Privacy

The short version

• Your site is moved before anything is sent. Your observing site is the latitude and longitude your telescope writes into each file. Upload replaces it, in your browser, with the center of the 6 km map cell it falls in. Clean my files moves it by up to 5 km, also in your browser.
• A file we can't clean isn't sent.
• Your files stay private. Uploads go to private storage and are never published or shared. What does become public is a dot on the sky map: the target, its position on the sky, the number of frames and the hours of exposure. To delete a batch, email data@skycruncher.io with its batch ID (what that covers).
• The planner and the cleaner run in your browser. The planner sends something out only after you press Add weather or a Seestar plan button. The cleaner uploads nothing.
• The help bubble sends nothing until you press it. Then your question goes to our server, which asks Claude, an AI model made by Anthropic, to answer it from this site's pages (what is sent and kept).
• No cookies. We count visits with Cloudflare Web Analytics, which sets no cookies.

On this page: how your site is moved · Upload · files we can't clean · the sky map · Planner · Clean my files · Engine (Alpha) · the Discord bot · the help bubble · the app · visit counts · server logs · requests to other sites · questions · changes

Each section is marked implemented when it describes what the site does today, checked against its code, or planned when it describes something not built yet.

How your observing site is moved

implemented The FITS files (the standard file format telescopes save their frames in) from a Seestar and most capture programs hold your exact observing site in their header, the block of text at the start of each file. Upload and Clean my files both move it, in your browser, but by two different rules.

• Upload: the center of your map cell. The Earth is divided into about 12.6 million equal cells, each about 6 km across (a HEALPix order-10 cell, the same rule the SkyCruncher app is planned to use when you share). Upload writes your site as the center of the cell it falls in. Every file from the same place gets the same center, so the site we receive says which cell you observe from, not where in it, and many uploads can't be averaged back to your exact spot. Nothing about your site is kept in your browser: the cell needs no memory. The rule is named community-privacy/2.
• Clean my files: a random offset of up to 5 km. The latitude and longitude move by a random direction and a random distance of up to 5 km. Because the distance is random, it is often smaller: about 1 site in 25 moves less than 1 km. The offset is picked once for your site and saved in your browser, and every later file from within 5 km of that site gets the same offset. The rule is named community-privacy/1; Clean my files has the details.

Under both rules:

• Elevation is rounded to the nearest 100 m.
• Values worked out from your site are recalculated for the moved site or removed: the target's altitude and azimuth, zenith distance, airmass, sidereal time, hour angle and parallactic angle. Sun and Moon altitude and azimuth are removed. Under Upload's rule, any other header value that still matches your site, to the precision we check, is removed too.
• Only the header changes. Two HISTORY lines are added, saying the site was moved and the pointing values recalculated. A CHECKSUM card, and any card that is removed, becomes a COMMENT card. The image data, any tables inside the file, and any bytes after the last header are kept untouched, and the page doesn't look for your site in them.
• Coordinates are never shown on the page, before or after the move.

What moving the site doesn't hide

• A full night of frames still says roughly where on Earth you were, as any astrophoto does.
• Everything else in the header is kept as written: times, exposure, gain, camera, target coordinates (RA and Dec, the target's position on the sky), the telescope's name, and any observer or site name your capture software wrote. If your software writes your name or your town into the header, it is sent.
• The telescope name (TELESCOP) is often unique to your unit, as with a Seestar's unit ID, so it links your uploads to each other.
• File and folder names are sent. We change parts that look like coordinates or match your site, but we can't catch every way of writing one, so please don't put coordinates in names. Other parts of the names, such as a town in a folder name or the name of the folder you dropped, are sent as they are.

For a walk through the header keys, photo data and file names that can point back to your site, read What's in your files before you share them.

Upload

implemented The upload page sends a night of your files to SkyCruncher.

Before anything is sent, in your browser

• FITS files (.fit, .fits, .fts, .fz): the site is written as its cell center, as described above. A file already moved by Clean my files is moved again, to the center of its cell.
• Notes, capture logs and gear lists (.txt, .md, .log, .json, .xml, .profile, .csv, up to 10 MB each): any site coordinates we recognize become their cell center, elevations are rounded, and home-folder paths and obvious user and machine names are replaced with <user> and <machine>. You see every change before you upload. Pointing values a mount writes in a log (its altitude, azimuth, sidereal time or hour angle) are kept as they are; with the time, they can show where you were to within tens of meters, so remove those lines from a log first if that matters to you.
• XISF and camera raw files (.xisf, .cr2, .cr3, .nef, .arw, .raf, .dng) are converted to FITS in your browser, and the site is moved like in any FITS file. The original file is never sent.
• Zip and tar files (.zip, .tar, .tar.gz, .fits.gz) are opened in your browser. Each file inside is handled like a file you dropped, and the archive itself is never sent.
• Everything else in the folder (previews, JPGs, videos) is skipped.

What is sent

• The cleaned files.
• A file list for the batch: the cleaned name, size, frame type, filter and exposure of each FITS and text file you added, including the ones that weren't sent and why, and a fingerprint (a hash) of each frame's image data.
• A summary of the batch: file counts and sizes by frame type, total exposure time, the gain and sensor temperature of each group, and any calibration warnings.
• Your answers under "About you", if you fill them in: name or Discord handle, email, AAVSO observer code, note, and the Seestar Collective box. All of them are optional. The upload page says of the email: "Only to send you your results or ask about your data. Never shown publicly."
• That you ticked the consent box, and the version of the page.

Where it goes

Into private SkyCruncher storage (a private Cloudflare R2 bucket), one folder per batch. It isn't public. Your answers under "About you" are stored with the batch and kept as long as its files. Frames may be copied to SkyCruncher's own computers for analysis.

What may be published. Your files themselves are never published or shared. Two things made from them can be public:

• A dot on the sky map. An upload's target, the target's position on the sky, the number of frames and the hours of exposure appear on the public sky map, without your name, telescope or site.
• Results. Experiments, measurements and papers made from your frames may be published, with credit. Before anything is submitted for publication, we'll ask how you'd like to be credited, or whether you'd rather stay anonymous or have your data left out of it: how you're credited is your choice. Nothing made from your data is submitted with the aim of making money without your explicit approval.

Two other records are kept, with no time limit:

• An uploads record for our private dashboard. It has one row per batch (when it arrived, how many files, the consent and page versions, and a few header values) and one row per stored FITS file: its stored name, which includes the cleaned file name, plus its size, the time it arrived, its fingerprint, and header values (date, telescope name, camera, capture program, target, filter, frame type, exposure, gain, mount mode and image size). It never holds your name, email, AAVSO code, note, text files or location.
• Fingerprint entries, so the same frame isn't stored twice. Each stored frame gets up to two entries, keyed by fingerprints of its image data and of its header (with the first bytes of its data), that lead back to the batch and file it was stored under. Before your files go up, the page asks which of them we already have. The answer is only yes or no for each frame, never whose file it was.

Your IP address and the bot check

Each upload counts against a daily limit for its IP address, and that counter deletes itself after about a day. The bot check, Cloudflare Turnstile, loads from challenges.cloudflare.com as soon as the upload page opens. It runs checks in your browser and sends information about your browser, and your IP address, to Cloudflare. Our server also passes your IP address to Turnstile to confirm the check. Cloudflare's Turnstile privacy addendum says how it handles that data. Your IP address isn't stored with your files. Server logs are covered below.

How long we keep it

No time limit has been set yet: nothing deletes an upload automatically today. If we set one, it will be on this page.

Deleting a batch

After an upload, the page shows your batch ID, and you can save it with the file list. Email data@skycruncher.io with the batch ID, and we'll delete everything we hold in cloud storage for the batch itself, including the files, the file list and your answers, the uploads-record rows and the fingerprint entries. During the beta we'll also make a best effort to remove copies made on our own computers for analysis, but we can't promise to find every one. Results already published from the batch stay published. Server logs can't be deleted on request; they expire within 7 days.

You can also ask us to delete the telescope and sensor profiles and the astrometric, photometric and per-star results we've made from your frames. We'd like to keep them for science if you're happy with that. If your data is part of an Experiment that's still running, we'll ask whether we can keep it until the Experiment ends; its final results combine everyone's data.

What your browser remembers

• The drive or folder you connected, if you used "Connect a drive or Seestar" (desktop Chrome and Edge).
• A fingerprint of each file it has sent (a hash of its name, size and date, not the name itself), so the same files aren't sent twice.
• Nothing about your site. An older version of the upload page, and Clean my files today, keep your site and its offset in this browser; clearing this site's data in your browser removes it.

Our code never sends any of it.

Files we can't clean aren't sent

implemented Upload fails closed: when it can't be sure your site is gone from a file, the file stays on your computer.

• A FITS file whose site we can't read and move isn't sent. The page lists it as "not sent, to protect your location". The same goes for an XISF or raw file whose location can't be carried over and moved, and for a file an earlier version of the page marked as moved while its site values are still in it.
• A text file we can't read or can't scrub (binary bytes, a latitude with no longitude, JSON that would break) is skipped, never sent as it is. If the page still finds your site in the scrubbed text, or a GPS position we recognize near the site of a FITS file in the same upload, the file isn't sent.
• One exception: a text file that already carries this rule's "scrubbed" line is sent as it is, without being scrubbed again. The same goes for a FITS file already carrying this rule's two marker lines.
• .7z and .rar files can't be opened here yet, so they are skipped.
• Our server checks again. It refuses a FITS file that has site values but no "site moved" line from this rule, and a text file without the "scrubbed" line or with a home-folder path that still names a user. For a file over 95 MiB, it checks only the headers in the file's first 50 MiB. It can't tell a moved coordinate from a raw one, which is why the moving happens in your browser.

The public sky map

implemented The sky map on Results shows a dot for every target with frames in the SkyCruncher frame catalog, uploads included. For an upload, that means its target, the target's position on the sky, the number of frames and the hours of exposure appear on the public map. A target's frames and hours are added up across everyone who has frames of it, so yours are counted in its totals, and shown alone only when no one else has frames of that target.

The map's data file holds, for each target, only its name, its sky position, its frame count, its hours of exposure, how far it has got (captured, processed or published) and a link when there is a published page. It never shows who took the frames, with which telescope, from where, or on which night. Names come only from a list of catalog designations: a field without one is shown only as "Unnamed field", because names written by capture software can hold anything. Comets and other moving targets, frames without a sky position, duplicate sessions, and calibration or stacked frames are left out.

Planner

implemented The planner works in your browser from files on this site. City search happens in your browser, and your city, telescope and plan are kept in your browser's storage. Two buttons send something elsewhere.

Add weather (you opt in)

Weather is off until you press Add weather. Then the page sends the center of the city you chose, rounded to a 0.1° grid cell (about 11 km from north to south), to our own weather service on skycruncher.io. That service asks Open-Meteo for the cell's forecast, so Open-Meteo never sees your request. Your choice is saved in your browser: once weather is on, the page asks for the forecast again on each visit and each time you change city, until you turn it off.

Send to Seestar

The Seestar plan QR sends a plan to ZWO's server, api.seestar.com, only when you press its button. It sends the targets: their names, RA and Dec, start times, lengths, filter and exposure. It names no place and no date, but start times together with RA and Dec hint at your time zone and rough longitude. Like the Seestar app's own shares, it carries the time you pressed the button. ZWO's server sees your IP address, as with any web request, and the shared plan stays on ZWO's server, open to anyone who has the link.

Shared observing sessions (switched off)

The planner has a way to share a night's plan, and to post it to a reviewed list of sessions, built but switched off. Today the planner sends nothing to a sessions service. Before it is switched on, this page will say what it stores and for how long.

Clean my files

implemented Clean my files moves the site in your FITS headers by a random offset of up to 5 km (the rule above), in your browser, before you share them somewhere else, such as a Drive or Dropbox folder. Nothing is uploaded; the help bubble sends only your question, and only if you press it. It saves cleaned copies to a new folder inside a folder you pick, or as downloads, and your originals aren't changed.

Where the offset is kept. Your browser keeps your true site and its offset in its local storage for skycruncher.io, so the next file from the same place gets the same offset. Our code never sends it. Each new browser, device or private window, and each time you clear this site's data, starts with a new offset. Several offsets for one site narrow it down, so for the best protection, clean from one browser and keep its data for skycruncher.io. When the browser won't let the page save data at all, one offset is used for that visit only.

What it doesn't do:

• It keeps file and folder names as they are.
• It doesn't scrub notes or logs.
• It skips camera raw and XISF files, and anything else that isn't FITS. Photos and raw files can carry GPS in their own metadata, which it doesn't clean.

If you later send a cleaned file through Upload, Upload moves its site again, to the center of its cell.

Engine (Alpha)

implemented Engine (Alpha) is the 2026 old engine, running in your browser on its own address, app.skycruncher.io. It reads your frame in the browser and doesn't upload it. It asks before it downloads the star catalogs, from our public data host, data.skycruncher.io.

• City search sends what you type to OpenStreetMap's Nominatim service (nominatim.openstreetmap.org) when you press Enter, to look up the city's position.
• Its Community setting is off unless you turn it on. Turned on, it sends a solve's measurements to an older SkyCruncher service; the app says these are never photos, file paths or your exact location. What that older service keeps isn't written up on this page yet, so leave the setting off if that matters to you.

The Discord bot

implemented The SkyCruncher bot in the SkyCruncher Discord server answers slash commands through our own service, which Cloudflare runs. It is in a trial: today only the server's administrators can use its commands. It speaks only when asked, and every answer ends with a small line saying it came from a bot. Discord's own privacy policy covers everything you post in Discord itself.

What it reads

• The commands you send it. For each slash command, Discord sends our service what you typed into the command, along with your account as the server sees you (your user ID, username, display name, server nickname, avatar and roles), the server, the channel and your language setting. The bot uses what you typed to answer, and your server nickname or display name only to credit an answer you post to the channel.
• Not your IP address. Discord sends commands from its own servers, so our service never sees your IP address.
• Not the server's channels. The bot's service receives only the commands sent to it; it doesn't read or keep messages posted in the server's channels. A direct message to the bot from anyone but the developer is dropped: it isn't passed on or kept.

What it keeps

Nothing of its own: each answer is made on the spot and not stored. Like the site, our Discord service keeps a log of each request for up to 7 days. The log holds Discord's address and request details, and for each answer the command's name, whether it answered, and how long it took, but not what you typed. When something goes wrong, the log holds the error, which can include what you typed.

Who else sees it

• /planner runs the planner's own code. Weather is on unless you turn it off in the command. If you give a location, the center of that city, rounded to a 0.1° grid cell, goes to our own weather service, which asks Open-Meteo for the cell's forecast, as with Add weather on the planner. With no location, it uses a fixed default location of ours.
• Nothing else today. Before any Discord helper sends what you write to an AI model or to our issue tracker, this page will say so. Nothing the bot reads is sold, used to train an AI model, or used to build a profile of you.

Answers you post

Answers come to you privately. If you press Post to channel, the answer is posted in that channel for everyone who can see it, credited "shared by" with your server nickname or display name. To have a posted answer taken down, or to ask about anything the bot has, email data@skycruncher.io.

The help bubble

implemented The round SkyCruncher button in the corner of most pages opens a helper that answers questions from this site's own pages. Nothing about it is sent anywhere until you press it.

When you open it, your browser loads Cloudflare Turnstile, the bot check Upload also uses (see Your IP address and the bot check), once for that browser tab. When you ask a question, it goes to our server on skycruncher.io. Our server picks passages from this site's public pages and sends them, with your question, to Anthropic, whose Claude model writes the answer. On a tool's page, the name of the step you are on is sent too, such as "Upload, choose files". The last two questions and answers in that tab go along with the next question, so the helper can follow on; they are kept only in that tab.

Never sent to Anthropic: your IP address, your files or their names, and your observing site. The planner's help never sends your place. A question that contains coordinates is refused before it is sent. Please don't type your location into a question.

We keep a count of questions and what they cost, not your question or the answer. Your question travels inside the request, not in its address, so our server logs don't hold it. If you press "This didn't help", that question, the answer and the page address are kept for 90 days so we can improve the pages, without your IP address. To stop abuse, each IP address gets a daily limit. The counter holds a scrambled form of your address and deletes itself after a day.

Anthropic doesn't use what it receives to train its models (Commercial Terms). It deletes your question, the passages and the answer within 30 days. If its safety systems flag a question as breaking its usage policy, it may keep it for up to 2 years (Anthropic's retention policy).

The SkyCruncher app

planned The SkyCruncher app is in development (where it stands). It is planned to work on your own computer and to share nothing unless you opt in. Sharing is planned to send measurements, never photos or frames, and to store your site only as its map cell of about 6 km (the same cell Upload uses) plus a site ID; nothing public is planned to carry a location. The service that will receive them, the receipt door, is built and tested but not deployed yet. A receipt is the record of what was measured on one frame (the frame receipt format); the receipt door will take those measurement records only, never a frame, and nothing will send to it until the app ships. None of this is what Upload does today; Upload is described above. Before the app shares anything, this page will describe exactly what it sends and keeps.

Visit counts

implemented Pages on skycruncher.io count visits with Cloudflare Web Analytics, which sets no cookies. Its script loads from static.cloudflareinsights.com and reports to cloudflareinsights.com. Our own code sets no cookies either.

Server logs

implemented Cloudflare runs this site. Our site keeps a log of each request for up to 7 days: the address requested, which names the page or file, and request details, which can include your IP address, your browser, the rough location Cloudflare works out from your IP address (such as country, region, city and postal code), and your network. Our upload and weather services may log requests the same way for up to 7 days. An upload request's address carries the cleaned name of the file being sent, and a weather request's address carries the rounded grid cell.

Requests to other sites

implemented Pages load only from skycruncher.io, plus the visit counter above, except where this list says so.

A link to another site is only a link: nothing goes to it unless you click.

Questions

Uploads, deletions and anything the Discord bot has: data@skycruncher.io. Anything else: hello@skycruncher.io. About SkyCruncher says who runs the site.

Changes to this page

• 21 October 2026: new section on the help bubble: what it sends to Anthropic, what we keep, and the bot check it loads only once you open it.
• 20 October 2026: first version for the rebuilt site, re-checked against the code. Upload now writes your site as the center of its 6 km map cell instead of a stored offset of up to 5 km. New sections on the public sky map, Engine (Alpha), shared sessions and the app.