Privacy policy

Last updated 2 November 2026

Who we are

Tell the Sky (“we”, “us”) runs the Tell the Sky website at tellthesky.com and the Tell the Sky apps for iPhone and Android. This policy explains what we collect, why, who we share it with and the choices you have. If you have a question, write to [email protected].

Your location: coarse areas only

Lanterns ride the real wind and land near real people, so the app needs a rough idea of where you are. It never needs, and we never keep, your exact position.

• Your saved area. Your account keeps one coarse area, used to offer you lanterns that drift overhead and as your default launch point. It is stored as a map cell (an H3 hexagon of about 0.1 km²), never as coordinates, and it is never shown to anyone or returned by the app to other people.
• How it is set. When you sign up, it is set once from the city your internet connection is in. Our network provider, Cloudflare, tells us that city; we do not look up or keep your IP address for this. After that, only you change it: by picking a town or city from a list, or with “Use my current location”.
• “Use my current location”. If you choose this, your device asks you for permission. The apps ask only for approximate location (Android’s coarse permission, iOS’s reduced accuracy). Your device rounds its position to a map cell before anything leaves it, so the coordinates are never sent, stored or logged.
• No background tracking. The app never re-locates you in the background. It uses your location only at the moment you ask it to.
• Launch points. When you launch a lantern, the launch point is snapped to the centre of a map cell (a few square kilometres for sky lanterns, about 0.1 km² for neighbourhood lanterns) before it is saved. Your raw launch point is never stored. To anyone but you, a lantern’s trail starts at the city-sized area around its launch, never the neighbourhood it left from, so a shared link can’t lead to where you live.
• Bottles at sea never start where you stand. You pick a coastal town, tap an area on the map or use your saved area, and the bottle is put in the sea at the centre of the nearest open-water square (about 28 km across). Only that sea point is stored.
• Blimp courses are made of city-sized areas (about 1,770 km² each), never points or addresses, so a course can’t lead to anyone.
• What others see. A lantern’s trail, its stops and a blimp’s courses show city-level labels only (for example “near Lisbon”). Nobody can see where you, the person, are.
• Visitors who are not signed in may see the map start near the city their connection is in. That is worked out for each visit and not stored.

What we collect and why

Your account

• Your email address, to sign you in and to send account emails (verifying your address, resetting your password).
• Your display name, which is shown next to the lines you write on lanterns. It is the only thing your profile holds: no age, gender, bio or photo. You can change it any time in Settings. If you delete your account, your lines are signed “a stranger” instead.
• If you sign in with Google: your Google account ID, name, email address and profile picture. Your display name starts as the name Google gives us, and you can change it straight away. Your picture is shown only to you, never on a lantern. If you sign in with Apple: your Apple ID identifier and the email address Apple shares (which may be a private relay address), plus an encrypted Apple sign-in token that we keep only so we can cancel it with Apple when you delete your account.
• If you sign up with email: your password, stored only as a secure one-way hash.
• That you confirmed you are 13 or older when you signed up, and when. We never ask for or keep your age or date of birth.

What you write and do

• Lanterns, blimps and bottles you send: the message, the mood you pick (if any), design, altitude, launch cell, a blimp’s courses and the vessel’s path across the sky or sea. A vessel’s position is the vessel’s, not yours.
• Lines you add to lanterns you catch, whether you chose to sign a line “a stranger”, and which lanterns were offered to you and which you caught (your logbook).
• Reports you make (the reason and any note you add) and people you block, so we can keep the sky safe.
• Catching settings: whether catching is on, your quiet hours, time zone, and counts of your catches.
• Your notification choices: which kinds you want by push and which by email.

What is public and what is not

Words are for catchers. A lantern’s lines, with each writer’s display name, are shown only to the people who wrote them and to the people who catch it. If you sign a line “a stranger”, everyone, you included, sees that label instead of your name; we still know who wrote it, so reports and blocks keep working.

Anyone, signed in or not, can see on the map and on a lantern’s public page:

• where a lantern, blimp or bottle is now and the trail it has flown (starting at city level, as above);
• its journey stops: the city it was launched from and the city where each catch found it, with the time, but never who launched or caught it;
• every course a blimp has been given, named at city level, never saying who set it;
• its vessel, altitude, flame, design and mood, and summary numbers: how many lines and languages it carries, the countries it has flown over, the seas it has crossed and how long it has been aloft.

Never public: the words of any line, who wrote a line, and who caught a lantern. The people who wrote on a lantern and caught it also see its chain with the city each line was written near. Search engines may list our public pages, but lanterns’ words are never on them. Please don’t put personal details in a lantern.

Moderation

Lines and display names are not filtered automatically. Instead, every line and every lantern can be reported and its writer blocked. A report goes to our moderators, who see the reported words, the reasons and a city-level place, but never who reported it. They may let it stay, hide it or remove it for good.

Translation

If you tap Translate on a line you can read, we send that line’s text (never your name or anything else about you) to OpenAI to translate it into your language, and we keep the translation so the next reader doesn’t have to ask again. Translations are deleted with the line.

Sign-in and devices

• For each sign-in session: the device’s browser or app description (user agent), the IP address it signed in from, and when it expires. We use this to keep your account secure and let you sign out of devices.
• If you allow notifications in the iPhone or Android app: a push token for your device. If you allow them in your web browser: your browser’s push subscription (an address and keys from your browser’s push service). We use these only to tell you when, for example, a lantern drifts over you.
• In-app notifications, such as “your lantern was caught”.

Push notifications are on by default and email notifications are off until you turn them on, kind by kind, in Settings. Email goes only to a confirmed address and every email has a one-click unsubscribe. Notifications name places at city level and never include a lantern’s words.

Server logs

Like any website, our servers keep short-lived technical logs (such as the time, the page requested and the connection’s IP address) to keep the service running and to stop abuse.

Cookies and storage

We use only the cookies the service needs. There are no advertising or tracking cookies.

During the private beta we also set a ts_beta cookie to remember an invite. It held no personal data and is no longer set.

The app also saves a few small things in your browser’s or device’s local storage: light or dark mode, whether the wind animation is on, and that you ticked “I’m 13 or older”, so you don’t have to tick it again on that device. They stay on your device and are never sent to us.

Who we share it with

We never sell your data. We share it only with the services that run Tell the Sky for us, and only what each one needs:

• OVHcloud hosts our servers and database (in the United States).
• Cloudflare runs our domain and network. It handles every connection to tellthesky.com, so it sees your IP address, and it tells us the city your connection is in.
• Google provides Sign in with Google (only if you use it), Firebase Cloud Messaging to deliver push notifications to the apps, and the fonts on our pages (Google Fonts, which sees your IP address when the fonts load).
• Apple provides Sign in with Apple (only if you use it) and delivers notifications to iPhones.
• Your web browser’s push service (run by your browser’s maker, such as Google, Mozilla, Apple or Microsoft) delivers notifications to your browser, if you turn them on there.
• OpenAI translates a line when you tap Translate. It receives only that line’s text.
• Resend sends our account emails and any notification emails you turn on, so it receives your email address and the email’s content.
• Fastmail hosts our support mailbox, so it holds any email you send us.
• CARTO provides the map tiles. Your browser or app loads them directly from CARTO, which sees your IP address and which part of the map you are viewing. Map data © OpenStreetMap contributors.

The wind comes from NOAA’s public Global Forecast System (GFS), and the ocean currents that carry bottles from NOAA’s Real-Time Ocean Forecast System (RTOFS). Our server downloads them; nothing about you is ever sent to NOAA. Town and city names come from GeoNames, which our server also holds a copy of.

We may also disclose information if the law requires it, or to protect people from harm.

How long we keep it

• Your account, logbook, settings, notification choices, blocks, notifications and sign-in records are kept while your account exists, and deleted when you delete it. Lanterns you sent and lines you added stay after that, without your name (see Deleting your account).
• A lantern burns for up to about 14 days (longer when people catch and refuel it). When it burns out it stays in the logbooks of the people who sent and caught it.
• Email links for verifying an address or resetting a password expire quickly and are single-use. We store only a hash of each link, never the link itself.
• A sign-in session lasts 7 days. A device’s push token is removed when you sign out on it, and every session, push token and browser push subscription goes when you delete your account.
• Reports are kept after a moderator has reviewed them, as a record of what was decided. A line removed by a moderator has its words wiped.
• Server logs are kept only for a short time.

Deleting your account

To delete your account, sign in, open Settings, choose Delete my account under “Your account” and type DELETE to confirm. This works on the website and in the iPhone and Android apps. Deletion takes effect immediately, cannot be undone, and signs you out on every device. It permanently removes:

• your account details (email address, display name, password hash and any Google or Apple link, which we also cancel with Apple), your saved area, your catching settings and your notification choices;
• your logbook, blocks, notifications, sign-in sessions, push tokens and browser push subscriptions.

What stays. Lanterns you sent and lines you added to other people’s lanterns are not deleted. They keep flying and stay readable by everyone a lantern reaches, now and later, so please don’t write anything in a lantern you would want removed with your account. They are no longer linked to you: your name is taken off and they are signed “a stranger”. In the same way, a lantern you caught keeps the record that it was caught near a city, and a report you made stays so that moderation still works, neither of them linked to you.

If you can’t sign in any more and want your account deleted, email [email protected] from the address on your account and we will delete it for you.

You can also ask us for a copy of your data, or to correct it, at the same address. Depending on where you live (for example in the EU, UK or California) you may have further rights, such as to object to processing or to complain to your data protection authority; write to us and we will help.

Children

Tell the Sky is not meant for children under 13, and we do not knowingly collect personal data from them. To sign up or sign in you confirm that you are 13 or older; we record only that you confirmed it, and when, never your age or date of birth. If you believe a child under 13 has an account, email [email protected] and we will delete it.

Security

All connections use HTTPS. Passwords are hashed, sign-in tokens are encrypted, and access to our servers is limited. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects you.

Changes to this policy

If we change this policy, we will update the date at the top of this page, and tell you in the app if the change is significant.

Contact

Questions, requests or worries about your privacy: [email protected]. The rules for using Tell the Sky are in our Terms of Use.