Privacy Policy

1. Who we are

This Privacy Policy explains how [Company legal name] ("we", "us"), with its registered office at [Address], Poland, registered under [KRS / CEIDG number], tax ID (NIP) [Tax ID], handles personal data in connection with:

• the Photons mobile application for iPhone and Android (the "App"), and
• the website at https://photonsapp.com and its subpages (the "Website").

We are the data controller for the processing described here. You can contact us about privacy at [Contact email] or by post at the address above. [If a Data Protection Officer is appointed: Our Data Protection Officer can be reached at [DPO email].]

2. The App

2.1 What the App does not do

• It does not require or offer an account or login.
• It does not contain advertising, analytics, crash-reporting or tracking software, and it contains no third-party SDKs.
• It does not send any data to servers operated by us or on our behalf. We do not receive your location, your camera feed, your searches or your saved plans.
• It does not track you across apps or websites, and it does not sell or share personal data.

2.2 Location

• What: your device's location, which the App requests at about 100-metre accuracy, while you use the App. If you allow only approximate location for Photons in your phone's settings, the App works with your approximate location. The App asks for permission to use location only while you use the app and never uses location in the background.
• Why: to calculate sunrise, sunset, golden hour, blue hour and Sun and Moon positions for where you are, and to centre the map on you.
• Where it goes: the calculations happen on your phone. If you save a plan for your current location, its coordinates are stored in that plan on your device. To show the name of the place you are in and determine its time zone, the App automatically sends your coordinates to your phone platform's geocoding service when your location is first found and again after you move about 2 km (see 2.6).
• Your choice: you can refuse or withdraw location access at any time in your phone's settings (on iPhone: Settings > Privacy & Security > Location Services > Photons). Without location access, choose a place by search or on the map; until you do, the App shows a default place (Kraków).

2.3 Camera

• What: the live image from the rear camera, only while the AR view is open, after you grant permission.
• Why: to draw the paths of the Sun and Moon over the real scene.
• Where it goes: the image is shown on screen and processed in memory. The App does not record photos or video and does not access your photo library. When you tap Save in the AR view, a single still frame with the sky paths drawn on it is stored as the cover image of that saved plan, on your device.
• Your choice: you can refuse or withdraw camera access at any time in your phone's settings (on iPhone: Settings > Privacy & Security > Camera > Photons). Without camera access, every feature except the AR view works normally.

2.4 Motion and compass sensors

The App reads the gyroscope, accelerometer and magnetometer while the AR view is open, to know where your phone is pointing. These readings are used live and are not stored or transmitted. The operating system does not show a permission prompt for this.

2.5 Saved plans

Plans you save contain a name, place name, coordinates, date or time, an optional subject location, the time zone and a small preview image (a map snapshot or the AR frame described in 2.3). They are stored locally in the App's storage on your phone. They are not synced to any cloud service or to us. They may be included in your own device backups according to your phone's backup settings (on iPhone, including iCloud Backup if you use it). Deleting a plan in the App, or deleting the App, removes them from the App.

2.6 Map and location services used by the App

The App uses the map and location services of your phone's platform, which connect to that provider's servers to:

• display map tiles;
• suggest and look up places when you type in the search field (the provider receives the text you type);
• convert coordinates into a place name and time zone, automatically for your current location and for places you pick (the provider receives the coordinates);
• create map preview images when you save a plan (the provider receives the place's coordinates).

These requests go from your device directly to the provider, which processes them under its own privacy policy. We do not receive this data.

• On iPhone, the provider is Apple (MapKit and Core Location frameworks), under Apple's privacy policy (https://www.apple.com/legal/privacy/). Apple states that Maps data is not associated with your Apple Account.
• On Android, the provider is [map, search and geocoding provider used by the Android app], under [its privacy policy URL]. [Fill from the Android build before publishing; do not guess.]

2.7 App stores

• When you download the App, the store you use (Apple's App Store or Google Play) processes your purchase and download data under its own terms. The store may share with us aggregated, anonymous statistics (for example, number of downloads), which do not identify you.
• If you have agreed in your phone's or store's settings to share diagnostics with app developers, the store may provide us with crash reports and diagnostics. We use them only to fix problems.

2.8 Children

The App is not directed at children under 13 (or under 16, where national law requires). The App itself does not send personal data to us.

3. The Website

3.1 Contact form and email

• Data: name, email address, topic, message, optional device details, and the date and time of sending.
• Purpose and legal basis: to answer your message (Art. 6(1)(b) GDPR where it concerns a contract or steps before one, otherwise our legitimate interest in replying, Art. 6(1)(f)). Where you give consent in the form, Art. 6(1)(a).
• Retention: up to 24 months after our last exchange, unless we need it longer to establish or defend legal claims.
• Processors: our email and form provider [Email/form provider, e.g. a transactional email service] and our hosting provider (see 3.4).

3.2 Visit statistics

[Option A, recommended - cookieless analytics:] We use [Analytics provider], a privacy-friendly analytics service that does not use cookies and does not collect personal data or track you across sites. It records aggregated information such as pages viewed, referring site, country, browser and device type. IP addresses are not stored. Legal basis: our legitimate interest in understanding how the Website is used (Art. 6(1)(f) GDPR).

[Option B - cookie-based analytics:] With your consent (Art. 6(1)(a) GDPR, Art. 399 of the Polish Electronic Communications Law [legal review: confirm article]), we use [Analytics provider] to measure visits through cookies. It runs only after you click "Accept analytics" and you can change your mind at any time via "Cookie settings" in the footer.

3.3 Cookies and local storage

Essential cookies are needed for the Website to work and do not require consent. You can block or delete cookies in your browser settings; some features (like the language choice) may then reset.

3.4 Server logs and hosting

When you visit the Website, our hosting provider [Hosting provider, e.g. Vercel Inc.] automatically processes technical data needed to deliver the pages and keep them secure: IP address, date and time, requested URL, referrer, browser and operating system. Legal basis: legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Logs are kept for up to [30] days.

3.5 Embedded content and links

The Website does not embed third-party social media widgets or video players [confirm]. Links to the App Store, Google Play and social networks take you to services with their own privacy policies.

4. Who receives data

We do not sell personal data. We share it only with:

• service providers who process it on our behalf under a data processing agreement (hosting, email, [analytics]);
• the provider of your phone platform's map and location services (Apple on iPhone) and the app store you download from (Apple or Google), as described in section 2, acting as independent controllers;
• authorities, where the law requires it.

5. Transfers outside the EEA

Some providers may process data outside the European Economic Area, for example in the United States. In that case we rely on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

6. Your rights under the GDPR

You have the right to:

• access your personal data and get a copy;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict processing;
• data portability, for data you provided based on consent or a contract;
• object to processing based on our legitimate interests, at any time;
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain to the authority in your EU country of residence or work.

To exercise your rights, email [Contact email]. We reply within one month. Apart from the app store data described in 2.7, we hold no App data about you, because the App stores everything on your device: to delete it, delete your saved plans or the App itself.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

7. Security

We use encrypted connections (HTTPS) for the Website, limit access to personal data to people who need it, and choose providers with appropriate security measures. App data is protected by your phone's own security, including its passcode and encryption.

8. Changes to this policy

We will update this policy when the App or Website changes, for example when new features are added. The date at the top shows the latest version. If a change significantly affects how we use your data, we will publish it on the Website and mention it in the App's release notes in the App Store and Google Play before it takes effect.

9. Contact

[Company legal name] · [Address] · [Contact email]