Back to DarkSkyTools.com

Privacy Policy

Last updated: 23 July 2026

DarkSkyTools — Privacy Policy

Effective date: 13 July 2026 Last updated: 23 July 2026 Publisher: Nustellar Pty Ltd (ACN / ABN on file), a company incorporated in Australia ("Nustellar", "we", "us", "our"). Application: DarkSkyTools mobile and web application and related services at darkskytools.com (the "Service"). Contact: admin@darkskytools.com

Nustellar Pty Ltd operates DarkSkyTools. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how we protect it, and the rights you have over it. It is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"), and — where applicable to users outside Australia — with the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA").

If you do not agree with this Privacy Policy, please do not use the Service.

1. Who we are — the data controller

For the purposes of the Privacy Act 1988 (Cth), the GDPR, the UK GDPR, and the CCPA/CPRA, the data controller (in Australian terms, the "APP entity") for personal information collected through the Service is:

We do not have a formally appointed EU or UK Article 27 representative at this time; you may reach us directly at the email above for any GDPR or UK GDPR enquiry.

2. What personal information we collect

We only collect what we need to run the Service. The categories are:

2.1 Information you give us directly

  • Account information — email address, display name, password (stored hashed), country, and preferred units.
  • Payment information — you enter card and billing details directly with Stripe, Inc. or, for in-app purchases, with Apple or Google. We do not see or store your full card number, CVV, or bank details; we only receive a payment token, last-four digits, card brand, and payment status.
  • Content you create — imaging sessions, target lists, photographs uploaded, session notes, plans, equipment profiles and preferences ("Your Content"). See Section 5 of our Terms and Conditions for how ownership works.
  • Support correspondence — the content of any email or in-app message you send us.

2.2 Information we collect automatically

  • Device and technical data — device model, operating system version, app version, language, time zone, IP address (used for approximate location and abuse prevention), and diagnostic identifiers.
  • Usage analytics — anonymised, aggregated events such as features opened, screen views, session duration, and crash reports. This data is not tied to your identity.
  • Location data — only when you enable it in-app and grant the operating-system permission. Location is used to plot your position on sky charts, evaluate light pollution at your site, and fetch local weather. See Section 3.

2.3 Information from third parties

  • Payment status from Stripe, Apple, and Google (subscription active, cancelled, refunded).
  • App store attribution (aggregate only) from Apple App Store Connect and Google Play Console.
  • Error monitoring metadata from our error-reporting sub-processor.

2.4 Sensitive information

We do not knowingly collect sensitive information as defined by the Privacy Act 1988 (Cth) — such as health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or biometric identifiers. If biometric authentication is used to unlock the app on your device, the biometric data stays on your device and is never transmitted to us.

3. How we use your location and sensors

Some features require access to native device capabilities. We only ask for the permission at the point when the feature is used, and you can revoke each permission at any time in your device settings.

| Sensor / permission | Why we ask | What we store | | --- | --- | --- | | Location (GPS) | Plot your position on the sky map, calculate rise/set times, fetch local weather, and show light-pollution readings for your site. | Only what you explicitly save to a session or site. Live location is not transmitted to our servers. | | Camera | Capture polar-alignment references, focus targets, and session photos. | Only the photos you save. Live camera stream is not transmitted. | | Motion / gyroscope / compass | Enable AR sky pointing and telescope orientation aids. | Not stored. Processed on device only. | | Notifications | Send you optional alerts about clear skies, ISS passes, and subscription events. | Notification token only, so we can deliver alerts. | | Biometric unlock | Optionally protect your account on your device. | The biometric template stays on your device; we never receive it. |

You can withdraw any of these permissions without losing access to the rest of the Service, although the associated feature will be disabled.

4. Why we use your information — purposes and legal bases

For each purpose we identify (a) the primary APP under Australian law and (b) the GDPR legal basis where the user is in the EU/UK.

| Purpose | Australian Privacy Principle (APP) | GDPR legal basis | | --- | --- | --- | | Provide the Service — accounts, sync, session storage, calculations | APP 3, APP 6 — collection and use for the primary purpose | Contract — Art. 6(1)(b) | | Process Subscriptions and prevent payment fraud | APP 6 | Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c) for tax and record-keeping | | Provide customer support | APP 6 | Contract — Art. 6(1)(b); Legitimate interest — Art. 6(1)(f) | | Send transactional emails (receipts, security alerts, policy updates) | APP 6 | Contract — Art. 6(1)(b) | | Send optional marketing emails and clear-sky alerts | APP 7 — direct marketing with opt-out | Consent — Art. 6(1)(a); revocable at any time | | Improve the Service (anonymised analytics, crash triage) | APP 6 — use for a directly related secondary purpose | Legitimate interest — Art. 6(1)(f); balanced against your rights | | Comply with legal obligations (subpoenas, tax, consumer law) | APP 6 | Legal obligation — Art. 6(1)(c) | | Protect the Service against abuse and security threats | APP 6 | Legitimate interest — Art. 6(1)(f) |

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you, and we do not use Your Content to train third-party AI models.

5. We do not sell your data

We do not sell personal information for money or other valuable consideration, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. We do not disclose Your Content to advertisers, data brokers, or unrelated third parties. If our position on selling data ever changes, we will update this Policy, notify users in advance, and honour opt-out requests before making any change.

6. Who we share information with — sub-processors and disclosure

We share personal information only with the categories of recipient below, and only to the extent needed to run the Service. Each sub-processor operates under a written data processing agreement that requires confidentiality, security, and use limited to our instructions.

| Sub-processor | Purpose | Location | Data types | | --- | --- | --- | --- | | Base44 | Cloud storage, hosting, backend functions | United States and other regions | Account data, Your Content | | Stripe, Inc. | Payment processing for web billing | United States, Ireland | Billing address, payment token, subscription status | | Apple Inc. | In-app purchases and subscriptions on iOS | United States | Purchase receipts, transaction IDs | | Google LLC | In-app purchases and subscriptions on Android | United States | Purchase receipts, transaction IDs | | RevenueCat, Inc. | Cross-platform subscription management and entitlement checks | United States | Anonymised user ID, subscription status, receipt | | OpenWeatherMap | Weather forecasts | United Kingdom, EU | Approximate coordinates (rounded) at the time of a forecast request | | Stadia Maps | Map tiles for site selection | Iceland, EU | Tile requests keyed by coordinate; no account identifier | | Despia | Native mobile wrapping for iOS and Android | United States | App diagnostics only | | Transactional email provider (SendGrid or equivalent) | Delivery of receipts and account emails | United States | Email address, message content | | Crash-reporting provider (Sentry or equivalent) | Diagnose crashes and errors | United States, EU | Device model, OS version, stack trace, redacted logs |

We may also disclose information:

  • To professional advisers — lawyers, auditors, and accountants — under professional confidentiality obligations, where reasonably necessary.
  • In a corporate transaction — if Nustellar merges, is acquired, or transfers assets, personal information may be transferred to the acquirer, subject to your rights under this Policy and applicable law.
  • To comply with law — where required by a valid subpoena, court order, or lawful request from an authorised government authority in Australia or, where legally permitted, elsewhere.
  • To protect rights and safety — of Nustellar, our users, or the public, including to detect, investigate, or prevent fraud, security threats, or abuse.

An up-to-date list of sub-processors is available on request. We will notify Subscribers in advance of any material change to this list.

SIMBAD astronomical database (CDS Strasbourg)

When you use the extended target search, the search term you type (an astronomical object name or catalogue identifier) is sent directly from your device to the SIMBAD astronomical database operated by the Centre de Données astronomiques de Strasbourg (CDS), France, in order to return matching objects. No account information, name, email address or precise location is included in these queries; as with any web request, CDS may receive your IP address and standard request metadata. SIMBAD queries are made only when you actively choose the SIMBAD search option. Attribution: Data: SIMBAD, CDS Strasbourg.

7. International data transfers

Because our sub-processors are located outside Australia — principally in the United States, the European Economic Area, the United Kingdom, and Iceland — personal information collected in Australia will be transferred to and processed in those locations.

Consistent with APP 8, before we disclose personal information overseas we take reasonable steps to ensure the overseas recipient is bound by obligations substantially similar to those under the Australian Privacy Principles, or we rely on an exception under APP 8.2 (for example, your consent to the disclosure after being informed of the consequences).

For transfers of personal information from the European Economic Area or the United Kingdom to countries outside their adequacy regime, we rely on the European Commission Standard Contractual Clauses (2021) and, for UK transfers, the UK International Data Transfer Addendum. Copies of the safeguards used are available on request to admin@darkskytools.com.

8. How long we keep your information — retention

We keep personal information only for as long as necessary for the purposes described in Section 4, and then delete or de-identify it.

| Data category | Retention period | | --- | --- | | Account and Your Content — active accounts | For the life of your account. | | Account and Your Content — after account deletion | Purged from live systems within 30 days of your deletion request. Residual copies may persist in encrypted backups for up to a further 90 days before being purged in the ordinary course of backup rotation. | | Payment and tax records | 7 years from the transaction date, as required by Australian tax law. | | Support correspondence | Up to 3 years after the ticket is closed. | | Analytics and crash data (anonymised) | Up to 26 months. | | Marketing consent records | Until you opt out, plus a further 12 months for audit purposes. | | Server access logs | Up to 90 days, then deleted or aggregated. |

Where a longer retention period is required by law (for example, in response to a preservation order), we will retain the specific data at issue for the required period only.

9. How we protect your information — security

We take reasonable steps under APP 11 to protect personal information from misuse, loss, unauthorised access, modification, and disclosure. Our controls include:

  • Encryption in transit — HTTPS/TLS 1.2+ on all connections between the app, Base44, Stripe, and third-party APIs.
  • Encryption at rest — Base44 encrypts stored data; passwords are stored as salted hashes (never in plain text).
  • Access controls — least-privilege access for staff and contractors; no shared credentials; access to production data logged.
  • Sub-processor diligence — we choose reputable providers and enter into written data protection agreements.
  • Payments — handled by Stripe, Apple, and Google, all PCI-DSS compliant. We do not store card numbers.
  • Backups — encrypted, rotated regularly, and tested.
  • Incident response — if a data breach occurs that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals as required by the Notifiable Data Breaches scheme, and — for EU/UK data subjects — the relevant supervisory authority within 72 hours as required by Art. 33 GDPR.

Despite these controls, no online service is completely secure, and you use the Service at your own risk. Please protect your password and notify us immediately at admin@darkskytools.com if you suspect unauthorised access to your account.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact admin@darkskytools.com and we will delete the information promptly.

11. Your rights

You have rights over the personal information we hold about you. Some rights apply everywhere; some apply only in specific jurisdictions.

11.1 Everyone

  • Access — request a copy of the personal information we hold about you.
  • Correction — ask us to correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
  • Deletion — request that we delete your account and Your Content. You can also delete your account yourself from account settings at any time.
  • Withdraw consent — where we rely on your consent, you can withdraw it at any time (this does not affect the lawfulness of earlier processing).
  • Opt out of marketing — every marketing email includes an unsubscribe link, and you can turn off promotional push notifications in your device settings.
  • Complain to us — see Section 13 below.

11.2 Additional rights under the GDPR / UK GDPR

  • Data portability — receive your account data in a structured, commonly used, machine-readable format, or ask us to transmit it to another controller where technically feasible.
  • Restriction of processing — ask us to pause processing in defined circumstances.
  • Object to processing — object to processing based on our legitimate interests, including profiling.
  • Right against automated decision-making — we do not make legally significant automated decisions about you, but you may object if this changes.
  • Lodge a complaint with a supervisory authority — in the EU member state or UK where you live, work, or where the alleged breach took place. In the UK, the supervisory authority is the Information Commissioner's Office (ICO).

11.3 Additional rights under the CCPA/CPRA (California residents)

  • Right to know — the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
  • Right to delete — subject to statutory exceptions.
  • Right to correct — inaccurate personal information.
  • Right to opt out of sale/sharing — we do not sell or share personal information for cross-context behavioural advertising, so no opt-out mechanism is currently required.
  • Right to limit use of sensitive personal information — we do not use sensitive personal information beyond the purposes permitted without an opt-out under Cal. Civ. Code §1798.121(a).
  • Right to non-discrimination — we will not deny service or charge different prices for exercising CCPA/CPRA rights.
  • Authorised agents — you may designate an authorised agent to exercise rights on your behalf; we will verify their authority.

We will respond to a verifiable request within 30 days (extendable to 45 or 90 days for GDPR/CCPA requests where necessary and with notice). To make any of these requests, email admin@darkskytools.com with subject "Privacy request".

We may need to verify your identity before we action a request — usually by confirming control of the email address on file. We will not charge you for exercising your rights unless a request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse to act.

12. Cookies and similar technologies

The DarkSkyTools mobile app does not use browser cookies. On the marketing website darkskytools.com we may use a small number of strictly necessary cookies (for session management and CSRF protection) and, if you consent via our cookie banner, analytics cookies to understand traffic. We do not use advertising cookies. You can control cookies through your browser settings and — where a consent banner is shown — through the banner's preferences.

13. Complaints

If you believe we have breached the Australian Privacy Principles, the GDPR/UK GDPR, or another applicable privacy law, please contact us first at admin@darkskytools.com with the subject "Privacy complaint". We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to a regulator:

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do:

  • Material changes will be notified to you at least 14 days in advance by in-app message or email to the address on your account.
  • Minor updates take effect on the "Last updated" date at the top of this Policy.
  • The current version of the Policy is always available at darkskytools.com/privacy and from within the app.

Your continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy. If you do not agree, you may cancel your Subscription and delete your account before the change takes effect.

15. Contact

For any privacy question, request, or complaint:

  • Nustellar Pty Ltd
  • Attention: DarkSkyTools Privacy
  • Adelaide, South Australia, Australia
  • Email: admin@darkskytools.com

We aim to answer every genuine enquiry within a reasonable period and, in any event, within any statutory response time that applies.

© 2026 Nustellar Pty Ltd. All rights reserved. DarkSkyTools is a product of Nustellar Pty Ltd.