Privacy Policy
Sky Radar ("the app", "we") is a specialized weather forecasting app for astrophotography, sea of clouds, and landscape photography in Vietnam, developed by Duy Chris (an individual developer). This privacy policy complies with Vietnam's Personal Data Protection Law No. 91/2025/QH15, detailing how we collect, process, and protect your personal data, and outlining your legal rights when using our services on the web (skyradar.vn), Android, and iOS.
This is an English translation of the official Vietnamese policy at skyradar.vn/privacy. In case of any discrepancy or conflict, the Vietnamese version shall prevail.
1. Data we collect
| Data type | When collected | Purpose of processing |
|---|---|---|
| GPS location (precise & approximate) | When you grant location permission on your device or browser | Display the map around your position, suggest nearest photography spots, and compute microclimate forecasts for coordinates |
| Account profile (Email, display name, avatar) | When you sign in using Google (Web & Mobile) or Apple (Mobile) | Create and identify a unique user account (Supabase User ID), synchronize favorite photography coordinates across your devices |
| Saved favorite spots | When you save custom spots or locations on the map | Synchronize your personal spots across your devices |
| Web QR Bank Transfer (VietQR) (Order payment code, amount, subscription plan, timestamp, bank transaction ID, transfer description) | When you pay for a SkyRadar Pro plan via bank QR transfer on the web | Automated payment reconciliation (via SePay/TPBank), grant SkyRadar Pro access, technical support, and tax/accounting compliance. Our system DOES NOT store your bank account number, DOES NOT store your sender name, and DOES NOT store your account balance. |
| Google Play Billing on Android (Encrypted purchase token, Google Order ID, product details, start/expiry dates, auto-renew status) | When you purchase or renew a SkyRadar Pro subscription via Google Play on Android | Verify transaction receipts directly with Google Play servers, grant Pro privileges, and manage subscriptions. We DO NOT collect or store your credit card or bank card details (Google Play handles payment processing directly). |
| Camera | When you open Virtual Sky (AR mode) | Render the celestial sphere and constellations overlaid on your real-world camera view in real time — NO photos taken, NO videos recorded, NOT stored, and NOT sent anywhere |
| Web Analytics data (Google Analytics 4) | Only if you actively click "Agree" on the cookie consent banner at the bottom of the website | Measure anonymous web traffic and page load performance; IP addresses are masked with anonymization enabled (anonymize_ip: true). If you decline or have not decided, the tracking script is not loaded and no _ga cookies are placed |
| Push Notifications (FCM Token) | When you grant notification permission on Android/iOS | Device token (Firebase Cloud Messaging) stored locally to deliver daily 16:00 forecasts and weather condition alerts |
| User-contributed spots (Coordinates, spot name, category, notes, and photos) | When you submit a new photography spot on the map (Pro accounts) | Receive and moderate community content. Photos are stored in Supabase Storage (contribution-images). Submitter metadata including account ID (user_id), display name, and email are secured on the server (accessible only to internal administrators for moderation). Upon approval, coordinates, spot name, notes, and photos are displayed publicly to the community (emails are never disclosed). Note: New submissions are currently paused under feature policy; previously approved spots remain available. |
| Technical forecast logs (Coarsened coordinates snap 0.05° ~5km, timestamp, calculation results, weather fingerprint, and error codes) | When the web or mobile app requests forecast computations from the server | System operations, caching optimization, reliability assessment, and troubleshooting; stored on Cloudflare D1 (assess_log). Coordinates are coarsened to 0.05° (~5km) to protect privacy; contains NO email, name, user ID, or IP address. |
| Automated error reporting (Error name, message, stack trace, filename, line number, app version, and page path) | Automatically when a script exception or app crash occurs (sent to /api/bao-loi) |
Centralized error tracking on Cloudflare D1 (error_fp) to diagnose and fix bugs. DOES NOT record your IP address (IP is only held transiently in server memory for anti-spam rate limiting and immediately discarded), DOES NOT record personal device identifiers, and sends no user coordinates or user IDs. |
| AI assistant queries and forecast summaries | Only when you submit a question in the SkyRadar AI Assistant | Send your question and minimal weather summaries to Google Gemini API for an explanation; no email, user identity, or account profile is attached |
We do not collect your device contacts, SMS messages, audio microphone, or personal photos from your photo library. Regarding Telegram: The system currently does not store user messages or Telegram identities (the interactive Telegram bot feature has been decommissioned).
2. Device permissions
- Location: Optional. If denied, the app continues to function normally; you can manually select any location on the map.
- Camera: Optional. Only used when activating Virtual Sky (AR) to overlay constellations over the horizon. Camera frames are processed directly on your device's GPU and never stored.
- Notifications: Optional. Used to alert you about favorable shooting conditions or reference disaster warnings. You can enable or disable this at any time in your OS Settings.
3. Cookie Policy & Web Storage Technologies
The website skyradar.vn strictly adheres to the principle of prior consent (Opt-in Consent) pursuant to Article 9 of Law No. 91/2025/QH15:
- Strictly Necessary Storage: Uses browser local storage (localStorage / sessionStorage) to maintain your Supabase authentication session (
sb-...-auth-token), map style preferences, offline cached spots, and preview mode flags. These items are strictly necessary for basic operations and are never used to track you across third-party websites. - Analytics Cookies (Google Analytics 4): Used for aggregated usage statistics (cookies
_ga,_ga_*). The tracking script is only executed after you explicitly click "Agree" on our consent banner. Your decision is stored under thesr_consent_v1key. If you click "Decline" or ignore the banner, no analytics cookies are generated.
You have the absolute right to revoke your consent at any time. Clicking the button below will immediately erase your stored choice, remove analytics cookies from your browser, and reload the page so you can choose again:
⚙️ Cookie Settings / Withdraw Consent
4. Storage, Processing & Cross-Border Data Transfers
User data is hosted and secured through reputable, industry-standard international cloud providers:
- Supabase, Inc. (USA; servers at AWS Seoul, South Korea): Hosts our PostgreSQL user database, manages account credentials, and enforces Row Level Security (RLS).
- Cloudflare, Inc. (USA): Provides our global Content Delivery Network (Edge CDN), Pages Functions, and edge database storage (Cloudflare D1 / R2) to calculate weather forecasts. D1/R2 data is stored on Cloudflare servers outside Vietnam; the exact location is assigned by Cloudflare.
- Google LLC (USA): Google Identity OAuth authentication, Google Play In-app Billing (Android), Firebase Cloud Messaging (FCM), Google Analytics 4 (upon consent), and Google Gemini API (AI assistant).
- SePay Payment Gateway / TPBank (Vietnam): Facilitates automated VietQR bank transfer payment reconciliation within Vietnam.
Cross-border transfer of personal data is carried out in accordance with the provisions of Vietnam's Personal Data Protection Law No. 91/2025/QH15 and its guiding documents. We do not sell your personal data to any third party for commercial or advertising purposes.
5. Data Security
We deploy robust technical safeguards to secure your personal data:
- All data transmissions between your device and our servers are encrypted via HTTPS / TLS.
- The database employs Row Level Security (RLS): only your authenticated account can access or modify your saved favorite spots.
- Google Play purchase tokens are encrypted using AES-GCM 256-bit prior to database storage.
6. Data Retention & Account Deletion
- Account data & saved spots: Retained securely until you choose to delete them or request account termination.
- User-contributed spots: Approved spots are retained alongside public spot data to serve the community; pending or rejected submissions (including photos) are kept for up to 12 months for moderation and then deleted. You may ask us to delete them sooner at any time.
- Payment transaction receipts (VietQR / Google Play): Retained in accordance with applicable accounting, tax, and e-commerce laws to handle reconciliation, disputes, and tax audits They are kept for 10 years from the transaction date.
- Technical forecast logs (assess_log on Cloudflare D1): Automatically purged within 365 days via scheduled server maintenance jobs at 07:00 VN daily.
- Server error ledger (error_fp on Cloudflare D1): Automatically purged within 90 days via scheduled maintenance jobs.
You have the full right to delete your entire account and all associated data at any time:
→ In the mobile app: Account → Delete account.
→ Or on the web: skyradar.vn/en/delete-account
Once deleted, your profile, saved spots, and authentication credentials will be permanently erased from our servers. This action is irreversible.
7. Data Subject Rights (Under Law No. 91/2025/QH15)
In accordance with Chapter II of Vietnam's Personal Data Protection Law No. 91/2025/QH15, you hold the following legal rights regarding your personal data:
- Right to be informed: The right to know about all processing activities concerning your personal data via this Policy.
- Right to give or withhold consent: The right to provide, refuse, or withdraw consent for data processing (such as analytics cookies or device permissions).
- Right of access: The right to inspect and obtain copies of your stored personal information and favorite spots.
- Right to rectification: The right to update or modify your profile and custom spot names in the app at any time.
- Right to erasure: The right to request permanent deletion of your personal data (skyradar.vn/en/delete-account).
- Right to restriction of / objection to processing: The right to restrict or object to data processing by contacting us.
- Right to file complaints and claim damages: The right to complain to relevant state authorities or initiate legal proceedings under Vietnamese law if your privacy rights are infringed.
To exercise any of these rights, please use the provided features in the app or send an official request to our email. We will acknowledge and complete valid requests within 72 hours.
8. Children's Privacy
Sky Radar is intended for photographers and sky watchers, is not directed at children under 13, and does not knowingly collect personal data from children. If a parent or guardian becomes aware that a child under 13 has provided personal information, please contact us immediately to have the data removed.
9. Changes to this Policy
When this policy is revised, we will update the "Last updated" date at the top of the page. Significant changes will be announced directly through the app or prominent notices on the website before taking effect.
10. Contact Information
For any inquiries, requests to exercise your data rights, or privacy questions, please contact:
- Developer Representative: Duy Chris [CẦN CHỦ DỰ ÁN XÁC NHẬN: Registered Business / Household name and formal business address if established]
- Support & Data Rights Email: vnpriston@gmail.com
- Website: https://skyradar.vn