Privacy Policy
What we collect, who it goes to, how long we keep it, and how to get it deleted.
Last updated October 17, 2026
The short version
You can use the dashboard without an account, and without telling us anything about yourself. If you create one, we store your email address and any locations you save, so we can tell you when the aurora is likely over them. We set no advertising or analytics cookies. We do not sell your data or share it for advertising. Email support@lightswatch.com and we will delete your account and everything attached to it.
Who we are
Lights Watch is operated by Objective Labs, LLC, 2006 7th St N, Sartell, MN 56377, USA. For anything in this policy — including a request to see, correct, export, or delete your data — write to support@lightswatch.com.
Under the UK and EU General Data Protection Regulation, Objective Labs, LLC is the data controller for the information described below.
What we collect
If you just visit the site
Nothing that identifies you. The dashboard reads public space-weather data from NOAA and shows it to everyone the same way. Our hosting provider, Cloudflare, records standard server logs — including your IP address — to serve the page and protect against abuse, as every web host does.
Page-view analytics come from Cloudflare Web Analytics and PostHog, and both are anonymous and cookieless: they store nothing on your device, assign you no identifier, and cannot follow you to other sites. That is why this site has no cookie banner — there is no non-essential cookie to ask you about.
PostHog tells us which pages are visited and which buttons get pressed, so we know what is worth improving. It never receives your email address, your saved locations, or any text shown on the page: on-screen text is masked before anything is sent, and web addresses are cut at the “?” so nothing after it is recorded. Visitors are counted with a daily hash that PostHog cannot reverse into who you are, and we never link analytics to your account. We do not record sessions.
If you create an account
| What | Why we need it |
|---|---|
| Email address | To send your sign-in code, and to deliver alerts if you turn on email alerts. |
| Saved locations | The coordinates and name of each place you want watched. Aurora visibility depends on geomagnetic latitude, so we cannot answer “can I see it from here” without knowing where here is. |
| Alert preferences | Your timezone, quiet hours, sensitivity, KP threshold, and cooldown — so alerts arrive when you want them and not at 3am. |
| Push subscriptions | If you enable push notifications, the endpoint and encryption keys your browser issues, plus a note of which browser it was, so you can tell your devices apart. |
| Alert history | A record of alerts we sent you. This is what stops us sending you the same alert six times in one night. |
Your location
We only ever have the locations you deliberately add. We do not track you in the background, and the site never asks for your location unless you press the button that asks for it.
When you add a place — by pressing “use my location”, or by typing a ZIP code or city — we send that input to Nominatim, the OpenStreetMap Foundation’s geocoding service, to turn it into coordinates and a readable place name. If you use the button, that means your device’s coordinates reach OpenStreetMap. Their handling of it is covered by the OpenStreetMap Foundation privacy policy. If you would rather not, type a city name instead — it is accurate enough for aurora forecasting.
Cookies and local storage
| Name | Purpose | Type |
|---|---|---|
sb-*-auth-token | Keeps you signed in. Set only after you sign in, cleared when you sign out. | Strictly necessary |
| Install-prompt key | Remembers that you dismissed the “add to home screen” prompt. Stored in your browser only, never sent to us. | Local storage |
That is the entire list. There are no advertising cookies, no analytics cookies, and no cross-site trackers. Strictly necessary cookies do not require consent under the EU ePrivacy Directive or UK PECR, which is why you are not being interrupted by a banner.
Why we are allowed to use it
If the UK or EU GDPR applies to you, our legal bases are:
- Contract — we cannot run an account, save your locations, or send the alerts you asked for without this data.
- Legitimate interests — keeping the service secure and working, and understanding aggregate traffic through cookieless analytics that cannot identify you.
- Consent — browser push notifications, which your browser asks you for separately and you can revoke at any time.
Who else sees it
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use the following service providers to run Lights Watch. They handle your information only to provide their service to us, and are not permitted to use it for their own purposes:
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Account database and sign-in | United States |
| Cloudflare | Hosting, security, cookieless analytics, inbound email routing | Global edge network |
| PostHog | Anonymous, cookieless analytics of page views and button presses | United States |
| Resend | Sending aurora alert emails | United States |
| DreamHost | Sending sign-in emails, and our NOAA data cache | United States |
| OpenStreetMap Foundation | Turning a place name or coordinates into a location | United Kingdom and Germany |
| Apple, Google, Mozilla | Delivering push notifications to your device, if you enable them | Global |
We will also disclose information if the law genuinely requires it, and we would tell you unless we were legally prevented from doing so.
Where your data is stored
Our database runs in the United States, in Amazon’s Ohio region. If you are in the United Kingdom or the European Economic Area, your information is transferred there. Those transfers rely on the UK and EU Standard Contractual Clauses, or on the EU-US and UK-US Data Privacy Framework where the provider is certified under it.
How long we keep it
- Your account, locations and preferences — for as long as your account exists. Delete a saved location at any time from your account page and it is gone immediately.
- Push subscriptions — until you turn push off, revoke the permission in your browser, or the device’s push service tells us the subscription is dead.
- Alert history — kept while your account is open so we can enforce the cooldown between alerts.
- Everything — deleted within 30 days of you asking us to close your account.
- Server logs — retained by Cloudflare on their standard schedule, which is measured in days, not years.
Your rights
Wherever you live, you can ask us to do all of the following, and we will not charge you or treat you differently for asking:
- Tell you what we hold about you, and give you a copy of it.
- Correct anything that is wrong.
- Delete your account and everything attached to it.
- Export your data in a machine-readable format.
- Stop sending you alerts, without deleting your account.
Email support@lightswatch.com from the address on your account. We will respond within 30 days. We may need to confirm it is really you before acting on a request, which for an account like this usually means replying from the registered email address.
If the UK or EU GDPR applies to you, you also have the right to object to or restrict processing, to withdraw consent at any time, and to complain to your national data protection authority. In the UK that is the Information Commissioner’s Office. We would rather you told us first, so we can put it right.
If you are in California, Colorado, Connecticut, Virginia or another US state with a privacy law, the same rights apply. We do not sell or share personal information as those laws define it, so there is nothing to opt out of. Saved coordinates count as sensitive personal information in California, and we use them for one purpose only: working out whether the aurora is visible from that spot.
Children
Lights Watch is not directed at children under 16, and we do not knowingly collect their information. If you believe a child has created an account, write to support@lightswatch.com and we will remove it.
Security
The site is served over HTTPS. Account data sits behind row-level security, so one account’s rows cannot be read by another. Sign-in uses one-time codes rather than passwords, so there is no password of yours for anyone to steal. Push notification payloads are encrypted end-to-end to your device.
No service can promise perfect security. If we ever suffer a breach affecting your personal data, we will notify you and the relevant authority as the law requires.
Changes
If we change this policy in a way that matters, we will update the date at the top and, for anything significant, email account holders. Continuing to use Lights Watch after a change means you accept the updated policy.
Contact
support@lightswatch.com
Objective Labs, LLC, 2006 7th St N, Sartell, MN 56377, USA
See also our Terms of Service.