Privacy Policy

Skyshot Solver (skyshot.app) · version of 12 October 2026

In short. Your images never leave your browser: stars are detected on your computer and only their positions are sent. The site sets no cookies and uses no third-party analytics or advertising trackers; we count visits ourselves, on our own server, without cookies and without storing your address. We keep request logs with shortened network addresses for 30 days. If you write to us or create a free account, we keep your e-mail address for that purpose only.

1. Controller

Afterstate PSA, ul. Plac Europejski 2, 00-844 Warszawa, Poland (“we”). Contact for all privacy matters: hello@afterstate.ai.

2. What we process and why

2.1 Using the website and the API

Every request to the solver is logged: the time, the route and result, a key or account identifier, your network address shortened to its first three IPv4 bytes (/24) or the IPv6 /48 prefix, the image width and height, the field-of-view range, the number of stars sent, timings, and the name and version of the client program. We never log the position of your field on the sky. Purpose: operating, securing and debugging the service and preventing abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Kept for 30 days.

2.2 Your images

The panel decodes your image and detects its stars in your browser. Only a list of star positions and brightnesses (and the image size) is sent to the solver. Images are not uploaded and not stored by us.

2.3 The demo without a key

To limit the free demo, your browser solves a small computational puzzle bound to your network address, and we keep a keyed fingerprint (HMAC) of your address (IPv4, or IPv6 /48) and the day the demo was issued, so that one address gets one demo per 30 days. The fingerprint cannot be turned back into the address without our secret key; because we hold that key, it is still personal data. The demo token is kept in your browser and on our server for up to 24 hours. Legal basis: legitimate interest in preventing abuse of a free service (Art. 6(1)(f)). Kept for 30 days.

2.4 Free account (e-mail)

If you request a free key, we process: your e-mail address (to send you codes and notices about your account), keyed fingerprints of the address, hashes of your keys, the account identifier, the creation date, the accepted terms version, the date of the last solve and usage counters (solves, star lists, processing time). Patterns of use (number of networks, image sizes, share of unsolved requests) are checked for abuse and can lead to the account being disabled by a person. Legal basis: the contract for the free service (Art. 6(1)(b)); abuse prevention (Art. 6(1)(f)). You must be 16 or older.

2.5 Contact form

We store what you send (name, e-mail address, optional organisation, topic, message), the language, the time, a message identifier and your network shortened to IPv4 /24 or IPv6 /32, and forward the message to our mailbox. Purpose: answering you. Legal basis: our legitimate interest in answering enquiries, or steps taken at your request before a contract (Art. 6(1)(f) and (b)). Kept until the matter is closed and then for up to 12 months.

2.6 API keys

Keys are stored only as cryptographic hashes; we cannot read your key back. The key itself is kept in your browser.

2.7 Statistics

We count daily totals (for example the number of solves or sign-ups) without identifiers. Daily files are kept for 90 days, then only monthly totals.

2.8 Visit statistics

When a page of this site is shown, your browser sends a short notice to our server (skyshot.app only): the page, the domain of the site that linked to it (never the full address of that page), the campaign tags of the link (utm_source, utm_medium, utm_campaign), how long the page was visible, and named steps such as “image loaded”, “solved” or “poster saved” (never the image, the stars or the position on the sky). From the request itself we derive the country and region of your network address, using a geolocation database kept on our server (IP Geolocation by DB-IP, CC BY 4.0), the first language your browser asks for, and a coarse browser, system and device type from the user agent. Solves are counted with their time, tier, result, country, region and client type.

To tell visits apart without cookies, we compute an identifier from your address, the user agent and a random value that changes every day. The random value is deleted when the day ends (UTC); after that the identifier cannot be linked to an address, nor to your visits on other days. Your address itself is not stored for statistics. Purpose: knowing how the site is found and used, and improving it. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). The data stays on our server, is kept for 400 days and is seen only by our team. You can object by writing to us; a browser that blocks the script /beacon.js sends no notices.

3. Cookies and storage in your browser

This site sets no cookies for visitors and uses no third-party analytics, advertising or tracking tools; the visit statistics of section 2.8 are counted on our server without cookies. Only our team’s internal statistics panel (/admin) sets a sign-in cookie, strictly necessary for it. Your browser’s local storage keeps only what the site needs to work: your language, your API key or demo token, the panel settings, the dismissal of the notice about this, and during a sign-up the pending sign-up in session storage. This storage is strictly necessary for the service you request, so it needs no consent; you can clear it in your browser at any time.

4. Content from others that you choose to load

5. Recipients and where data is processed

These providers process data on our behalf under data processing agreements. We do not sell data and do not share it for advertising.

6. Retention at a glance

DataKept
Request logs (shortened addresses)30 days
Solar system answers (field and time, no address)30 days
Visit statistics (no addresses; daily identifiers)400 days
Daily random value behind those identifiersto the end of the day (UTC)
Demo: address fingerprint / token30 days / 24 hours
Free account and its addressuntil deletion, or 12 months after the last solve
After deletion: address fingerprint and allowance leftto the end of that month
“Stop” list (fingerprint)12 months
Pending sign-up15 minutes
News consentuntil withdrawn
Contact messagesuntil closed, then up to 12 months
Abuse flags90 days
Backupsup to 14 days

7. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. A free account can be exported and deleted in the panel (a code is sent to the account’s address to confirm); for anything else write to hello@afterstate.ai. Because we do not keep identifying data for the demo or the logs, we may ask you for details (for example your network address and the time) to find your entries. You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, Poland.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic limits (for example the number of requests per address) only pause access; disabling an account is decided by a person.

8. Security

Connections use TLS. The server is hardened and isolated from other services on the host; addresses in logs are shortened, keys are stored only as hashes, and identities in the demo and the free tier are kept as keyed fingerprints.

9. Changes

We will publish changes here with a new date. Material changes affecting free accounts are announced in the panel.