-sized area, about 5.5 km across, with the town’s name on it. It is drawn from the coarse cell every shared sky already carried, so nothing new is published; what changed is that the map now shows what the record already said. It is never a point. Zoom in and the area grows to cover streets, so nobody can mistake it for where you stood. A sky with the switch on is still drawn as an exact pin, exactly as before, and only that.

The four places this policy said the cell “is never drawn on a map and never becomes a place name” now say what is true: it is the town name, and it is the area.

Five things changed in the app, this policy caught up with them, and a few sentences that had fallen behind the code were corrected on the same pass.

The sky rating is gone. No card asks how a sky turned out any more, on Home or after a photograph, and no rating is written anywhere. The small adjustment your answers used to make to your own score, kept on your phone, is gone with it, and the collection those records went into is closed to every read and write. Records written by earlier builds cannot be found, because they carried no identifier. The switch at Settings → Privacy that read App counts and sky ratings now reads App counts, and it governs Firebase Analytics and nothing else. §8.1 keeps its number with a retirement note in place of its body, and every other sentence about a rating, in §2, §5, §6, §8, §9, §10, §11, §13, §14 and §15, is gone.

The weekly note is gone. The one silent note a week, on a day you picked, is no longer offered and is not sent. The app sends no weekly notification of any kind.

The camera-opens switch is gone from Settings. The one-off reminder you can arm from the shutter, so the app tells you when the camera opens, still exists and is still a notification the app can send. What went is the standing switch in Settings, which nothing read. So the kinds of reminder the app can place, and the kinds app counts can name, are four: sunrise reminder, sunset reminder, leave by, and camera opens. The note at peak colour counts as a sunrise or sunset reminder. §8 says so, and no longer lists a weekly note or a gathering you joined, which nothing in the app schedules.

Leave by is a switch, not a timing. At leave-by is no longer one of the timing choices, which are 45 minutes before, 2 hours before, 4 hours before and at golden hour. In Settings → Reminders there is one switch, Tell me when to leave, on for everybody. When it is on and you have planned a spot, that day’s reminder for that light fires at the leave-by time instead of at your usual lead. Nothing new is collected: the leave-by time is worked out on your phone from the drive time Apple’s routing service already gave you.

The record behind the Lock Screen card, in full, and the end push. §2 now lists every field on that record, including your Sunset and Sunrise switches, which of Apple’s two push services your copy uses, and the notes our server writes beside it, and it says when the record is rewritten: when any of that changes, and again the next time the app runs more than a week after the last write. It also says what this policy had left out. Up to two pushes go to your phone for each card, not one. The start push, at the opening minute, carries the card’s times and the name of your watched place. Your phone hands back a second token for that one card, and iOS wakes Skysta in the background for a moment to do it. Five minutes after the window closes the server uses that token to end the card. The end push carries the times. Neither carries anything about the forecast. The job’s logs carry a short hash of your record’s address, never a token, a place or a name. §9 and §10 say the same, and the Cloud Functions row in §9 now names the job that reads that record every ten minutes and the function that serves the website. None of this is new behaviour. The policy had described one push where the server sends up to two.

The six-cards rule is gone, and this policy was wrong about it. §16.14 said the record was deleted on its own after three days if the phone stopped answering, and §6 said six unanswered cards. From today the server only counts unanswered cards and writes a log line. The record now goes on its own only if Apple tells us your phone’s token no longer works. §2 and §6 say so.

Account deletion names the card record. The sweep in §11 deletes the Lock Screen record between your saved spots and your profile picture, and stops if it cannot confirm it gone, because a server reads that record on a timer. It is now written down as step 7, and the steps after it are renumbered. §1 lists the record among the things under your account.

The Device ID row on the privacy label is now linked to you. Two things fall under it: the identifier Google and Crashlytics make for themselves when you turn diagnostics on, which is never joined to your account, and the token Apple gives your phone for starting the Lock Screen card, which is stored under your account while that switch is on and deleted with it. The manifest inside the app says the same, for analytics and for app functionality. §15 says so, and the short version now lists the other-data and device-identifier rows the manifest declares.

Settings moved. The Lock Screen card switch is at Settings → Reminders → Lock Screen → Show the card. The block list is Settings → Blocked people. Your suggestions are at Settings → Help → My suggestions, feedback at Settings → Help → Share feedback, and this policy under Settings → About. You change your name by tapping it at the top of Settings. Every path in this policy now reads that way.

Corrections, made by reading the code again. §4 said the coarse cell is never drawn on a map and never turned into a place name; §2.1 and §4.1 already said otherwise, and §4 now agrees: it is the point the town’s name is worked out from, and on the map it is a town-sized area. §12 now says the same. §13.3 said the map switch governs the town name; it governs the exact pin, and Name the town governs the name. §9 said Apple’s geocoder receives the exact capture coordinate at share time; it receives the capture point rounded to about 5.5 km when the review page opens, while Name the town is on, and the exact point you mark when you suggest a spot in the app. §5.1 said the share card can carry the town a sky was named with; the card takes its place name from the trusted spot tag only, and the town is not on it. The short version’s §12 said a sky shared with the three place controls off carries no place at all; it still carries the rough cell, and now says so. §10 said a reminder’s words name clock times and nothing else; a reminder can also carry one short sentence about how tonight looks, written on your phone, with no place, no spot and no number. And §10 said the card could appear up to an hour and a half before a window you planned, which stopped being true on 6 September; it appears only while the window is open.

Three things the policy had not named. Directions to a trusted spot can open Google Maps, if you choose it, and the link carries the spot as the destination and nothing about you; §9 has a row for it. Our server removes a shared sky’s photograph whenever its record is deleted, and tries again if that fails; §7 says so beside the app’s own retry. Your profile page shows your newest sixty skies and a spot’s page its newest forty; older ones are not deleted and still open from their own link; §6 says so.

A date correction. The one-tap share, the town from the cell and the hour-long goodnight described in §16.15 shipped on 7 September, a day after that entry’s date.

Two more fields named, and one more time. The record behind the Lock Screen card also carries a number saying which shape of record it is and the moment your phone last wrote it; §2 lists them now, and §1 no longer claims §2 names every field. The start and end pushes carry one more clock time than §9 said, the minute of the next light after the one the card is for.

What did not change. Nothing new is collected, and no default in the app moved: sunset reminders on, sunrise off unless you chose mornings or both when you set the app up, 45 minutes before, every day, quiet hours off, the Lock Screen card on, the note at peak colour off, tell me when to leave on, crash reports off, app counts off.

One sentence in §10, and it was overstating what the Lock Screen card shows.

The card does not always carry a number. §10 said the card names the place or the spot you planned “and showing the Sky Score”, flat, as though a score were always on it. It is not. The card shows a Sky Score only when your phone has a reading recent enough to stand behind, and no number at all when it does not or when the card was started by our server rather than by the app. That has been true of the app for some time; the sentence had not caught up. §10 says it now.

Nothing about what is collected changed, and no default in the app moved. The record behind the card, what the start and end pushes carry, and how long any of it is kept are all exactly as §2, §9 and §10 already described them. This entry exists because this page promises every change to the policy is written down and dated, and a correction is a change.

§9 says what “read by a person” means. The policy said a spot suggestion, a spot correction and a feedback note are read by a person, and stopped there. It now says what that person does with a suggestion: reads it at a desk, checks what you wrote against public sources, and checks the coordinate you marked against a map. Nobody goes to the place. §9.1 says the same beside the list of what a suggestion carries.

Nothing new is collected, nothing new is shared, and nothing is kept for longer. What a suggestion carries, who can see it, how long it lasts, and what a developer erasure does and does not remove are all exactly as §9 and §9.1 already described them. No default moved and no switch changed.

Why it is here at all. The words “read by a person” could be read as somebody going out to look at the place, and they never meant that. A sentence that can be read two ways in a document about what happens to something you sent us is worth closing, and this page promises every change is written down and dated.

Nothing else moved. No other section changed and no number changed. How a trusted spot gets into the catalogue is not a privacy matter and is not described here: that is the terms of use, §5, changed the same day.

This one is material, and it changes a number. Read it even if you skip the rest.

The town on a shared sky is now worked out from a point rounded to about 1.1 km, not about 5.5 km. Everything else about location is exactly as it was.

Why. A photograph taken at Salt Lake County Flight Park, which is in Draper, was published as “Lehi, UT”. Nobody chose that. Before asking Apple’s geocoder for a name, the app rounded the capture point to the same ~5.5 km cell it publishes, and at that spot the rounding moved the question 2.6 km south, over the Salt Lake and Utah county line. Apple answered correctly about the point it was handed. Checked against every place in our catalogue, that rounding named the wrong town roughly one time in four. A wrong town is a false statement about where somebody stood, published to strangers and kept, and that is worse than asking a slightly better question of a service that is already answering the question anyway.

What did NOT change, and this is the part that matters most. The cell that is PUBLISHED on a shared sky is still about 5.5 km, still the only location a sky carries when the map switch is off, still what the Local feed groups by, and still what is drawn on the map as a town-sized area. Nothing about what is stored, shared, or kept moved at all. No new recipient. No new field. No default changed.

The finer point is asked about and then gone. It is not stored on your phone, not written to our database, and not published on the sky. It exists for the length of one question to Apple’s reverse geocoder. About 1.1 km is the same coarseness this policy already describes for the air-quality lookup in §2, and §13 files it under the same coarse-geolocation heading.

Being straight about the old number. Apple’s geocoder already receives an unrounded point from your phone for a different reason: when you choose Use my location for your watched place, the app hands Apple the exact fix to name your town. So rounding the capture point to 5.5 km before asking the SAME service was buying very little against that service, while costing a wrong town on one sky in four. It reads more protective than it was.

Nothing else moved. No other section changed and no other number changed. The effective date at the top of the policy moves to 13 September 2026 with this entry, because this one is material and that is what this page promises.

This one is material, and it moves something out of the “never uploaded” column. Read it even if you skip the rest.

Where your photographs were taken is now saved in the private copy of your journal that Skysta keeps for you. It was not before. Section 2.2 used to say the backup record had no latitude or longitude field and that the app never wrote one, and that was true until today.

Why. Signing out deletes the journal from your phone. The coordinate went with it, and because nothing anywhere else had a copy, it was gone for good. One sign-out emptied a person’s own photo map permanently, and every photograph restored afterwards came back with no place on it. The owner of this app found it on their own account by signing out and back in. The old promise was real, and every bit of its cost was paid by the person it was written to protect.

Who can read it: you, and nobody else, exactly as before. The journal lives under your account and the server rule on it is owner-only in both directions. One signed-in account can read a journal record and that account is yours. This is the same place your photographs themselves have been kept since the backup existed, under the same rule.

What did NOT change, and it is the part that matters most. Nothing about a SHARED sky moved. A shared sky still carries a locality cell of about 5.5 km and nothing finer, unless you turn Show on the map on for that one photograph, exactly as §4 has always said. No new recipient. No new published field. No default changed. The coordinate is still not in any analytics, not on a share card, and not readable by another Skysta user under any circumstance.

One honest limit. If you signed out before today, those coordinates were already erased from your phone and had never been anywhere else. Nothing can recover them, and photographs from before then may come back without a place on the map. Coordinates recorded from today on survive a sign-out and a new phone.

Nothing else moved. No other section changed and no other number changed. The effective date at the top of the policy moves to 15 September 2026 with this entry, because this one is material and that is what this page promises.

This one adds a way for a journal photograph to reach one other account, so read it.

You can now send a private sky to exactly one person. New section 5.3 says what is copied, how the one person is chosen, and what it is not. In short: the picture is copied to a private area of our server, the link carries a secret, the first account to open it becomes the only other account that can ever see it, a forwarded link opens nothing, and it is never in the feed, on a map, on a spot’s page, or on your profile. It carries no location. Sections 5 and 6 of the short policy carry the same in fewer words.

What the server keeps. A fingerprint of the link’s secret, never the secret itself, and the name of the recipient account once one has opened it. Nothing about a private sky goes to analytics.

What did NOT change. Sharing a sky to the feed is exactly as it was. The journal backup is exactly as it was, and the private link’s secret is not in it. No new recipient for your data and no default changed.

Nothing else moved. The effective date at the top of the policy is already 15 September 2026 from entry 16.22, and this entry joins it.

Entry 16.22 said “No other section changed”, and that was wrong. Entries are never edited, so this one corrects it. When the coordinate joined the private backup, sentences elsewhere still said it never left the phone: the summary bullet at the top of the full text, §3.2, §3’s “what did not change”, the Firestore row of the §9 table, §11.2, and short §3, plus the in-app promise sheet and the first-run location line. Every one now says what §2.2 says.

Three smaller corrections in the same pass. Short §10 said other people’s data is never written to your phone; records are not, but since 30 August the app keeps up to 200 MB of recently shown shared pictures in a cache on the phone, emptied at sign-out, and now says so. The daily copy in §6 is written by a timer inside the admin tool whenever it is running, not “the first time the developer opens it”. And “the rule has never deleted anything” stops being true on 20 September 2026, when the oldest daily copies begin to age out on their own, so it is dated rather than left to go stale.

Also today, from the same review: account deletion now asks the server directly for your shared skies and stops if it cannot, rather than treating a list it could not read as an empty one; a sky sent to one person is deleted with the photograph and with the account (§11’s contract gained the store).

Nothing else moved. The effective date stays 15 September 2026.

Entry 16.24 said every sentence now agrees with §2.2, and that was wrong. Entries are never edited, so this one corrects it. Four sentences still said the coordinate of a capture stays on your phone and nowhere else: the summary bullet at the top of the full text, the §2 table row for where a photograph was captured, the first bullet of §10, and short §10. Each now says what §2.2 and §3.2 say: since 15 September 2026 the coordinate is also in the private copy of your journal that only your account can read, and a sky that stays in your journal is published nowhere. The §13.1 precise-geolocation row now lists that backup record too, and §10 is now titled “What stays with you”, because its first bullet no longer belongs under “nowhere else”.

Nothing about what the app does changed. The backup has carried the coordinate since 15 September. The text is catching up with it.

A line-by-line walk from the code outward, rather than from the policy inward. Most of this document held up. Four sentences did not, and one of them was not a sentence at all.

A broken sentence in short §3. It read “A trusted spot tag is.” and stopped there. It is the orphaned half of a contrast whose first part was replaced on 18 September. It now says what the full text has said all along: the trusted spot tag is in the journal backup, so a restored photograph comes back wearing the spot’s public name.

Deleting your account also withdraws the skies you sent to one person, and §11 did not say so. The sweep has a step for it, between shared skies and the retry, and a failure there stops the whole deletion the same way a shared sky does. Short §11 and full §11 step 2 now name it. No step was renumbered, on purpose: the numbers in that list are cited from this page and are a contract.

The verification counter keeps a lifetime total. §1 said the daily count was “the only thing this step stores”. It also keeps how many have ever been sent to that account, and that one is never reset. Both are now named. Nothing else about that record changed: still no address, no name, no link, still unreadable by any copy of the app, and still out of the delete button’s reach.

The Lock Screen card record holds two more fields than §2 listed. A second token, for ending the one card that is running, and which window that token belongs to. The server’s own notes also include which window the end push is for. All three are deleted with the record when the card switch goes off, so no retention sentence changes.

Nothing in the app changed for any of this. These are four descriptions being brought back into line with behaviour that was already there.

One change, and it is a new value written to our own server.

§2 describes the record Skysta keeps for the Lock Screen card field by field, and it said that record carried two housekeeping values. It carries three now. The third is one word, written by your phone, saying what it did with the last card it was asked about: that it kept it, that it ended a second copy of the same card, or that it ended a card it had not started itself.

Why it is there. Some cards were not ending when the window closed, and there was no way to tell whether the phone had answered at all. This word is the phone answering.

What it is not. It says nothing about the sky, nothing about your Sky Score and nothing about anything you photographed. It is one of three words and it is deleted with the rest of the record when you turn Show the card off or delete your account.

No other row of §2 moved, and nothing new leaves your phone because of it.

The composer no longer stops you with a sheet the first time you share a sky with a pin. It used to: a sheet came up after you had already turned Show on the map on and tapped Share. The warning is on the switch now, where the choice is made. While the pin is on, the line under the switch reads “Anyone on Skysta can see your exact spot.” With the pin off there is no line under it, unless Precise Location is off in iOS, when one line says that turning the switch on asks for it first, or that there is no exact pin to drop. A question mark beside Show on the map opens a short explanation you can read at any time, and it changes nothing and shares nothing. It says what other people see with the pin on and with it off, and when the town goes it says the map shows the town as an area, for example “No pin. The map shows Orem, UT as an area.” It also says where the switch starts for your next sky, and where in Settings to change that and the town. With the pin on, the Share button reads Share with the pin. §4.1 and §4.2 now describe that screen, and §4.2 quotes the words it actually shows. The town a sky will carry used to be written on the page itself. It is in that explanation now and nowhere else on the page, so §2 of the policy and §2.1 of the full text say where to find it.

Three things are corrected to match the code. §4 said the town’s name is worked out from the ~5.5 km cell. It is worked out from a different, finer point, which is only ever asked about and never published, as §2.1 has said since 13 September 2026. The Apple reverse geocoding row of the table in §9 said the review page sends a point rounded to about 5.5 km. It is about 1.1 km, the same point. And §4.1 listed an audience picker, which the composer no longer has.

Nothing new is collected, and nothing new leaves your phone. The pin is still the exact spot, it still goes only when you turn it on, and it still starts off for your next sky unless you set it to start on in Settings.

The Lock Screen card now leaves about an hour after the light ends even when Skysta started it itself, as long as your phone could reach our server while the card was up. Until now only a card our server started had a token our server could end it with, so a card the app raised itself, or one iOS 26 started from the app’s own plan, stayed until the app ran again or iOS took it. To end every card, your phone now gives our server, for each card that is up or waiting to start, at most five at once, a token for ending that card and the times of its window, and for a card about a spot you planned, the spot’s name and, when the card’s times are shown in a time zone other than your phone’s own, that time zone. Each of those is deleted when its card is ended, or when the server gives up on it. The record also carries a new mark saying your copy of the app arranges the end of its own cards. No forecast or Sky Score is involved, and the end push carries the card’s times and, when the card has them, the spot’s name and the time zone. §2, §6, §9, §10 and §15 say so.

The card’s last hour can show a few skies from the feed. Up to five small square copies of shared skies are kept on your phone for the card, made fresh so that no location or camera details come with them. They are never backed up and never sent anywhere, they are never your own skies, a private sky, or anything from someone you blocked, and you can turn them off at Settings → Reminders → Lock Screen → Show people’s skies. To choose them the app reads the newest shared skies and your block list from our server, the same reads the feed makes, including when iOS wakes the app for a moment as a card starts. §6 and §10.

A Lock Screen card that starts with Skysta closed can now get its Sky Score as it starts. When iOS wakes Skysta for a moment as the card starts, it asks Apple WeatherKit and Open-Meteo for that window’s forecast at your watched place, as it does when it is open, works the score out on your phone, and puts it on the card once. Nothing new is sent to our server. iOS does this for cards our server starts; where it also does it for the cards your phone schedules itself on iOS 26, the same happens for them, so we no longer say that nothing is sent when one of them starts. §2, §9 and §10.

Four older sentences are corrected.

• The server reads the card record every five minutes, not every ten (§9).
• §10 said no morning card is scheduled while sunrise reminders are off. Since 19 September 2026 a morning card is planned whenever the card switch is on, whatever the Sunrise switch says; the card switch, quiet hours and your chosen days are what keep one away. The same sentence said sunrise reminders start off unless you chose sunrises when you set the app up. Setting the app up no longer asks which light you follow, and saying yes to reminders there turns on both.
• The website’s forecast server stores nothing, as before, but the policy said more than that: that nothing about your request is kept and that there is no log of who asked about where. The requests pass through Google’s platform, whose ordinary request logs keep each one, with the place or rounded position in it and your network address, for up to 30 days. §2, §13 and §15.1 now say so, and the short policy’s §2 now says the same of the network address on a spot suggested on the website, which the full text’s §15.1 already said.
• §15.1 said the home page draws the map of spots. It shows a picture of the map, served from the site itself; the live map is on the spots pages and the page for suggesting a spot.

One row of §9 is brought up to date. The Google Maps row now says where the destination comes from: the spot’s name with Google’s own id for the place when we have one, or the spot’s name, town and state from Skysta’s own list, or its coordinate. Nothing about you goes in the link, as before.

Nothing else that leaves your phone changed.

We read this policy against the app, the website and the tools behind them, sentence by sentence, and some had stopped being true. Entries are never edited, so this one says what changed. Almost all of it is the text catching up with what the code already did. Where something changed and this page never said so, it says so now, with its date.

Two changes this page should have recorded when they happened.

• No released version could ever send a sky to one person. Entry 16.23 added a way to send a private sky from the journal to exactly one person on 15 September 2026. It was taken out of the app the next day, 16 September, before any version reached anybody. Short §5 now says Skysta has no way to send a sky privately to one person, and full §5.3 keeps one paragraph of history, because the server half still exists: if such a sky was ever made in testing, only its sender and the one account that opened its link can see it, and deleting the photograph or the account deletes it. Entries 16.23 and 16.24 stay as they were written; this corrects them.
• Shared skies have been uploaded at 2048 pixels since 21 September 2026, not 3072. They are smaller and stripped of hidden data the same way. Skies shared before that stay at 3072. §3 and §3.2.

The card your own sky sends. Since 16 September 2026 it is the photograph, your name and profile picture, and whether it was a sunrise or a sunset. It carries no Sky Score, no light and no spot name, and the Sky Score was never public on a sky, though this policy said it was. The light travels as one line in the message, beside the sky’s link. Only a sky you have shared can be sent, and the button is called Send this sky. §5 and §5.1.

What else is corrected.

• Apple accounts see the name screen. Since 28 August 2026 the app does not take your name from Apple; if you let Apple share it, it is filled in as a suggestion you can change. §1 and §1.2.
• A sky we take down is kept, privately, so a wrong decision can be undone: its record in a store no copy of the app can read, and its picture, unless we choose to destroy it, at its old storage address, where no screen or Skysta link shows it but anyone already holding its address could still open it. The Delete account button cannot reach either; our own erasure can. A takedown’s line in our moderation log also keeps the post’s identifier, our reason, whether the picture was kept and whether the account was switched off. §6, §7, §9 and §11.
• The website, as it has worked until now. If you had already let skystaapp.com use your location, the home page read it by itself when it opened, without a tap, and the spots pages used it to sort spots by distance. The suggest page’s Use where I am put the pin exactly where you were, not rounded. Letters typed into a place search went through our server to Open-Meteo as you typed. Our server keeps answers in memory for up to a day, not a few minutes, and counts each network address’s requests for a minute to slow abuse. §2 and §15.1 said only a press reads your location; they now say what the website does.
• Email. If our verification email cannot be sent, Firebase sends a plainer one. A password reset email comes from Firebase. The verification counter also keeps when the last email went, and Resend keeps its own record of a message. We use your email address to tell you if we act on a report you filed or take down something you shared. §1, §1.1 and §9.
• Location. Setup asks for about a kilometre; after that the app asks for about a hundred metres. §2 now also lists Apple’s geocoder naming your watched place from your position, Apple Maps starting a drive time from it, a trusted spot more than 15 km from your watched place going to Apple WeatherKit with three points along its sun path and to Open-Meteo rounded, a spot you suggest going to Apple’s geocoder for its town, up to four more rounded points when the review page’s first one names no town, and the short alert on the Lock Screen card’s start push.
• The content check also runs when Communication Safety is on, and on your own phone before another person’s sky is saved for your Lock Screen card. §3 and §3.3.
• What your phone keeps that §10 did not list: a week of Sky Scores, which shared skies you have seen, what you reported, the town under other people’s pins, which months of your journal it has already shown back to you, and a scrambled note of which accounts finished setup on this phone. Signing out leaves four small notes, not three. §2.3, §10 and §11.2.
• What deletion cannot reach. The lists now include a sky we took down, our daily copies and, if you were the one person a sky was sent to, your account identifier on that sky. Every list says the same number: two things cannot be removed even by hand, our record of what we did and a report somebody else filed. The seven-day and one-hour windows end on their own, and app counts carry no account identifier, so yours cannot be found. §11, §11.1 and §13.
• Resend never sees your network address. Our server talks to it, not your phone. §13 and §13.2.
• The daily copies on the developer’s Mac. The tool runs all the time and checks every half hour, rather than when it is opened, and the short policy now names the copies it keeps past thirty days. §6 and §9.
• With app counts on, Google’s library sends Apple’s identifier for vendor, which is the same for every app one developer makes on your phone. Skysta is our only app. §8 and §15.
• A copy of 942 app count events, sent between 21 and 23 August 2026, was downloaded to the developer’s Mac on 26 August 2026 and is kept there. It carries Google’s install identifier, the app’s version, the phone family, session counts and a rough time of day, and no account identifier. §6, §8 and §9.
• Microsoft hosts the hello@skystaapp.com mailbox, so it holds what you write to us. §9, §13 and §13.2.
• The Privacy Policy link in Settings → About opens this page on skystaapp.com. An app update does not carry the text. §16, and the top of this page.
• Smaller fixes. The online-status record goes at step 10 of §11, not step 9. A shared picture also carries a note telling browsers they may keep a copy. §15 drops its library counts, files the Lock Screen card’s times under other data as the App Store label does, and says that Google’s libraries declare other diagnostic data of their own. §13 no longer calls Skysta “before launch”. §15 says what the website asks anyone else for.
• The full text no longer opens with its own summary. The short policy is the short version, and the website links the two. The full text’s first lines also said the short policy says the same things in a tenth of the words; it takes a fraction of them, about a fifth, so they now say that.
• The tops of the policy no longer say every sentence was checked line by line; the full text says when it was last checked. They also say who the website is for: the app is offered only in the United States, and the website can be read from anywhere.

Nothing new is collected, and nothing new leaves your phone.

The website was rebuilt today, and it now reads where you are only when you press a button. Until today the home page and the spots pages could read your location by themselves when your browser already allowed it, as entry 16.30 says. They do not any more. On the home page, Show my sky and Use where I am are the only things that ask. On the spots pages Near me asks, and on a spot’s page How far is it? asks. Each rounds the position to about 5.5 km. Near me and How far is it? keep it in the page and send it to nobody, though the map then shows your area, so the map pieces it asks for show that area too. On the suggest page, the button that puts the pin exactly where you stand is now called Pin where I’m standing, so its name says what it does. §2 and §15.1.

The home page’s twelve cities are shown one at a time. Once a city has been on screen for a moment, the page asks our server for that one city’s forecast, the same request as for a place you pick, which this policy already covered: the place goes to our server, and nothing about you goes with it. The page no longer asks our server for all twelve at once.

The sky at the top of the home page, before you press anything, follows your time zone. It used to run a fixed day from six in the morning to six at night; now it shows the real sun for about this time of day in your device’s time zone. Your browser works that out from its own clock. It reads no position and sends nothing. §15.1.

Nothing else that leaves your browser changed. No cookies, no analytics, no storage of any kind, and no new host. The map on the spots pages still comes from OpenFreeMap, drawn in new colours.

A shared sky can carry a colour preview. From version 1.0 (16) of the app, a sky you share also carries sixteen colours: the average of each square of a 4 by 4 grid over the photograph. Your phone works them out from the picture you publish, so they say nothing the picture does not, and the feed shows them while the picture itself downloads. Like the rest of the record, every signed-in account can read them. Skies shared before, and the rare share where the phone cannot work it out, carry none. §4.

The app downloads pictures with your own sign-in. From version 1.0 (16), the app no longer asks Firebase Storage for a photograph’s download link to show it to you; it downloads the picture with your own sign-in instead. The link itself still exists, still works for anyone who has it, and any signed-in account can still ask for it, so a shared sky is as public as it was. §5.

What the download cache holds, said exactly. It is still up to about 200 MB of shared skies, emptied when you sign out and when you delete your account. It now also says which ones: the skies the app has shown you, the few next to them that you are about to reach, so they are ready before you get there, and, when the Lock Screen card shows other people’s skies, the ones it picks from, up to eight at a time. Before you open the feed, getting it ready downloads at most two on mobile data and none in Low Data Mode; the Lock Screen card’s picks are downloaded when it needs them, on any connection. Blocking someone removes their skies from it. §10 and §11.

The website’s home page. It no longer has twelve cities on screen. Its Sky Score asks our server for a city’s forecast only when you press that city’s name in the short list under it, or open a link that names a city, one city at a time, and again every ten minutes while the page stays open on it. Before any press, it draws the sky for about this time of day in your device’s time zone beside an example city’s light times, worked out in your browser; that reads no position and sends nothing. Show my sky and Use where I am are still the only things on it that ask where you are. §15.1.

The website’s maps can show aerial photographs. Each map of spots now has a Map and Satellite switch. Satellite swaps the map’s background for aerial photographs from the U.S. Geological Survey’s The National Map (basemap.nationalmap.gov), a public service of the United States government, and is the one new place your browser may ask for anything: only after you press Satellite on that map, and then, like any map, each request carries your network address, the map area you are looking at, and the name of our site. It sets no cookies, and the choice is stored nowhere. The small picture beside each spot is now a photograph of that place’s ground, made ahead of time from the same public imagery (EOX’s Sentinel-2 cloudless 2016 for Alaska) and kept on our own site, so showing it asks nobody else for anything. §2, §9, §13 and §15.1.

Sentences put right. We read this policy against build 1.0 (16) of the app, the website and our server again, sentence by sentence, and these had stopped being true. Entries are never edited, so this one says what changed.

• A pinned sky’s page names the place under the pin, on every phone, the author’s own included. Your exact position is still never sent to name the town your sky carries; but with Show on the map on, the pin is public, and any phone that opens the sky asks Apple to name the place under it, even with Name the town off. §2, §2.1, §2.4, §9 and §10.
• Onboarding tells you that shared skies carry the town; it does not ask. The switch is at Settings, Location & units, Name the town. §2.1.
• The empty caption field is sent because the server rule once required it; the rule no longer does. §4.
• Taking a sky down. From the feed or your public page the menu has Remove the place and Make private, which keeps the photograph in your journal; Delete is on the menu when you open the sky from your journal. §7.
• The Lock Screen card. A person you block is never chosen for it again; a sky you report is not chosen again while you stay signed in on that phone. If a sign-out cannot reach our server, deleting the card’s record is tried again the next time you sign in to that account there, and until it succeeds your account identifier stays on the phone. §2, §6, §10 and §11.
• Deleting an Apple account. Inside two minutes of signing in, the app still sends you through the Apple sheet if Skysta has been closed and opened since, so it can disconnect Sign in with Apple. §11.
• What is required. An account, a name and a rough position; the name screen has no skip. §13.
• A shared sky stays until you take it down; nothing in Skysta deletes it on a timer. §12.
• The download cache holds about 200 MB; it can pass that for a moment before it trims. §10.
• Your phone’s own copies. The database’s own cache stays off; what the app does keep from other people’s skies is listed in §10. §14. Many, not all, of the libraries in the app carry their own privacy manifest. §15.
• The website. The map’s pieces and label fonts come from the map hosts, not the site. Any place on the home page’s Sky Score is read again every ten minutes while the page stays open on it. After Near me, the small pictures of the nearest spots also show your area to our own site, and with Satellite on, the map’s pieces come from the U.S. Geological Survey. The suggest form also sends the moment the page was opened, and a field only a script fills in, which our server checks once and does not keep. §2 and §15.1.

Nothing else that leaves your phone or your browser changed. No cookies and no analytics.

This policy now says what the App Store label says, and why. The label lists other diagnostic data as linked to you, and it now lists coarse location for analytics as well as app functionality. Both were already true; the policy said diagnostics were never linked. Now it says that crash reports and app counts are never linked to your account, and that a few technical values Skysta keeps are tied to it: the app version on your online record, on the Lock Screen card’s record and on a feedback note, the outcome of your last Lock Screen card, and your account identifier in the verification email step’s logs. With app counts on, Google works out a rough region from your network address, as §8 already said. §8 and §15.

Three technical lines, said in full.

• The verification email step’s logs keep your account identifier as well as a masked address, and never the link. §1.1 and §9.
• The header Google’s libraries add to every sign-in and database request also names the phone’s model and iOS version, the versions of the tools the app was built with, and whether it came from the App Store. §8.
• With crash reports on, Crashlytics’ companion library also sends a small record each time the app opens: an identifier it makes for this installation, a session number, and the phone’s model and iOS version. It stops when crash reports are off. §8.

Nothing new is collected. These lines describe what already happened.

The home page lists cities around the world now, in place of the Sky Score section it had. For sixteen cities around the world it shows the local time, the next sunrise or sunset there and whether its light is on now, all worked out in your browser from its own clock and a list built into the page. On a phone it first shows the eight whose clocks are nearest your device’s own time zone, worked out from your browser’s clock, and nothing about that leaves your browser. Showing the list reads no position, sends nothing and shows no Sky Score. The example city, and the sky that section drew for about this time of day in your device’s time zone, are gone with it. §2 and §15.1.

A city’s Sky Score is read only when you press that city, or open a link that names it, one city at a time, through the same request as a place you name: the city goes to our server, and nothing about you goes with it. A link to the home page that names a city opens that one city the same way; for a city that is not in the list, the page first asks our own site for its list of cities. While a place’s Sky Score stays open on the home page, the page asks again every ten minutes, and pressing Another place stops that. §15.1.

Show my sky and Use where I am are still the only things on the home page that ask where you are, and they still round your position to about 5.5 km before it leaves your browser. §2 and §15.1.

What the home page does after Show my sky or Use where I am, said in full. Once your browser has your rounded position, the home page also lists the three spots nearest it, and your browser asks our own site for those spots’ small pictures, so those requests show your area too, as they do after Near me on the spots pages. This policy now says so for the home page as well. §2 and §15.1.

Nothing else that leaves your browser changed. No cookies, no analytics, no storage of any kind, and no new host.

This one lets one person reach another, so read it. From the version of the app that brings them, you can send an appreciation: a private thank-you for somebody else’s shared sky. Open their sky and tap the heart in its bottom corner, and tap it again to take it back. New section 5.4 of the full text says everything about it, and §1, §5, §6, §7, §9, §10, §11, §12, §13, §14 and §15 of both texts now carry it.

What is held, and who can see it. Appreciations you send and receive are held under your account: each is one record, written by our server, holding the sky, its author, the sender, the sender’s display name as it stood then, whether the sky was a sunrise or a sunset, and when. Only the sender and the sky’s author can see it. Appreciating a sky shows your display name and profile picture to that sky’s author, and only to them: the author of a sky you appreciate becomes a recipient of your name and picture. Nobody but the author ever sees how many people appreciated a sky, and there is no total. Nothing is written on the sky itself, so what a shared sky publishes (§4) has not changed.

How long it lasts. An appreciation lasts until it is taken back, the author removes it from their list, the sky is deleted, or either account is deleted. Deleting your account removes the appreciations you sent and received and your phones’ notification tokens. The limits record our server keeps for appreciations, described below, is out of the app’s reach like the verification email counter, so the Delete account button does not remove it; our own erasure of an account does, and so does asking. A notification already delivered stays on the phone it reached, and taking an appreciation back cannot recall it.

The notice, and who receives what for it. When somebody appreciates your sky, our server sends you a notification, such as “Sam appreciated your sunset.” It carries no score, no place and no coordinate, and it has no sound and no badge. For that, your phone’s notification token is stored under your account while Settings → Reminders → From people → Appreciations is on and notifications are allowed for Skysta, and it is removed when you turn that switch off, sign out, or delete your account. A sign-out that cannot reach our server leaves it in place until somebody next signs in to Skysta on that phone, which takes it off your account, or Apple tells us it no longer works. Your phone keeps two small notes of its own: when you last opened your Activity list, and the token it last gave our server with the account identifier that record names. Google Firebase (Cloud Functions and Firestore) runs the job that records an appreciation and sends its notice. Apple’s push service receives the token and the notice’s words, which include the sender’s display name. To keep anybody from being told twice or too often, our server also keeps counts for daily and hourly limits and a note of which notices have gone, in a record filed under an account identifier that no copy of the app can read.

Blocking. If you have blocked somebody, you are never notified about their appreciations and they are never shown to you. Each one is still recorded, so the person you blocked cannot tell.

The compass on a spot’s page. The dial on a trusted spot’s page now turns with your phone. While the dial is on screen it reads which way your phone is pointing, on the phone only. That direction is never stored and never sent, and reading it asks for no permission. §2 and §10.

What did not change. Nothing new is published on a shared sky, and there are still no public likes, no counts anyone else can see, no comments and no messages. The feed’s order does not read appreciations. No new analytics event. The effective date at the top moves to 17 October 2026.

A shared sky that names its town but has no pin now shows the photographer’s time. It used to show yours: a sunrise taken at 7:21 AM in Cyprus read 10:21 PM the evening before on a phone in Utah. Now, when you open one of those skies full screen, your phone asks Apple’s reverse geocoder for the time zone of the rough cell, about 5.5 km across, that the sky already carries. Only the time zone is used; the name Apple gives back is never shown, because the town on the sky is the one its author published. The answer is remembered while Skysta stays open, like the town under a pin. §2, §2.4, §4 and §9.

The light, too. The same page now says which part of the light such a sky caught, such as how long after sunrise it was taken. Your phone works that out from the same cell and sends nothing for it.

What did not change. A sky that names no town sends nothing from your phone and keeps your own clock. The feed never asks about a cell. A sky tagged at a trusted spot whose time zone Skysta already lists uses that one and asks nothing. Nothing new is published on a shared sky, and nothing new reaches our own server.

The home page’s map is now the live one. The spots part of the home page used to show a picture of the map, served from our own site. It now shows the same live map as the spots pages. It starts as you scroll near it and first shows the whole country, so the map pieces your browser then asks OpenFreeMap for (or OpenStreetMap, when the newer map cannot be drawn) say nothing about where you are. As you pan and zoom it asks for the pieces on your screen, as the spots pages always have, and Satellite asks the U.S. Geological Survey only after you press it. If the map cannot be drawn, the picture stays. §2 and §15.1.

Near me is on the home page too. It works as it does on the spots pages. It asks your browser where you are only when you press it, or uses the position Show my sky or Use where I am already has, rounds it to about 5.5 km, keeps it in the page and sends it nowhere. The page works out the nearest spots itself, lists three and moves the map to them, so the map pieces your browser then asks for, and the small pictures of those spots it asks our own site for, show your area. Near me never asks for a Sky Score. §2 and §15.1.

The list of cities. It now first shows the eight cities whose clocks are nearest your device’s time zone on every screen, not only on a phone, and offers one city, with a button to see its Sky Score: of the cities whose light is on now, the one whose clock is nearest your device’s time zone, or, when the light is on in none of them, the next one to get it. All of that is worked out in your browser from its clock, and nothing is sent until you press. §15.1.

What did not change. Show my sky and Use where I am work as before; after them the home page’s map only marks your rough position and does not move. Nothing on the site reads your position without a press, nothing is stored, and the site still sets no cookies and runs no analytics.

The list of cities. Entry 16.37 said the home page first shows the eight cities whose clocks are nearest your device’s time zone. That holds on a screen narrower than 1024 pixels, with a button for the rest; on a wider screen all sixteen show. The one city the page offers first is now a city whose light is on and whose clock is within three hours of your device’s time zone, the nearest of those, or, when there is none, the next of your eight nearest cities to get its light. All of that is still worked out in your browser from its clock, and nothing is read or sent until you press. §15.1.

A link to a place. A link to the home page can now name a place by its coordinate, rounded to about 5.5 km. The page writes one into the address bar when you press a city or type a place, and Copy a link on the card makes one for the place on the card, your own rounded place included, on that press only; your own place never reaches the address bar by itself. Opening such a link reads that place’s Sky Score the way a city link does, sending that coordinate, never yours, to our server for the forecast. The link sits in the part of a web address a browser never sends to any server, and the site still stores nothing. §2 and §15.1.

A search of the spots. The home page has a Find a spot search. It matches the spots by name, town or state in your browser, and nothing you type leaves it unless you follow the “See all” link to the spots page, which carries your words in its address. The page asks our own site for the list of spots, their picture list and the small pictures of up to six matches, so those requests show what you searched, and the home page’s map moves to the matching spots, so the map pieces it then asks for show that area, never where you are. The map also starts when you touch it, point at it or press Near me, as well as when you scroll near it. §2 and §15.1.

What did not change. Show my sky, Use where I am and Near me are still the only things on the site that ask where you are, and only on a press. Nothing is stored, no cookies are set, and no analytics run.

A page for each city. The home page’s list of cities is now a set of names: each city’s name and country, and nothing worked out about it, so nothing is read or sent while you look at it. Each city has its own page, at skystaapp.com/sky, with today’s times worked out in your browser, the year’s sunrise and sunset times, and a map of the checked spots near it. Pressing a city opens its page and reads that one city’s Sky Score, sending that city to our server for its forecast, as pressing a city did before. A city’s page opened any other way, from a search engine or a link without the press, reads nothing until you press its button. It reads once; Read again asks again. (The home page’s old reading asked again every ten minutes while it stayed open; nothing does that now.) §2 and §15.1.

A search for any town. The home page, the list of cities and a place’s page have a search. The cities Skysta has pages for are matched in your browser; from the second letter, what you type also goes through our server to Open-Meteo to find towns, as the old search on the home page did. Picking one opens that place’s page, with the place in the part of the address a browser never sends anywhere. §2 and §15.1.

Your own sky moved to its own page. Show my sky and Use where I am now open a page for your own sky, which asks your browser for your position once, on that press. The rounded position (about 5.5 km) is used as before, for the forecast and the town’s name, and is never written into the page’s address. That page also lists the checked spots within about 80 km and shows them on its map, so the spot list, their small pictures and the map pieces your browser asks for show your area too. §2 and §15.1.

Satellite first on a city’s page. On the page for a city, or a place, in the lower 48 states, the map opens on the Satellite look, so your browser asks the U.S. Geological Survey for the aerial photographs of that area as the page opens. Everywhere else, and on every other map on the site, nothing is asked of it until you press Satellite. The choice is still stored nowhere. §2, §9 and §15.1.

What did not change. Nothing is stored, no cookies are set, no analytics run and no third-party scripts load. Show my sky, Use where I am, Near me, How far is it? and Pin where I’m standing are still the only things on the site that ask where you are, and only on a press.