PERIGEE is a real-time 3D map of everything near Earth. It is built to be private by default. This policy describes exactly what it does and does not do with your data — in plain terms, with no legalese padding.
PERIGEE has no accounts, no third-party analytics, no ads, and no tracking. There is no login, no advertising identifier, no cross-app tracking, and no behavioral profiling. What you look at in the app is not measured or reported to us or to anyone else. The two things that do leave your device besides feed requests are described below: purchases in the iOS app, and a small start-up diagnostic and anonymous counters.
PERIGEE Pro is sold through Apple's in-app purchase system. The iOS app includes the RevenueCat SDK, which we use to confirm your subscription with Apple and unlock Pro. RevenueCat receives your Apple purchase receipts and transaction history for this app, a random app-user identifier it generates on your device (not tied to your name, email, or Apple ID), and basic device details such as iOS version and app version. It does not receive your location. RevenueCat processes this on our behalf under its privacy policy. Apple's own handling of purchases is described in Apple's privacy policy. The web version of PERIGEE contains no purchase SDK.
To learn which of our own App Store search ads work, the iOS app also passes RevenueCat an attribution token from Apple's AdServices framework. RevenueCat exchanges it with Apple for the Apple Ads campaign, ad group and keyword that led to the download, if any. If you didn't arrive from one of our Apple Ads, Apple reports only that. This uses no advertising identifier, involves no tracking across other companies' apps or websites, and is stored only with RevenueCat's random app-user identifier.
Because the iOS app loads this site inside a native shell, the only way for us to learn that the app failed to start on someone's phone is for the app to tell us. On iPhone and iPad, the page sends up to three short reports during the first 25 seconds after launch: which loading stage it reached, whether the native bridge was present, how long the feed requests took, the first few JavaScript error messages if any, and the browser user-agent string. These reports contain no location, no identifier that persists between launches (only a random per-launch token), and no account information. They are appended to a log file on our server that is overwritten when it reaches 20 MB, and are used only to find start-up failures.
PERIGEE also keeps a few anonymous counters, on the web and in the iOS app, so we can tell whether the first run works: which interests were picked (for example the Space Station or rocket launches), how a place was set (device location, the time-zone guess, a searched city, declined or skipped — never the place itself), whether the next-pass card showed a visible pass, whether push alerts were turned on, refused or put off (and, when they could not be turned on, the coarse reason: permission, network or server), whether the PERIGEE Pro sheet was shown, which plan was selected and which plan button was tapped, whether a purchase completed or failed, whether you answered “yes” or “missed it” when the app asked if you saw a pass, and — at most once a day — that the app was opened again on a later day, as a coarse bucket (the next day, within a week, or later). For that last counter the date you first opened PERIGEE is kept on your device only. Each event is one line with a timestamp, the event name and the screen it came from — no identifier of any kind, so events cannot be linked to a person or to each other.
If you set an observer location — by searching a place, entering coordinates, or using your device's location — it is used only to compute which satellites and passes are overhead. That math happens locally on your device. Your location stays in your browser's local storage and is never sent to any feed provider.
The single exception is push alerts. If you enable them, your chosen coordinates and the label you picked for that location are stored on the operator's server together with your push subscription, so the server can decide when a pass, asteroid approach, fireball, or launch is relevant to you. That data is kept until you disable alerts. Your location is never sold, rented, or shared with anyone.
Push alerts are entirely opt-in. When you enable them, your browser's push subscription (an endpoint URL supplied by your browser's push service) plus your alert preferences and observer location live on the operator's server. When you disable alerts, that subscription and its stored data are deleted. Subscriptions that a push service reports as expired are also removed automatically.
PERIGEE draws its data from public space feeds. Your server makes standard requests to these sources; your coordinates are sent to none of them:
The only user-supplied text that ever leaves your device is the place name you type into the search box, which is sent to Nominatim to resolve into coordinates. Your resolved observer position is not.
When we run ads, they link to small landing pages under perigee.earth/go/ that show the App Store badge. Those pages, and only those pages, may load the Meta Pixel so that Meta can tell us that an ad click reached the page and whether the App Store badge was tapped; Meta sets its own cookie on that page under its privacy policy. We also keep a count of visits to these pages by device type, without IP addresses. The PERIGEE console and the iOS app contain no pixel, no analytics and no advertising code.
PERIGEE is suitable for all ages and shows factual astronomical and orbital data only. It collects no personal information unless you enable push alerts — in that case your chosen coordinates, location label, timezone, and push endpoint are stored as described above, and deleted when you disable alerts.
Questions about this policy? Email hello@perigee.earth.