How Sky-Lens handles your data

01What we collect

• Account data — email address, optional display name, password (stored as an Argon2id hash — we never see the plain text), account tier, and timestamps for account creation and sign-in.
• Sign-in data — your browser user-agent and IP address per session, so you can see active sign-ins in your profile and revoke them.
• Observation queries — when you use "What did I see?", we log the location, time, and parameters you submitted, plus the top candidates we returned. If you're signed in, queries link to your account; anonymous queries store only a hashed IP for abuse prevention.
• Analytics — Google Analytics counts pageviews and approximate location (see §3).
• Consent records — when you accepted the privacy policy and terms, and your marketing-email preference.

What we don't collect: payment data, social-media tracking pixels, precise location (beyond what you enter yourself), or cross-site profiles. We never sell, share, or rent data.

02Legal basis

• Contract (GDPR Art. 6(1)(b)) — account creation and providing the service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — abuse prevention, rate limiting, security logging.
• Consent (Art. 6(1)(a)) — Google Analytics cookies and optional marketing emails. Revocable at any time.

03Cookies & analytics

We use two categories of cookies:

• Strictly necessary — sky_session, a HttpOnly SameSite=Lax cookie that keeps you signed in. Expires after 30 days. No consent required under EU law.
• Analytics — Google Analytics 4 (G-LZ3VJMQXTW) counts pageviews, session duration, approximate country/city, and the language / device type you use. It sets the _ga and _ga_* cookies on your device. Data is processed by Google LLC (United States).

You can opt out of analytics by installing the Google Analytics opt-out browser add-on, by using a browser that blocks tracking (Firefox, Brave), or by enabling "Do Not Track". We do not use advertising cookies, remarketing, or social-media pixels.

04Service providers

Sky-Lens uses the following sub-processors, all bound by GDPR-compliant data-processing agreements:

05How long we keep data

• Active accounts — kept for as long as the account exists.
• Inactive accounts (no sign-in for 24 months) — deleted automatically after notice.
• Unverified signups — deleted after 30 days.
• Revoked sessions — purged after 90 days.
• Observation queries — kept indefinitely in anonymized form after you delete your account.
• Google Analytics data — retained for 14 months, then automatically deleted by Google.

06Your rights under GDPR

07Contact