Privacy Policy

Last updated: 4 September 2026

This policy explains what the Above You mobile app and the above-you.app website do with information. It is written to be read rather than to satisfy a checklist, and every claim in it describes something the code actually does.

1. Who is responsible

Above You is operated by the developer of the app. For any question about this policy, or to exercise the rights described in section 9, write to contact@above-you.app. We answer in English or Turkish.

2. What the app collects

Your approximate position — used, never stored

When you grant location permission, the app reads your coordinates on your device and sends them with each query so the server can work out which aircraft and satellites are above you and how high above the horizon they are. That is the only purpose.

• Coordinates are not written to any database and are not retained after the query is answered.
• They are not attached to an account — there is none — and are never passed to the advertising SDK. The ad network does not learn where you are from us.
• They are not sold, rented or shared with anyone.
• Nothing is read while the app is closed or in the background. Foreground permission only.
• Permission is optional. Decline it and the world map, the aircraft you tap on it and every reference screen keep working.

A coarse place name (your district and city) is derived on your device by the operating system for the header line. It is not sent anywhere.

What is kept on your device

A handful of values, in the app's own local storage: your chosen language; a flag recording that you have been shown the location explainer before, so a relaunch does not turn into a second prompt; a count of how many times you have opened the app and when the last full-screen ad was shown, which is how the frequency limits in section 3 are enforced; and, if you have watched a rewarded ad, the time its ad-free window ends. Deleting the app removes all of them. Google's advertising SDK keeps its own storage on the device, including your consent choices, which is outside our reach.

What we do not collect

• No name, email address, phone number or postal address — there is no sign-up.
• No contacts, photos, calendar, microphone or camera access. The app requests none of these permissions.
• No analytics, crash-reporting or attribution SDKs. The only third-party SDK in the app is Google's advertising one, described next.
• No fingerprinting, and no identifier of our own — we operate none, and there is nothing on our side to join anything to.
• No purchase history — the app has no payments.

3. Advertising

Above You is free and has no subscription or in-app purchase. It is paid for by advertising, supplied by Google AdMob. This is the one part of the app where a third party receives data about your device, so it is worth being exact.

What Google receives

• Your device's advertising identifier — the IDFA on iOS, the Advertising ID on Android. It is a resettable identifier assigned by the operating system, not by us.
• Your IP address, from which an approximate region can be inferred. That is inherent to the request reaching Google's servers.
• Ordinary device and app information (model, OS version, app version, language) and how you responded to the ad: whether it was shown, seen, closed or tapped.

Google acts as an independent controller of that data under its own privacy terms. We receive only aggregate counts and earnings; we never see who you are, and no report we can open identifies an individual.

What Google does not get from us: your position. The app never passes location to the advertising SDK, and there is no account or profile on our side for anything to be joined to.

Your choice

In the European Economic Area, the United Kingdom and Switzerland the app asks for your consent before requesting a single ad, using Google's own consent form. You can reopen that form and change your answer at any time: ? → Ad privacy settings inside the app. On iOS the system asks its own separate question about tracking; declining it withholds the IDFA entirely.

Refusing changes nothing else. Every screen keeps working, and the ads simply become ones chosen from the context of the moment rather than from your device's history.

You can also reset or switch off the identifier itself, outside the app:

• iOS: Settings → Privacy & Security → Tracking.
• Android: Settings → Google → All services → Ads, where the ID can be reset or deleted.

How often ads appear

These limits are enforced in the app's own code, not left to the network:

• Nothing at all during your first session, or in the first 90 seconds of any session.
• At most one full-screen ad every four minutes, and never more than three in a session.
• Full-screen ads appear only at a seam — when you close an aircraft's detail page — never over the live map or the list.
• Watching a rewarded ad, entirely your choice, removes full-screen ads for 24 hours. That promise survives restarting the app.

4. Server logs

Our API server keeps ordinary operational logs — request paths, response codes and timings — for a short period so that faults can be diagnosed. Query coordinates are not written into these logs. Logs are not used to build a profile of anyone and are not shared.

5. Third-party data sources

Aircraft positions, route information, aircraft photographs and satellite orbital elements come from open, publicly available sources maintained by volunteer communities and public agencies.

Your device never contacts these sources directly. Requests are made by our server, so the operators of those networks see our server, not you — no IP address of yours, no device identifier, no advertising ID. Google's ad servers are the one exception to that rule, and section 3 covers them.

Aircraft photographs are served from public spotter archives and are shown with the photographer's name and a link to the original. Copyright remains with the photographer.

6. This website

above-you.app is a set of static pages. It sets no cookies, runs no analytics, and loads no fonts, scripts or images from any third party — everything the page needs is served from this domain. The web server keeps standard access logs (IP address, page requested, timestamp) for a short period for security and troubleshooting.

7. Children

Above You is not directed at children, and we collect no personal information from anyone, including children. There is no user-generated content, no messaging and no social feature of any kind. Because the app is not child-directed, ad requests are not marked as such; where a child uses the device, the operating system's family controls and the advertising-ID settings in section 3 are the effective lever.

8. Security

All traffic between the app, the website and our server is encrypted with TLS. The API runs with restricted system privileges and is reachable only through the reverse proxy. Because we hold no personal data at rest, there is no store of user information that could be exposed.

9. Your rights

Under the GDPR, the Turkish KVKK and comparable laws you have the right to access, correct, delete or port personal data held about you, and to object to its processing. In our case there is nothing to retrieve or erase: we do not hold personal data about you. If you would like that confirmed in writing, ask us at contact@above-you.app and we will reply.

Data held by Google in connection with the ads is a separate matter, because Google is its own controller there. Withdraw consent through ? → Ad privacy settings in the app, and use My Ad Center together with the device settings in section 3 for the rest.

Location permission can be withdrawn at any moment in your device's system settings, without uninstalling the app.

10. Changes to this policy

If this policy changes in a way that affects you, the date at the top of this page changes with it and the revised version is published here before it takes effect. We do not make quiet edits.

11. Contact

Questions, corrections and privacy requests: contact@above-you.app.