Privacy Policy

In short

Space Realm is a space-launch tracker. There are no accounts, no sign-up and no newsletter — we never ask you for your name, e-mail address or any other personal detail.

What we do have is the technical data every website receives (such as your IP address in our server logs), one first-party cookie that remembers your choice in the banner, and visitor counts that store nothing on your device.

Two things run only if you agree, and you are asked about them separately. Advertising is handled by Google’s own consent dialog, the one that greets you when you arrive. Product analytics is handled by our small banner, which appears afterwards so the two never talk over each other. Either answer can be changed at any time.

Who is responsible for your data

www.spacerealm.live is operated as Space Realm (“we”, “us”), based in the European Economic Area and the data controller for the processing described here.

For anything in this policy — including requests to see, correct or delete data — write to info@spacerealm.live.

What we process, and why

Cookies we set ourselves

We set no cookie that identifies or follows you. There is exactly one, and it exists to make the site behave:

• sr_consent — remembers the choice you made in the cookie banner, and which version of this policy you made it under, for 6 months. Without it we would have to ask you on every page. Strictly necessary.

Storage in your browser

We keep a few display preferences and self-diagnostic values in your browser’s local storage, and the site registers a service worker so it works offline as an installable app. This data stays on your device and is never sent to us.

Server logs

Our web server records the usual request data: IP address, date and time, the page or file requested, the referring page, and your browser’s user-agent string. We use it to keep the service running and to detect abuse. It is not used to build a profile of you, and it is not combined with the analytics below.

We read those logs with GoAccess, which runs on our own server — the log data is not sent anywhere for analysis.

Fault diagnostics

Your browser reports back which version of the site’s files it is actually running, so we can spot visitors stuck on a stale or corrupted copy after a release. The report lists file names and version stamps — nothing about you — and is recorded with the usual request data above.

Live launch updates

Launch pages hold an open connection to our server so updates arrive as they happen. For as long as that connection is open we keep its IP address and user-agent string in memory, to cap how many connections one address may hold and to cut off abusive ones. It is discarded when the connection closes.

Abuse protection

Failed sign-in attempts against our maintainer-only endpoint are counted per network address in memory for 15 minutes, to blunt brute-force guessing. Nothing is written to a database.

Visitor statistics — nothing stored on your device

We count page views with GoatCounter, a privacy-friendly statistics service. It sets no cookies and writes nothing to your device, so the rule requiring consent to store or read data there does not apply to it; it does not follow you to other sites and it does not build a profile of you. Because of that it is named here rather than switched on and off by the Analytics settings control, which does not affect it. The counts are aggregate and we do not use them to single you out, but any personal data involved in producing them is still processed — on the basis of our legitimate interest in knowing what the site is used for. You may object to that at any time; see “Your rights”.

Product analytics — only with your consent

If you accept, PostHog (EU-hosted) records product-usage events — pages viewed, elements clicked — under an identifier stored on your device. It may also record session replays: a reconstruction of your visit showing navigation, clicks and scrolling within the site. None of it runs before you agree, and it is not loaded at all if you decline.

Advertising — your choice is made in Google’s dialog

The site is funded by Google AdSense. Consent for advertising is collected by Google’s own certified consent dialog (Funding Choices), which is what greets you on arrival — we deliberately do not ask a second time, because two banners with two answers would mean neither could be relied on.

Your answer there governs what Google may do. If you consent, Google may set cookies and read device identifiers to deliver and measure personalised ads. If you do not, Google may restrict, limit or not serve advertising at all, depending on your choices and the ad-serving mode available — note that non-personalised ads still use cookies, for purposes such as frequency capping and fraud prevention. Google acts as an independent controller for that processing — see How Google uses information from sites that use its services, and manage your Google-side choices at My Ad Center.

Launch data

Launch, rocket, company and news content is served from our own backend. Requests to it carry only the technical data described under “Server logs”.

Content loaded from other services

Some parts of a page are fetched by your browser directly from another company’s servers. When a resource is loaded that way, that company receives the request — your IP address, your user-agent string and the page you were on — independently of what you chose in the banners. What each company then does is governed by its own privacy policy.

• Launch livestreams — where a launch has a stream, the player is embedded from YouTube, Vimeo or Twitch, and appears only on the page of a launch that has one. YouTube players use its privacy-enhanced mode (youtube-nocookie.com), which Google describes as keeping what you watch here out of your YouTube personalisation; that is not the same as the player contacting nobody. Vimeo and Twitch players set their own cookies, analytics and preference ones included, once loaded.
• Launch-site maps — satellite imagery tiles come from Esri (ArcGIS Online).
• Images — rocket, spacecraft and news pictures are partly served from our own servers and partly loaded straight from the data provider’s or publisher’s own image hosts.
• Links out — following a link to a news article, a launch provider or a social network takes you to a site we do not control.

Fonts are served from our own servers, so no font provider is contacted.

Legal basis

Two different rules apply here, and they are easy to run together. Whether something may be stored on, or read from, your device is governed by the ePrivacy rules. Whether the resulting personal data may be processed is governed by Art. 6 of the GDPR. Each purpose below is set out under both.

• The consent cookie — storage: exempt, because it exists solely to provide something you asked for, namely a site that remembers your answer. Processing: legitimate interest in operating the service, Art. 6(1)(f).
• Server logs, fault diagnostics, live-connection limits and abuse protection — nothing is stored on your device. Processing: legitimate interest in keeping a free service online, available and secure, Art. 6(1)(f). We do not use this information to identify you or to build a profile about you.
• Aggregate visitor statistics (GoatCounter) — storage: none, so the device-storage consent rule does not apply. Processing: legitimate interest, Art. 6(1)(f), which you may object to as set out under “Your rights”. It is not governed by the Analytics settings control.
• Product analytics (PostHog) — storage: consent. Processing: consent, Art. 6(1)(a).
• Advertising (Google AdSense) — storage and processing: consent, Art. 6(1)(a), collected and recorded through Google’s consent dialog where it is required.

Consent can be withdrawn at any time, as easily as it was given, without affecting what was done beforehand. Where we rely on legitimate interest, you have the right to object — see “Your rights”.

Who else sees the data

We do not sell your data. The recipients of data we send are the providers needed to run the site: our hosting provider, and the analytics and advertising services named above. Separately, depending on the page you open, technical request information reaches the embedded-content, mapping and image providers your browser contacts directly — currently YouTube, Vimeo, Twitch, Esri, and the image hosts of our data providers and news publishers, as described under “Content loaded from other services”.

Some of those providers are based outside the European Economic Area, or may process data there. Where personal data is transferred out of the EEA, the provider may rely on an adequacy decision, on approved contractual safeguards such as Standard Contractual Clauses, or on another recognised transfer mechanism; which one applies is set out in that provider’s own privacy documentation, and we will point you to the relevant one on request. PostHog is used on its EU infrastructure.

How long it is kept

• Server logs: size-rotated — once the cap is reached the oldest entries are deleted, so how far back the logs reach varies with how much traffic the site is getting. There is no long-term archive and no backup of them. Ask us and we will tell you the window the current logs cover.
• Live-connection details (IP, user-agent): held in memory only while the connection is open.
• The sr_consent cookie: 6 months, after which we ask you again.
• Analytics and advertising data: retained by those providers under their own policies and retention settings.

Your rights

Under the GDPR you may ask us for access to your data, or for it to be corrected, erased or restricted; you may object to processing based on legitimate interest; you may ask for a portable copy; and you may withdraw consent at any time without affecting what was done beforehand.

Send any of these to info@spacerealm.live and we will respond within one month. Because there are no accounts here, we often cannot tell which records relate to you: we may need further information from you to locate them, and in some cases we may be unable to identify any data as yours at all. Where that is so, we will tell you rather than guess.

You also have the right to complain to a data protection supervisory authority — in the EEA, the one for the country where you live or work; in the United Kingdom, the Information Commissioner’s Office (ICO).

Changing your choices

For analytics, use the Cookie settings link in the site footer, or the button at the top of this page.

For advertising, re-open Google’s dialog with the Ad consent settings button at the top of this page (shown when Google’s CMP is available on your device), or manage it from My Ad Center.

Your browser’s own settings can additionally block or delete any cookie, including ours.

Profiling and automated decisions

We make no automated decisions about you and build no profile of you. The data described here is used to run the site, not to evaluate anyone. Ad personalisation, if you consented to it in Google’s dialog, is Google’s own processing and is governed by their policy.

Children

The site is not directed at children, and we do not knowingly process data from anyone under 16.

Changes to this policy

If what we do changes, this page changes with it, and both the version number and the date at the top go up. When a change affects what you consented to, the banner re-appears so you can decide again — an answer given under an older version is never carried over silently.