Celeris
DE·EN
Get app

Legal

Privacy policy

This policy covers the Celeris app — for iPhone, iPad, Mac and Android — and this website. They are treated separately because they work differently: the app computes on your device, the website by its nature sits on a server.

In short: Celeris has no accounts, no trackers, no ads and no analytics. All astronomical calculations run on your device, and so do the time zones. The only thing of mine that takes data in is the small script behind the feedback form — it turns what you write into one email to me and keeps nothing. The app talks to four outside services: the map service of the platform it runs on — Apple on iPhone, iPad and Mac, Google on Android — for the map and the place search; RevenueCat, to find out whether the purchase exists on this device; a content delivery network, from which it fetches elevation data, places and 3D models as ready-made files; and CelesTrak, from which it fetches the orbital elements the International Space Station is drawn from. On top of that there is the optional sync: it keeps your plans, places and 3D objects in step across your own devices — through your own iCloud, or your own Google Drive on Android. Sync transfers those saved contents into your account with the respective provider. You may also export contents through the share sheet; operating-system backups may include app data.

Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Stefan Engel
Talstr. 25
66994 Dahn
Germany
Email: info@stefan-engel.biz

No data protection officer has been appointed; the statutory conditions for one are not met.

The Celeris app

What the app does not do

The app's own privacy manifest declares no tracking and no data types collected by me; on Android the data safety form on Google Play says the same. The bundled RevenueCat SDK carries its own manifest and declares purchase history there — not linked to your identity and not used for tracking. See the section on the purchase below.

What is stored on the device

The app remembers a few things locally so that it carries on where you left off:

These values live in the app's own settings and in a shared container the widgets can read; the tiles live in the caches directory, which iOS and Android may also empty of their own accord when space runs short. Saved content remains local unless you share it or use the sync described below. Network functions send the requests described in their respective sections. Deleting the app does not automatically erase data in iCloud, Google Drive or existing backups; local app data can also remain on a Mac. Device backups and restoration follow system settings and the app’s backup rules.

Sharing a planned night makes the picture for it on the device and hands it to the system's share sheet. Where it goes from there — into a message, into your photos, into a social network — is yours alone to decide; the app sends it nowhere.

Sync between your devices (iCloud, Google Drive)

What you have saved can be kept in step across the devices that are yours. Sync transfers saved contents into your own account with the platform provider, not to a Celeris server. Because Apple platforms and Android go about it differently, both are described here.

What travels:

No movement history or usage statistics are synchronised. Plan coordinates identify the planned standpoint; when taken from a GPS fix, this may also be your actual location. The platform provider processes the sign-in information needed to access your account.

On iPhone, iPad and Mac the sync runs through iCloud (CloudKit) into your own private iCloud database. It is on as soon as the device is signed into iCloud, and a switch in the app's settings turns it off. The data sits under your Apple account; I have no access to it, and no server of mine is involved. Switching the sync off stops any further transfer — what is already in iCloud stays there and can be removed in the iOS settings, under your name in the iCloud section, by deleting the app's iCloud data.

On Android the sync runs through Google Drive, and only if you ask for it: nothing is transferred until you turn the switch on in the app's settings and confirm Google's own consent dialogue. What is transferred lands in the app-private area of your own Google Drive, the appDataFolder — it does not show up among your ordinary Drive files, I cannot reach it, and here too no server of mine is involved. You can withdraw the app's access at any time in the security settings of your Google account, and delete what is stored there in Google Drive under Settings and “Manage apps”. Switching the sync off stops any further transfer.

In both cases the data goes straight from your device to Apple's or Google's servers over an encrypted connection (TLS). Apple and Google hold it as what it is — storage in your own account — and process it under their own privacy policies. The two worlds stay apart: nothing from iCloud reaches Google, and nothing from Google Drive reaches Apple. I never see any of it, never receive it, and have no way of asking for it.

The purpose is keeping your own devices in step; the legal basis is Art. 6(1)(b) GDPR on Apple platforms, where the sync is part of the function you use, and your consent on Android, Art. 6(1)(a) GDPR, given through Google's dialogue and withdrawable at any time. This too is dispensable: leave the switch off and the app stays fully usable, with everything kept on the device as described above. Where Apple and Google physically store the data, and whether a transfer to a third country is involved in that, follows from your account with them and their terms — this storage is part of your arrangement with them, not of a contract of mine.

Providers: Apple Inc. and Apple Distribution International Ltd. (addresses as above; details in Apple's privacy policy) and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (details in Google's privacy policy).

Location, compass and motion sensors

The app uses the device location when you choose “My location”. On supported mobile devices, AR standpoint guidance that you start also needs current position fixes to determine direction, distance and arrival at the planned spot. Several GPS readings may be needed. Guidance ends on arrival or when you stop it; no movement history is recorded.

Position accuracy and, where appropriate, GPS altitude also help align the simulated terrain. Calibration belongs to the current situation. Compass and gyroscope readings control the viewing direction on the device; sensor histories are not sent to a Celeris server.

Permission is voluntary and can be withdrawn in system settings. Without it you can still plan on the map and search for places. Precise AR guidance may request a more accurate location permission. The legal bases are consent through the system dialogue, Art. 6(1)(a) GDPR, and performing the selected function, Art. 6(1)(b) GDPR.

When a measured position becomes the planning location, it may be included in the last saved map position, a saved plan or a saved place. Map and geocoding requests and the area downloads described below may concern that location. Their recipients are described in the following sections.

Camera in AR mode

On supported mobile devices, Celeris uses the camera with your permission to overlay the calculated sky on a live view. The picture is displayed on the device; Celeris does not record video, upload camera frames or need a microphone. Saved plan previews are rendered from the simulation, not captured from the live camera.

You can switch the camera off or revoke permission in system settings at any time. Other planning functions remain available. The legal basis is your consent, Art. 6(1)(a) GDPR. The Mac app does not offer this camera/AR function.

Maps and place search (Apple, Google)

For three things the app relies on the system services of the platform it runs on, which in turn talk to that platform's servers — Apple's on Apple platforms, Google's on Android:

The time zone no longer comes from there: the app carries a table of time zone boundaries and works it out on the device. On Apple platforms Apple's answer is taken as a correction only when the geocoding replies anyway; on Android the geocoder returns no time zone at all, so the table alone decides.

The coordinates and search inputs concerned are transmitted to Apple or to Google respectively and processed there on their terms. I do not receive this data and have no access to it. The legal basis is Art. 6(1)(b) GDPR, as these functions are an essential part of the app.

Providers: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, and Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (details in Apple's privacy policy); Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (details in Google's privacy policy).

Terrain, places and 3D models (file downloads)

For the selected planning area, Celeris downloads public files over HTTPS from celeris-terrain.b-cdn.net (terrain), celeris-poi.b-cdn.net (place markers) and celeris-objects.b-cdn.net (ready-made models). These requests need no Celeris account and contain no saved plans, user-built models or Celeris-assigned user identifier.

As with other network requests, the provider processes the IP address, requested file, request time and technical HTTP information. File paths reveal the area being viewed: place and model cells span 1°; terrain tiles reach down to 1/16° × 1/16°, depending on detail level. Multiple requests can narrow down the planning area further. The current device location is not sent as a separate GPS field, but it may coincide with the planned location.

Manifests describe coverage. Downloaded data are cached locally. The model catalogue checks the published content revision; changed models are fetched through new revision-specific paths. A revision identifies a dataset, not a user. This prevents an unchanged file address from serving an old model indefinitely.

Without a connection, existing cached data remain usable. Missing files mean flat ground or absent place/model markers. Astronomical calculations continue locally. The ready-made 3D objects switch under More stops their display and further downloads; it is not an upload switch for your own models. Downloaded terrain can be deleted in Settings.

The purpose is to display the selected landscape; the legal basis is Art. 6(1)(b) GDPR.

Provider: BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. A data processing agreement under Art. 28 GDPR is in place (DPA). According to the operator configuration, the existing terrain and POI zones use EU delivery with access logging disabled. This statement is not extended without verification to the newly added model zone. The provider operates a worldwide network; processing and deletion depend on the zone configuration and contractual terms. Data protection information and bunny.net privacy policy.

Orbit data for the ISS (CelesTrak)

To draw the International Space Station in the sky and to work out its passes, the app needs the station's current orbital elements. It fetches them over HTTPS from celestrak.org — a single small text file, the station's public orbit record, the same for every user. It is a plain file request with no sign-in — no accounts, no cookies, no identifiers.

What is transmitted is your device's IP address and the request for this one file, which is the same every time. Unlike the tiles it names not even a region: the request is identical for everyone and says nothing about you beyond the fact that an app wants to know where the station is.

The app asks only when the station is needed somewhere — in the sky, in the list of its crossings of the sun and the moon, or in the calendar — and only while it has no copy or the copy it has is more than three days old; the file stays on the device. The widgets never fetch it themselves; they read the app's copy. Passes and transits are calculated locally; planned locations and search results are not sent to CelesTrak. Turning the ISS display off stops orbit downloads.

The purpose is drawing the station and computing its passes, the legal basis Art. 6(1)(b) GDPR. This too is dispensable: without a connection, a still-usable local copy may be used. Without usable orbit data, the station is not drawn — better no station than one on the wrong piece of sky — and everything else in the app works unchanged.

Provider: CelesTrak, a non-profit organisation under US law (501(c)(3)) run by Dr. T. S. Kelso, USA. The request therefore goes to a third country; it is occasional and necessary for the function you asked for, Art. 49(1)(b) GDPR. By its own account CelesTrak sets no cookies and collects no personal data beyond IP addresses, which serve solely to fend off abuse and to gauge the load on its systems — not for tracking — and are not passed to third parties (celestrak.org).

Obtaining the app through the App Store and Google Play

On iPhone, iPad and Mac, purchase, download and updates are handled by Apple. Data arising there — your Apple account identifier and purchase information, for instance — is processed by Apple under its own responsibility. What I see of it is aggregated, non-personal sales and crash statistics in App Store Connect.

On Android the same is true of Google. Purchase, download and updates are handled by Google Play, and the data arising there — your Google account identifier and purchase information — is processed by Google under its own responsibility. What reaches me is again aggregated and non-personal: sales figures and crash statistics in the Play Console.

Checking the purchase (RevenueCat)

Celeris has one one-time in-app purchase — billed through the App Store on Apple platforms and through Google Play on Android. Whether it exists on this device is checked through the RevenueCat service in the same way on both — on launch, and when something is bought or restored. What is transmitted:

I see neither your name nor your Apple or Google account nor your email address in any of this — what stands in RevenueCat is a random identifier. The sole purpose is to unlock what was bought and to restore it on a new device. The legal basis is Art. 6(1)(b) GDPR: without this check the purchase contract cannot be performed.

Provider: RevenueCat, Inc., 300 Broadway, Suite 30, San Francisco, CA 94133, USA. A data processing agreement is in place; the transfer to the USA rests on the European Commission's standard contractual clauses. Details in RevenueCat's privacy policy.

Feedback, wishes and reports from the app

Four places in the app let you write to me, and none of them opens a mail app: the row “Feedback to Stefan” on the info screen, which the rating card also leads to if you give fewer than five stars; the row “Send a bug report”, under “More”, beneath “Info”; the wish for a new 3D model, under “More”, in “Predefined 3D models”, the row “Suggest a new 3D model”; and the report about a model that already exists, under “More”, the row “Feedback on a 3D model”. The two model rows belong to the full version; the bug report is free, like the feedback. Each of them opens a form in the app. Every message carries your name and your email address, the text you wrote, the language the app is set to, the app version and build, the system version, the device model (“iPhone17,1” or “samsung SM-A528B”, for instance) and the time you sent it. A wish adds the name of the model, what kind of thing it is, the place you picked on the map as coordinates, and why you think it is worth it; a report adds which curated model it is about — its identifier, its name and its coordinates —, what is wrong with it and your details. A bug report adds nothing of its own; instead the form lists the technical details it will send — the app version and build, the system version, the device model and the language the app is set to — under their own heading, “Sent along with the report”, so that you read what goes along rather than guess at it. Nothing beyond what every message carries is attached to it: no location, no plans, no device identifier. Name and address are required because answering you is the point of the message; the technical details are there so that a report can be placed.

The message travels encrypted over HTTPS to a small script on this very website, https://celeris-app.com/api/landmark-feedback.php. It sits on the same webspace as the rest of the site, with 1blu, the provider named under This website and bound by the same data processing agreement. The script checks the message, turns it into one email and hands that to the provider's mail system. It stores nothing: no database, no copy of what you wrote. All it writes are small counters against floods — a salted hash of the sending IP address for the day with a count beside it, and two counters that belong to nobody in particular. They live in a temporary directory and are swept after two days, and the hash cannot be turned back into an address. Beyond that, the request appears in the provider's ordinary server log like every other request to this site — IP address, time and path, as described under “Hosting and server log files”. The app sends two headers and a token along with the request; that is a technical measure against automated spam, and it identifies the app, not you.

The mail lands in my mailbox at feedback@celeris-app.com, a mailbox kept for exactly this, carrying your address as its reply-to so that I can simply answer. There it stays for as long as I need it to deal with the matter and to answer you; there is no further processing, no profiling and nothing passed on to anybody. The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in answering what you wrote to me. You can ask me to delete your message at any time at that address — see Your rights.

See also: Delete your data — one page that names every place something of yours can sit, the device, your own iCloud or Google Drive, the stores and this mailbox, and how each of them is emptied.

Your name and your email address stay on the device once you have written, so that the form need not ask again. They are kept locally and nowhere else: they are not part of the sync and are sent to no one but me, with the message you write. Clearing the two fields removes them.

This website

Hosting and server log files

This website is hosted by 1blu AG, Riemannstraße 1, 10961 Berlin, Germany. There is a data processing agreement with the provider under Art. 28 GDPR: 1blu processes the access data named below solely to perform the hosting contract and is bound by my instructions in doing so. The servers are in Germany; no transfer to a third country takes place.

When a page is requested, the server automatically records the usual access data:

This data is technically necessary to deliver the site, keep it stable and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and undisturbed operation of the site. It is not combined with other data, and no profiles are built from the log files.

The script that takes feedback, wishes and reports from the app runs on this same webspace, so its requests appear in this same log — see Feedback, wishes and reports from the app.

For the retention period 1blu names no fixed term but criteria (Annex 3 to the data processing agreement): full IP addresses are recorded only as far as the proper operation of the servers requires it — to fend off attacks, to establish misuse of services, or for disclosure to law enforcement authorities. Log files holding unmasked IP addresses are rotated automatically. Where IP addresses are kept for longer, as the basis for access statistics for instance, one octet (IPv4) or one hextet (IPv6) is masked, so that they can no longer be attributed to a particular person.

No cookies, no analytics

The site sets no cookies and uses no analytics, reach measurement or tracking tools. There is no cookie banner because nothing is loaded from a foreign server unless you set it off yourself. Fonts, images, stylesheets and scripts are all on this server — no web fonts, no CDNs, no embedded maps. The short, silent app clips on the start page and the product pages are served from this server too and request nothing from third parties. The one thing embedded from a third party is the film on the start page, and it waits for your click: see The film on the start page (YouTube).

A few external sites are linked, such as GitHub and Creative Commons. Apart from the store redirect described below, your browser connects to such a provider only when you click its link. The provider is responsible for its own data processing.

The film on the start page (YouTube)

The start page carries the Celeris film. Until you start it, all that lies there is a still frame from this server and an ordinary link: no request goes to YouTube or Google, no script of theirs is loaded, and no cookie of theirs is set. Without your click, Google learns nothing of your visit.

Only when you click the play button is the player loaded — from youtube-nocookie.com, YouTube's extended privacy mode. From that moment there is a connection to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It receives the connection data technically required to play the film, in particular your IP address, the time, and browser and device information, may store information on your device, and processes all of it under its own responsibility — by its own account also outside the European Union. The details are in Google's privacy policy. I have no influence on the content or the extent of that processing.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give with that very click and which you may withdraw at any time with effect for the future by reloading the page and not starting the film. The consent is not stored — neither in a cookie nor in browser storage — so every page view begins at the still frame again. The still frame itself is a single frame of the film and lies on this server; no thumbnail is fetched from YouTube. The player is embedded so that it suggests no videos from other channels afterwards. With JavaScript switched off the link stays a link and opens the film on YouTube in a new tab — the same deliberate step.

Store redirect at /get/

A recommendation link shared from Celeris first opens the /get/ page. A script running solely in your browser uses the device and system information supplied by the browser to distinguish Android devices from Apple devices, and among Apple devices a Mac from an iPhone or iPad, so that the App Store opens the listing for your platform. It then redirects you to Google Play or the App Store. If the device cannot be identified clearly, or JavaScript is disabled, the page remains visible with buttons for both stores.

The device classification is not stored, sent to me or combined into a profile. The page uses neither cookies nor local browser storage for this. The initial request for /get/ produces only the hosting access data described above. The browser-side classification serves solely to open the appropriate store without an additional choice. The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in making the app available simply and in a way appropriate to the recipient's platform.

On redirect, your browser connects to Apple or Google. The chosen provider receives the connection data technically required to open the page, in particular the IP address, time, browser and device information, and processes it under its own responsibility. The redirect page sends no referrer. For details, see Apple's privacy policy or Google's privacy policy.

Language preference and model catalogue

The address you open determines the language. DE and EN link directly to the corresponding translation; browser language and language choices are not read or stored. A language preference saved by an earlier version under celeris.language is removed locally on your next visit.

The 3D catalogue search and country filter run entirely in your browser. Search terms are neither transmitted nor stored persistently. Model previews are hosted on this webserver and loaded on demand like other images, producing the server requests described above. No external maps or third-party model viewers are embedded. Only clicking an external source or data link connects you to that provider.

Contact by email

These pages carry no contact form; the form in the app is described above. If you write to me, I process your address and the content of your message in order to answer it. The legal basis is Art. 6(1)(b) GDPR for enquiries about the app and Art. 6(1)(f) GDPR otherwise. Messages are kept for as long as handling them requires and are deleted afterwards, unless statutory retention periods say otherwise.

Your rights

You have the following rights against the controller:

An informal mail to info@stefan-engel.biz is enough for any of these.

Independently of that, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for instance the authority responsible for my place of residence or the one where you habitually reside.

This policy is current as of 26 September 2026. It is a translation for convenience; in case of doubt the German version applies.