Privacy notice

1. Controller and contact

Laura Rönick, Rare Sights, Am Drosselschlag 23, 16348 Wandlitz, Deutschland.

Phone: +49 15678 132719; email: contact@raresights.app.

2. Visiting the app and security

When you visit the app, technically necessary connection data is processed, including your IP address, time, requested URL, browser details and response status. This is needed to deliver the site, diagnose errors and defend against attacks. The app is hosted on Cloudflare Workers. The legal basis is Article 6(1)(f) GDPR (secure and reliable operation). Additional Worker invocation logs, traces and issue collection are disabled for the website service and the separate mobile data service. Cloudflare also processes connection and security data. For security events and traffic data available in its dashboard, Cloudflare currently states retention of up to 31 days on the Free plan used here. This is not a single deletion period covering all internal provider records.

3. Accounts and sign-in

You do not need an account to browse public events. If you register or sign in, Supabase Auth processes your email address, a protected password value, identifiers and technical sign-in information. Google sign-in, offered on the website, exchanges the account data needed for authentication between Google and Supabase. The session is stored locally in your browser or iPhone app storage to keep you signed in. The legal basis is Article 6(1)(b) GDPR (providing the requested account).

Confirmation and password emails are sent by Supabase through the connected delivery provider Resend. Your email address, message content and delivery information are processed. We generally keep account data until the account is deleted. In your signed-in profile, you can permanently delete your account, profile, saved events, reminders and earlier account-linked statistics from the active app database. You can also request deletion using the contact address above. Technical logs, backups and legally required records must be considered separately.

On the Supabase Free plan used here, the provider states retention of one day for API/database logs and one hour for Auth audit logs. Additional storage of Auth audit logs in our database is disabled. The Free plan does not include accessible project backups. This does not mean there are no internal operational copies. Resend states that it retains system emails and delivery logs for 30 days, with backups persisting for seven days. After the Resend account is terminated, remaining customer data is deleted within 90 days according to the provider. These periods do not automatically shorten the lifetime of your app account. Open and click tracking are disabled for our sending domain.

4. Profile, saved events and location

If you complete a profile, we store the details you provide, such as display name, home city, country, interests and travel preferences, along with your saved events in the Supabase project. Without an account, saved events stay locally in your browser or iPhone app. The legal basis for account features is Article 6(1)(b) GDPR.

Choosing a location is optional. If you select a city or explicitly allow device location, we store the chosen place and coordinates locally. The data needed for place names, distances and weather conditions is sent to our server. For German locations, our server first requests DWD MOSMIX data through Bright Sky. It then checks worldwide for a DWD MOSMIX station within 30 km. Where no suitable station answers, it uses MET Norway. Location coordinates are transmitted for these requests and rounded for MET Norway. Weather requests normally go through our server. A fallback request for German locations may contact Bright Sky directly from your browser; Bright Sky then receives your IP address and connection details as well as the coordinates. The location feature does not run in the background. Our server processes place search terms against its GeoNames place data. The legal basis is Article 6(1)(b) GDPR when you request these features. You can remove the local selection in the app.

For faster weather displays, the web app can cache up to twelve weather responses with grid-based coordinates. When you change or remove the selected place, we clear this persistent weather cache where your browser permits it. On subsequent use, we remove invalid or expired entries, including responses fetched at least 24 hours earlier. A closed browser performs this cleanup when you next use the app. Account sessions, language and saved events are not deleted by this cleanup. Clearing local storage does not retrieve data already sent to our server or weather providers.

5. Maps, fonts and external content

Calculated event zones are shown without an external map background. Only when you choose ‘Load map background’ or ‘Load external map’ does your device load tiles from tile.openstreetmap.org or an embedded map from www.openstreetmap.org and its map servers. They receive your IP address, connection details and the requested map area. You can hide the background again; this does not undo data already transmitted. The legal basis for this requested map display is Article 6(1)(f) GDPR (showing the selected places and event zones). Font files are served by raresights.app itself without contacting Google Fonts.

If you choose to open an external provider link, that provider's privacy notice also applies. The public app does not currently connect live hotel prices or bookings.

6. Usage statistics are disabled

Usage statistics are disabled. This version sends no statistics events and creates no statistics device ID, including if you opted in to an earlier version. When you open the updated web app, we remove the previous statistics ID and its stored choice where browser storage allows this. Account sessions, saved events, language and your selected location are unaffected.

On 27 October 2026, we deleted the statistics events stored before collection was disabled, including entries linked to an account, from the active app database. This cleanup concerns usage statistics; it does not delete your account, profile or saved events. Technical provider logs and any existing backups are handled separately according to their applicable retention periods.

Only if you choose ‘Turn on partner offers’ in privacy settings does the website load Travelpayouts Drive from emrldtp.com. It can analyse page views and interactions, change links, show recommendations and previews, and open a partner offer in another tab when it detects booking intent. The provider receives technical connection data; further access to your device and processing of your usage may occur. The legal basis for this optional feature is your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw your choice in privacy settings. After reloading, the script will no longer load; this does not undo transfers that already occurred. This applies to the website only, not the iPhone app. Travelpayouts privacy policy.

7. Email contact

If you email us, we process your sender address and message to handle your request. We use a dedicated mailbox provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as our processor. New messages to contact@raresights.app are received and stored there; forwarding to the private Gmail mailbox is not configured. The legal basis is Article 6(1)(f) GDPR (responding to enquiries) or Article 6(1)(b) GDPR for contract-related enquiries. We delete correspondence when no longer needed, unless retention duties or a legal dispute require otherwise.

For its mail service, IONOS states a maximum of seven days after a deletion we initiate or after the contract ends, and a maximum of 28 days from creation for technical mail logs. This does not mean your message is automatically deleted after seven days while we retain it to handle your enquiry. Earlier contact correspondence may still be stored in the Gmail mailbox used previously. It is reviewed separately for continued necessity and any retention duties. Changing the receiving provider does not automatically delete these earlier messages.

8. Recipients, international transfers and retention

Depending on the feature, data is processed by Cloudflare (website and mobile data service), Supabase (authentication and database), Resend (system emails), IONOS SE (contact mailbox), Google (Google sign-in and, where applicable, earlier contact correspondence), Bright Sky/DWD (forecasts for German locations), DWD directly (station forecasts worldwide), MET Norway (forecasts based on rounded coordinates), and OpenStreetMap map servers. We do not sell personal data.

Our Supabase database project is located in Frankfurt am Main. The contracted processor is Supabase Pte. Ltd. in Singapore; support and operational processing can also take place outside the EEA, particularly in Singapore and the United States. The data processing agreement includes EU Standard Contractual Clauses for these transfers. The database region does not mean all processing takes place exclusively within the EU.

Cloudflare, Inc. in the United States provides the website and mobile data service through its global network. Resend, operated by Plus Five Five, Inc. in the United States, stores message content and delivery data in the United States; the configured sending region in Ireland does not change that storage location. Cloudflare and Resend participate in the EU-US Data Privacy Framework. US transfers within its scope are covered by an adequacy decision under Article 45 GDPR; the provider agreements also contain Standard Contractual Clauses for the transfers governed by them.

You can review the contractual safeguards and subprocessor information here: Supabase DPA, Cloudflare DPA, Resend DPA, IONOS AVV. Current certification scope is listed in the Data Privacy Framework Register. You can also request a copy of the relevant safeguards using our contact address.

Data is kept only as long as needed for the relevant feature, security, handling an enquiry or legal duties. You can remove local settings and guest saved events in the app or by clearing browser or app data. Account data is generally kept for the lifetime of the account; provider logs follow their technical deletion cycles.

9. Additional information about the iPhone app

The iPhone app requests public event content directly from Supabase, including when you do not use an account. Supabase receives your IP address, the content requested and technical connection data. This is used to deliver the content you request; the legal basis is Article 6(1)(f) GDPR. The provider and transfer information in sections 3 and 8 also applies to these requests.

In the iPhone app, you can sign in with email and password. Account confirmation and password reset links open our website. When you sign in, events you previously saved locally are added to your account so you can use them across devices. Profile details, saved events and their status are stored at Supabase with your account identifier. The legal basis for these requested account features is Article 6(1)(b) GDPR. You can start deletion in your signed-in profile or request it at contact@raresights.app.

The iPhone app stores your language, guest saved events, selected place including coordinates and, where applicable, your session on the device. This storage supports the features you use. Settings remain until changed or removed. Signed-in saved events are synchronised with your account; this does not save the selected device position as your profile's home city. ‘Remove location’ removes the selected place from app storage. Account deletion preserves your place and language settings; removing local data does not retrieve data already transmitted or any operating-system backups.

Device location starts only when you request it in the app and grant the required iOS permission. Coordinates may reveal your precise location. For place names, weather and local aurora information, the app sends the necessary coordinates to raresights.app; a place search sends your search text. Weather data is requested through our server using the provider route described in section 4. GPS location is not continuously obtained in the background. You can select a city instead, remove the selected place or revoke permission in iOS Settings. The legal basis for the requested location features is Article 6(1)(b) GDPR. iOS permission is not consent to advertising or statistics.

External maps in the iPhone app also load only after the explained loading action; the transfers in section 5 apply. The calendar feature creates a file on the device containing the event title, date and event information. You share it with an app you select in the iOS share menu. A copy may remain in the local cache. Rare Sights does not read your existing calendar for this feature. Sharing with a calendar or cloud app is also subject to that app's settings and privacy notice.

10. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time for the future. Contact contact@raresights.app to exercise these rights. You may also complain to a data protection authority. The operator's local authority is the Brandenburg Commissioner for Data Protection and the Right of Access to Files.

www.lda.brandenburg.de