Privacy

Version and effective date: 2026-11-07. This policy explains how we handle personal data. It is information, not a contract; the terms and the Engine Licence are the agreement.

Optional Google Drive originals

You may enter a Google account email to use that account's existing permission rather than choose an account again. This optional hint goes only to Google in the authorization request, is held in page memory, is cleared by Disconnect or reload, and is not saved or included in analytics.

Connecting Google Drive loads Google's sign-in and file-picker scripts only after you press Connect Google Drive. The picker requests drive.file access to files you select. That permission also allows editing those files; this importer sends only read requests. It does not upload, edit, share or delete provider files, and it does not list your entire Drive.

Google receives the selected file identifiers to return names, sizes, versions and original bytes directly to your browser. These identifiers and the short-lived OAuth token are not sent to our API, account settings, analytics or session recording. The token stays in memory and is cleared by Disconnect or reload. No refresh token is stored. The public configuration request to our API contains no token or photograph.

With your explicit permission, selected originals are copied to temporary storage on this device. Add verified originals admits the complete checked selection to your source groups; it never starts processing. Disconnect clears the connection but keeps those device copies. Clear temporary cloud originals removes the copies and their imported sources; files in Google Drive remain unchanged. Local files remain available when you cancel or access expires.

Optional Dropbox folders

Connecting Dropbox opens its sign-in window and requests read-only file metadata and content access. Dropbox grants access beyond one folder. The app lists folders you open and downloads only originals you explicitly select and assign to source groups. It cannot upload, edit or delete Dropbox files.

Requests go directly from your browser to Dropbox. Folder identifiers and selected file identifiers are sent to Dropbox to retrieve their names and original bytes. They are not sent to our server, account settings, analytics or session replay. This feature is separate from optional analytics consent.

Sign-in uses a short-lived session token held only in memory; reloading or disconnecting removes it. No refresh token or Dropbox credential is saved. With your explicit permission, imported original copies are kept in this browser's temporary device storage. Disconnecting removes the connection; use Clear temporary cloud originals to remove imported sources and their local copies. Your provider originals remain unchanged. Local file selection remains available without connecting.

Your photographs

They are read, measured, combined and encoded inside your browser tab, by code running on your own machine. The pages and the processing code are static files. The site’s small API serves accounts, alerts and similar features; it has no server that processes images and no endpoint that accepts an upload of them; the finished PNG or FITS is handed to you from your browser’s memory.

The image-processing path makes no upload. If you drop a RAW file, it downloads the RAW decoder — one 804 KB WebAssembly file from this same domain, /vendor/raw/rawlab.wasm. That request carries nothing about your files. Separately, the page may load the cookieless analytics script and send the closed-set events described below; those requests never carry image or session metadata. Microsoft Clarity loads as well only if you accept session recording, described below. Disconnecting after the page and RAW decoder have loaded does not stop the frames from stacking.

The same applies to the metadata. Timestamps, exposure, focal length, camera model and serial number are read from the files to compute the sequence’s defaults, and they stay in the tab with the pixels.

Deep sky registration, calibration, integration, display stretching and FITS encoding use the same local worker. The 16-bit PNG is display-stretched; the 32-bit Float32 FITS keeps the signed, unclamped integration. Both are browser-created downloads, not server responses containing your image.

Comet preparation, nucleus marks, both registered arms and the exact-grid composite also remain in that worker and tab. Its three PNG/FITS output pairs use temporary browser object URLs that are revoked when you reset or start another accepted run.

Planetary SER headers, frame ranges, quality scores, measured translations, all-valid crops and PNG/FITS pairs also stay inside that worker and tab. Restart and Reset revoke every Planetary download URL.

What is stored on your device

Your account workspace can show the recipes and calibration master metadata already saved in this browser. These device items are shared by people using the same browser; signing out or deleting an account does not remove them. The workspace does not read or upload master image bytes. To check a Dropbox connection, it asks open Studio tabs on this site for a connection state only. No Dropbox token, folder name or file information is shared with the account page or our server.

The stacking workspace sets no cookie. It remembers the last settings you change in each mode on this browser and offers them when you return. These settings contain no photographs, source names, masks or frame decisions. Named recipes can also keep your optional camera/setup label. If you enable automatic project saving, it stores source file names and review decisions; original photographs and output pixels are not included. If you explicitly import or save a calibration master, its FITS bytes and compatibility metadata stay in this browser's device library. Named recipes, project recovery and the calibration library are not synced to your account or uploaded. Named working nights have the separate optional account-copy action described below. While signed in, changes to supported reusable processing controls also save automatically to your account; see Optional account below. Settings & library lets you export or remove saved items and clear device memory. Browser storage may be cleared or lost; keep downloaded project and master files when they matter. It keeps working data only if you tick Keep working data on this device, so that an interrupted stack can be continued, and Delete kept data removes it. Your browser keeps its own cache of this site’s files. In its local storage the light pollution map remembers its view, its display settings and whether Terrain is on, the aurora pages remember your pin, the header's red-light button remembers whether red light is on, and your answer to the session-recording question below is kept under sf-consent, with the date you gave it, so you are asked once rather than on every page. Cookies on this domain are the optional account cookies below and, only if you accept recording, Microsoft Clarity’s cookies.

Cookies and browser storage, in one table

Working nights

Saving a working night stores a named project snapshot in this browser: its optional observing date, source basenames, sizes, modification dates and available revision/hash, settings, normalized mask edits and frame decisions. Photos, exported pixels, calibration master bytes, EXIF/GPS, paths, file handles, provider file identifiers and credentials are not included. Browser nights are shared by people using this browser and stay here after sign-out or account deletion. Remove a browser copy in Library; export night backups to keep copies if browser storage is cleared or lost.

Only pressing Save to account sends that snapshot to our account service. Signing in or saving on this browser does not upload a night. Account copies can be read on another signed-in browser and copied locally by choice. Delete from account removes the snapshot from the live account catalogue; deleting your account removes all its nights. Existing recovery backups can retain earlier states for up to 35 days. Your other browser copy, current session and photographs in Drive remain intact. Night names and project data are masked from session recording and are not analytics events.

Optional account

You can use every current stacker tool without an account. If you choose Google sign-in, we request openid email profile. Google sends a verified email address, name and profile picture; we keep the email and name for the account and do not keep the picture or sign-in token. No photograph, stack result, EXIF or location is attached to the account. Working-night project metadata is stored only when you explicitly save it to the account, as described above. Reusable processing controls that you change while signed in are saved to your account, separately from the device stores. They can be offered on another signed-in browser; applying them is your choice and never starts processing. If saving fails, the workspace reports that account sync is pending rather than claiming it succeeded. Signing in never subscribes you to alerts or marketing. We use Google user data only to provide and secure the account functions you ask for, in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

During sign-in this domain sets __Host-sf-startrail-state, an HttpOnly ten-minute state cookie. A completed sign-in sets __Host-sf-startrail, an HttpOnly session lasting twelve hours, and __Host-sf-startrail-hint, a non-secret flag that tells the page when to ask whether you are signed in. Signing out clears them. The account page is excluded from Clarity recording even if you accepted it elsewhere. Account settings are kept until you replace them or delete your account. You can delete the account on its page: the live identity, processing-settings and working-night rows are removed immediately, and DynamoDB recovery backups retain earlier table states for up to 35 days. No payment or paid access is active.

Your acceptance of the terms. When you accept the terms and the Engine Licence, your browser keeps the version and the time, and sends the version to our server. Our server records:

• the time;
• the version;
• a fingerprint (hash) of the two documents you were shown;
• how you accepted (before a run, or before sign-in);
• your account identifier if you are signed in.

For account holders we keep that record, without an IP address, for as long as the account exists and six years afterwards, so that we can show what you agreed to. For runs without an account we also record the IP address and browser type and keep them 30 days.

What is measured

Anonymous, cookieless usage statistics, so we can tell whether anyone is using the tool: which page was visited, roughly where in the world from your IP address, which is not stored, and a small closed set of events. The same cookieless script measures page-loading and interaction timings, including LCP, INP and CLS, with the page address and device context so we can find slow routes. These timings contain no file contents or image measurements. The canonical anonymous completion events are work_started and work_completed; this tool also distinguishes a refusal, cancellation and download, counts when a result's feedback prompt is shown or rated, and counts the session-recording prompt and your Accept or Reject choice without recording the choice's page content. The complete list is in /assets/analytics.js on this site and no event outside it can be sent.

If a star-trail night stops before it finishes — the browser closes the tab (on a phone this is usually because it ran out of memory), the page is reloaded or left while it runs, the processing worker stops, or the engine reports an error it could not handle — the next time the page loads in that tab it counts one fixed name, run_died_<class>_<stage>_<device>_<engine>_<size>. It carries only which of those four it was, how far the run had got (starting, preparing, cleaning trails, stacking or finishing), whether the device is a phone, a tablet or a computer, the browser engine (Blink, WebKit or Gecko), and whether the night had fewer than 20 photos, fewer than 200, or more: no photograph, file name, exact count, size, camera detail or error text. The marker that remembers this lives in this tab only (sessionStorage) and is never sent; it is removed once counted.

Cloud originals counts fixed Dropbox and Google Drive connection, folder-opening or selected-file listing, import, verification, source-addition, cancellation, disconnection and local-cache clearing events, including whether an operation failed. These events send no account identity, folder or file names, paths, counts, byte sizes, hashes, authorization tokens or error messages. They use the same cookieless usage statistics described here; connecting either provider does not enable session recording.

On the plans page and the download page, pressing a plan or desktop-app button counts one fixed name (which plan and billing period, or which operating system) and nothing else. It stores nothing in your browser, sends no address or identity, and does not start a plan: nothing is charged and no card is asked for.

Account sign-in clicks and completions are counted as names only, without email or identity. Those events carry no file names, no camera model, no frame count beyond one of three coarse ranges, no sky measurements and no image data of any kind. If your browser sends a Do Not Track signal, nothing is recorded at all.

If you choose aurora forecast emails, the form collects your address and alert settings under that separate consent. Its fixed-name events count a request, confirmation, unsubscribe and deletion, including failures, without sending the address, location, threshold, time zone or link token to analytics. The email token is removed from the address bar before those events. Alert pages are excluded from Clarity session recording.

Session recording, only if you accept

A bar at the bottom of the page asks whether Microsoft Clarity may record how these pages are used. Nothing is recorded unless you press Accept. Reject takes the same single tap, and the site works exactly the same either way. Until you accept, no Microsoft code is loaded: the page does not even fetch it. If your browser sends Do Not Track or Global Privacy Control, you are not asked and nothing is recorded, and a Clarity cookie left from an earlier Accept is deleted.

Clarity never runs on the light pollution map, the aurora pages or Sky Director, and the bar is not shown there. Those pages keep the place you picked in their address, and Clarity records the address of every page it runs on.

If you accept, Clarity records the address of each page you visit, clicks, taps, scrolling, mouse movement and the page’s layout and visible text, so that we can replay a visit and see where the tool confused someone, along with the device type, browser and screen size. Microsoft works out a rough location from your IP address. The parts of the page that list or show your own files are masked: their text is replaced before anything is sent, so no file name leaves your tab. Your photographs are never part of it. Clarity records the structure of the page, not image data, and a picture made from your files exists only as a canvas, which Clarity cannot record, or as a temporary blob: address that nothing outside your tab can open.

Accepting lets Clarity set two cookies on this domain: _clck, which keeps a pseudonymous Clarity ID for a year, and _clsk, which joins the pages of one visit into one recording and lasts a day. Microsoft can also set its own cookies on clarity.ms and bing.com. Only analytics storage is granted; this site carries no advertising and grants nothing for ads. Microsoft keeps recordings for 30 days, and a favourite or randomly sampled recording can be kept for up to nine months. Microsoft’s own privacy statement applies to what it receives. Your answer is asked again after a year.

You can change your mind at any time with Privacy choices at the foot of every page. It forgets your answer, tells Clarity that consent is withdrawn, deletes Clarity’s two cookies on this domain itself, and asks you again. It cannot reach the cookies Microsoft set on its own domains, and it does not recall a recording already made, which Microsoft keeps for the time above.

The light pollution map

The light pollution map is the one page on this site that draws on anything outside it, so it is worth stating plainly what leaves your browser there and what does not. Nothing above changes: no photograph, no file you chose and no measurement taken from one is involved on that page at all, and there is still no upload endpoint anywhere on this site.

The brightness data itself is ours and is served from this domain — the atlas tiles, the overview grid and every calculation the panel shows are fetched from startrailstacker.com and run in your browser. So is the base map. The coastlines, roads and place names under the overlay used to be tiles fetched from a third party as you panned; since September 2026 they are drawn in your browser from a single map archive on this domain, which your browser reads a few kilobytes of at a time. That removed the one host this page reached on every visit, and it is why only one other host can be reached here at all:

• Elevation tiles from the public elevation-tiles-prod bucket on AWS, used to work out the horizon around a point. Terrain is off until you press the Terrain button. A first visit reaches no elevation host at all; pressing it fetches nine tiles around the point you chose, and that request carries those coordinates at roughly one-kilometre resolution and nothing else. Turning it on is remembered by your own browser, so on a later visit the map reads the horizon for the remembered point without waiting to be asked again — pressing Terrain a second time turns it off, and it stays off.

That request carries no photograph, no file, no account, no cookie and no identifier we set. The attribution these sources require, and their licences, are on how this map is made.

No third host is contacted to resolve the time zone. The map prints every time in the local time of the point you picked rather than on your own clock, and it works out which time zone that is in your browser, from a table served from this domain — the coordinate is not sent anywhere to resolve it, and no geolocation or time-zone service is contacted. The table’s own licence and how approximate it is are on how this map is made.

The aurora pages

Northern lights tonight, the aurora forecast, the Kp index, geomagnetic storm today and the place pages under them read live data that this site does not produce, and they read it the same way the map does: your browser fetches it directly, there is no server of ours in between, and nothing about you is stored anywhere but in your own browser. Two hosts are reached, each for one thing:

• NOAA Space Weather Prediction Center (services.swpc.noaa.gov): the aurora probability grid, the Kp index, the solar wind, the 3-day and 27-day forecasts, hemispheric power, scales and alerts. These are the same public-domain files for everyone; the request carries nothing about you or your location.
• MET Norway (api.met.no): the cloud and temperature forecast for the point you chose. This is the one request that carries your pin, rounded to two decimal places (about a kilometre), because a cloud forecast has to be for somewhere. It is fetched once per pin and cached in your browser until the forecast expires.

The pin itself lives in your address bar (so a bookmark keeps it) and in your browser's local storage; the "Use my location" button asks the browser for your position only when you press it, and the answer goes nowhere but into that pin. No photograph, no file, no account, no cookie and no identifier we set are involved on any of these pages. The alerts page offers free aurora emails. If you request them, we record a separate purpose choice, email address, location rounded to a quarter degree, IANA time zone, Kp threshold and optional quiet hours in a site-specific encrypted-at-rest database. Amazon SES receives only the address and message needed to send confirmations and alerts. A link expires after 48 hours; an unconfirmed request expires after 30 days. A confirmed subscription expires after 12 months without an alert sent or a new confirmation. Unsubscribing stops delivery immediately and marks the row for automatic deletion after 30 days; the email link also offers immediate deletion. These emails have HTML and equivalent plain-text copies, with no open or click tracking pixels. No alert data is attached to an optional site account, and accepting analytics or signing in never subscribes you.

Browser aurora alerts: a separate choice

Browser alerts are off until you explicitly enable them and grant browser notification permission. They need no email or account. We store your browser's push endpoint and encryption keys, quarter-degree location, time zone, Kp threshold, quiet hours and dated consent in the same site-specific encrypted-at-rest database, under a separate push partition. An opaque management key is saved in startrail.aurora-push.v1 in your browser; only its hash is stored by the server.

Notifications use your browser vendor's push service (Google, Mozilla, Apple or Microsoft). The vendor processes the endpoint and delivery metadata; the message is encrypted for your browser. It contains the observing note and a link for your chosen approximate location, never photographs, an email address or account identity. Notification text can appear on your lock screen. There are no push tracking pixels or click analytics.

A push-only service worker receives notifications and opens their safe site link after a click. It has no offline cache, fetch handler, photo processing or background location access. For an automatic alert it sends a same-site receipt after its request to display the notification completes. The receipt identifies that one alert, not an email address, browsing activity or a notification click. Checks use fresh NOAA Kp and oval data plus calculated darkness; clouds and Moon are not checked for the push. Quiet hours default to midnight–07:00 in your chosen time zone. At most one automatic alert is sent per local night, at least six hours apart. System Focus settings can prevent display even after the vendor accepts a push or the browser requests display.

If you confirm email on the same device as an active browser subscription with the same location and Kp choice, or explicitly link matching choices from an email preference link, we keep opaque cross-references between those two subscriptions. A linked browser is primary: we do not send its afternoon forecast email, and attempt one backup email only if no browser display-request receipt arrives within 15 minutes. A lost receipt can lead to both notifications; browsers cannot prove that the operating system actually showed one. You can unlink by stopping browser alerts, or unsubscribe and delete the email independently.

The subscription expires after 90 days unless you explicitly save settings to renew it; delivery alone does not renew consent. Expired unlinked browser endpoints are removed when the provider reports them; a linked expired endpoint can remain up to one day for the single backup decision. Stop browser alerts on the alerts page removes the server subscription and disconnects it in the browser, independently of email. Revoking permission or clearing site data can lose the management key; disconnect the old browser subscription and create a new one if needed. An inaccessible old server record expires within 90 days. Database backups can retain removed records for up to 35 days; they are not used for delivery. Contact us if you need help removing a record whose management key was lost.

Sky Director

Sky Director plans a shot from a latitude, longitude and UTC time that you type. They stay in the page’s memory: they are not put in the address, stored in the browser or sent anywhere, and a plan file you download contains them only because you downloaded it.

Its optional phone pointer reads your phone’s orientation sensors only after you ask twice: the first Enable loads its code, and the second asks your browser for motion and orientation access, and for the compass where the phone has one. It never asks for your position. To turn a compass heading into true north it uses the WMM2025 magnetic declination at the latitude, longitude and date you typed into the plan, computed in your browser from NOAA’s published coefficients, which are part of the page’s own code. It reads your device’s date and time once, at the moment you press Calibrate on Polaris, the Moon or your planned target, to work out where that object stands; a horizon bearing needs no time, and Sky Director’s own code reads the date and time at no other moment.

Sensor readings, that time and the calibration stay in the page’s memory. Nothing is stored or sent, no analytics event carries them, and Stop, hiding the page or leaving it clears them. No camera is opened.

What is not here

Unless you accept session recording, the page uses no tracking pixels, fingerprinting or cross-site identifiers, and its only third-party script is the cookieless analytics collector described above.

Video guides are hosted on YouTube. This site shows only its own poster image for each video; nothing from YouTube or Google is requested until you press play. Then the privacy-enhanced player from youtube-nocookie.com loads inside the page, and YouTube’s own privacy policy applies from that moment. Without JavaScript the card opens the video on youtube.com in a new tab instead.

Who is responsible, legal bases and your rights

The controller of the personal data described here is Vitali Bibikov, a sole proprietor (JDG) registered in CEIDG, NIP 5213977371, REGON 522636099, trading as AIErudit, Warsaw, Poland (registered in the Polish business register CEIDG; email support@startrailstacker.com). Privacy questions and requests can be sent through the contact page or by email to that address.

You do not have to give us any personal data to stack photographs. An account needs the email address and name Google sends when you sign in; aurora emails need an email address. Without them, those optional features are not available, and nothing else changes.

Service providers that process data for us: Amazon Web Services hosts the site, its content delivery, the API, the account database and alert email in the EU (Frankfurt, eu-central-1), with content delivered through its worldwide edge locations; the API’s technical logs are kept for 30 days and are not designed to record IP addresses. The cookieless usage statistics are collected by the analytics service at analytics.pagefabrica.com, a self-hosted Umami instance that we operate ourselves. Cloudflare provides the domain’s DNS only; site traffic does not pass through it. Google, for sign-in and Drive, Dropbox, and Microsoft, for session recording, act under their own terms as described above.

Some of these recipients process data outside the European Economic Area and the United Kingdom. Amazon Web Services processes our data in the EU (Frankfurt, eu-central-1); where data leaves the EEA or UK, the transfer relies on the AWS Data Processing Addendum, which incorporates the European Commission’s standard contractual clauses and the UK addendum, and on the EU-U.S. Data Privacy Framework where AWS is certified under it. Cloudflare answers DNS queries for the domain worldwide; a DNS query carries the address of the resolver that asks, normally your provider’s, not your device’s. Google (sign-in and Drive), Dropbox, Microsoft (session recording) and your browser’s push service may process data in the United States as independent controllers under their own terms, which name their transfer mechanisms . The analytics service’s location is Poland.

You can ask for access to, correction or deletion of your personal data, ask us to restrict its use, ask for a copy in a portable form, and object to uses based on legitimate interests. You can withdraw consent at any time without affecting earlier use. You can also complain to a data protection authority, in particular in the country where you live or work. Our lead authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

Contact

Support is available by email. The contact page gives the address and what to include.