Privacy Policy
Chaos with Planets
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Chaos with Planets stores research folders, questions, hypotheses, notes, links, tags, comparisons, virtual planet versions, observation dates, manually entered places and equipment, outcomes, and attached photos on your device in a SQLite database. Language, distance units and sync preferences are stored locally. Personal age and mass calculations remain in the current screen and are not sent to the backend. The app has no accounts. If you enable synchronization, research records, links and attached images are sent to our backend and associated with a randomly issued installation identifier. An installation secret is stored in this device’s Keychain; the server stores its cryptographic hash. The atlas and topic catalog are fetched over the network even when synchronization is off. Hosting necessarily receives IP addresses, request times, paths and technical connection information. The app contains no advertising or analytics SDK.
How we use information
Local storage supports offline research and reopening saved work. Optional synchronization keeps this installation’s research package on the server and resolves record conflicts using modification timestamps. Public catalog requests update reference material and suggested research questions. Photos and camera access let you add observing evidence; Photos add permission saves exported comparison and scale images. Optional local notifications remind you about scheduled observations. Technical hosting information supports serving requests and diagnosing availability.
Service providers and sharing
The backend and PostgreSQL database are hosted on Railway, which processes network traffic and infrastructure information as our hosting provider. We do not sell research records or share them with advertising or analytics providers. The app does not send your research to NASA; opening an external NASA source link loads its website under that site’s practices. If you use the iOS share sheet to export a JSON file, you choose the recipient and that recipient receives the file, including attached images. Photos exports are saved to your own Photos library. Infrastructure logs may be handled by Railway; we do not assert a provider log retention period.
Data retention
Research remains in local storage until you delete individual records or use Delete all data. Server records for an installation remain until a deletion request is received; there is no automatic research expiry. Deleted individual records are represented by synchronization tombstones to prevent stale records from reappearing. Delete all data removes the installation and its server records. The app does not implement a separate backup service. Device or hosting backups and infrastructure logs may persist under their operators’ controls; no fixed backup or log purge period is promised. Exported files and images already shared or saved outside the app remain under your control.
Deleting your information
Use Settings → Delete all data to clear local research and request deletion of all server records and the installation identifier. When offline, the request remains pending locally and the installation secret is retained solely to authorize deletion when connectivity returns; the status is shown in Settings. Once deletion succeeds the secret is removed. Turning sync off stops research transfers but does not delete previously synchronized records. Individual record deletion keeps a tombstone until all installation data is deleted. Removing the app does not itself request server deletion, and losing the secret can prevent access to or deletion of those records. We cannot promise restoration or cross-device access. Remove exported files and Photos copies separately.
Permissions and your choices
Photo selection uses the system photo picker and only the images you select are imported. Imported images are resized and JPEG encoded. Camera access is requested when taking a photo; Photos add access is requested when exporting an image. Notification permission is requested only when an observation reminder is enabled. No geographic location or maps permission is requested: observation places are entered manually. You can withdraw camera, Photos or notification permissions in iOS Settings. Denial leaves text research available, and withdrawing permission does not delete previously attached or exported images.
Your privacy rights
You can view and edit research in the app, export all non-deleted records as JSON, switch synchronization off, and request deletion through Settings. Depending on your location you may have rights to access, correct, delete or restrict processing and complain to a relevant authority. Privacy questions may be sent to JagoThornycroft@icloud.com, the public privacy contact. Do not send the installation secret. With no account or email identity, we may be unable to locate or verify ownership of server records without the installation’s authorized in-app request.
Security
The public API uses HTTPS. Private endpoints require a unique random installation bearer secret; PostgreSQL queries scope access to the installation identified by the secret’s hash, not a client-supplied installation ID. The secret uses device-only Keychain storage. Inputs and package sizes are limited. The backend does not deliberately log bearer secrets or research payloads. Local storage relies on iOS application isolation and device protection. No system can guarantee absolute security; someone with access to an unlocked device or its secret may access that installation’s records.
Children’s privacy
The educational app is intended for people aged 14 and older, including older students and adults. It does not request a birth date or create child accounts. Avoid recording unnecessary personal information about yourself or others in free-text notes, locations or photos. If you believe information about a younger child was provided, contact JagoThornycroft@icloud.com so we can discuss the available steps; installation authorization may be needed to identify records.
Changes to this policy
This policy describes the current app and backend behavior. We will publish changes on this page and update the effective date when processing practices change. Review the policy through the link in app Settings. Material changes will be reflected in the app or this public page; no account or email notification system is operated.