Privacy Policy
GoldenLight is built by one photographer for other photographers. This policy explains what data the app uses, where it goes, and what we do not do with it. In plain English. It covers GoldenLight on iPhone and on Android; where the two differ, it says so.
GoldenLight has no accounts, no sign-in, no ads, no analytics SDKs, and no tracking of any kind. Your saved pins, plans, and profile never leave your device. When you ask for a forecast, the app sends only the coordinates you asked about — never your name, your device, or anything that identifies you — to the weather services that answer it. One of those services is a server we run ourselves. This policy explains that in Section 4, because you should know when your data reaches us rather than a public agency.
1. Who we are
GoldenLight ("the app," "we," "our") is published by Andrew Sambuceto Photography, a sole proprietorship based in Canby, Oregon, United States. We are the data controller for the purposes of the UK and EU General Data Protection Regulation.
Trader information (EU Digital Services Act):
- Trader: Andrew Sambuceto
- Address: 543 S Ponderosa St, Canby, OR 97013-6324, United States
- Email: andrew@andrewsambucetophotography.com
- Phone: +1 503-970-8948
2. What the app collects
2.1 Information you provide. If you fill out the Profile screen, the app stores what you enter — your name, title, city, gear, and shooting preferences — locally on your device. It is never transmitted to us or to anyone else. It exists only to personalize the app on your phone.
2.2 Location. GoldenLight uses your device location for its core features: predicting sunrise and sunset colour, fetching weather, tide, wave and air-quality data, calculating sun, moon and Milky Way positions, and building terrain horizon profiles. You control this in your phone's settings, and the app works without it — you can add any location by name instead.
Your location is used in two ways:
- On device only — every astronomical calculation, terrain horizon profile, alignment search, and distance measurement. These never leave your phone.
- Sent out to get an answer — when the app requests a forecast for a place, it sends that place's latitude and longitude to the services listed in Section 4. Those requests contain the coordinates and your device's public IP address, as any internet request does. They contain no name, no account, no device identifier, and no advertising ID.
2.3 Camera. The AR Viewfinder uses the camera to show the live scene with sun, moon and Milky Way overlays. The feed is processed in real time on your device and is never recorded, stored, or transmitted.
2.4 Notifications. If you turn on Pin Alerts or a plan's reminders, the app asks permission to send notifications. These are generated entirely on your device — there is no push server, and we are never told what your alerts say or when they fire.
2.5 Photo library. GoldenLight does not access your photo library.
2.6 Saved data. Your pins, shoot plans, preferences, downloaded terrain tiles, and cached forecasts are stored on your device. They are included in your phone's own backup if you have it turned on (iCloud Backup on iPhone, Google's backup on Android). We cannot access them.
2.7 Sky ratings you choose to send us. The app keeps a local log of its own predictions and of any skies you rate. If — and only if — you tap Send to Andy, your mail app opens with that log attached so you can send it. Nothing is sent unless you press Send in your own mail app. The log contains the coordinates, times, forecast values and ratings for the skies you rated. We use it solely to measure and improve the prediction model, and we do not publish it with anything identifying attached. If you would rather we deleted a log you sent, email us and we will.
3. How the app uses it
Only to provide the features you can see: calculating light and astronomical events for your location, fetching forecasts, building terrain profiles, showing regional observations, saving your locations and plans, and personalizing your home screen.
We do not use your information for marketing, profiling, advertising, or analytics. We do not sell it, and we do not share it for anyone else's advertising.
4. Where your location goes
4.1 Our own server ("Throttle")
Some of GoldenLight's forecast data comes from a weather server we run ourselves, rather than from a commercial API. It reaches it at goat.goldenlightapp.com and goes.goldenlightapp.com. As of this version it supplies the colour score, the weather card, cloud observations, fog, storms, waves, bioluminescence and the cloud map overlay.
What we receive: the latitude and longitude you asked about, the time, and your device's public IP address — nothing else. There is no account, no device identifier and nothing that links one request to another or to you.
What we do with it: answer the request, and nothing else. Successful requests are not logged. The server keeps no access log, so there is no record of the places you looked up. When a request fails — almost always because you asked about somewhere a particular forecast model doesn't cover — an error line is recorded containing the coordinates, the time and the app's version number. Those lines are deleted automatically after 30 days. Our network provider (Cloudflare) separately keeps short-lived connection logs, including your IP address and the address requested, as part of keeping the service secure and available. We do not build profiles from any of this, do not combine it with anything else, and do not share it.
If it is unavailable, the app quietly falls back to the commercial Open-Meteo service for most features, and simply hides the few that only our server can provide. You can see exactly which source answered at any moment in Settings → Data Sources.
4.2 Third-party data providers
To return forecasts and observations, the app requests data from public and licensed scientific services. Each request includes the coordinates and your public IP address, and nothing else about you. Each provider has its own privacy practices.
| Provider | What it supplies |
|---|---|
| Open-Meteo | Weather, cloud, marine and air-quality forecasts |
| NOAA Space Weather Prediction Center | Aurora, solar wind, geomagnetic data |
| NOAA CO-OPS | Tide predictions and water levels |
| NOAA CoastWatch (ERDDAP) | Chlorophyll data for bioluminescence |
| U.S. Naval Observatory | Moonrise, moonset, twilight |
| NASA DONKI | Coronal mass ejection and solar flare data |
| NASA Earthdata | SRTM elevation tile downloads |
| U.S. Geological Survey | Elevation and river gauge data |
| Open Topo Data | Elevation fallback |
| NIFC / WFIGS | Wildfire perimeters and incident locations |
| Bureau of Land Management | Public lands boundaries |
| iNaturalist | Wildflower bloom observations (Pacific Northwest) |
4.3 Apple and Google
On iPhone, the map, place search and place names come from Apple Maps. When you search for a place or the app names a location, that query and the coordinates go to Apple under Apple's privacy policy. We never see it.
On Android, the map comes from Google Maps, and place search and place names come from Android's built-in place lookup, which Google provides. Your search text and the coordinates go to Google under Google's privacy policy. The Google Maps component built into the app also sends Google some technical information about its own use: your device's IP address, a usage identifier that Google says is not used to identify you or for advertising, crash reports, and how the map is moved and zoomed. Google uses it to run and improve its maps. We never see any of it.
5. Purchases and subscriptions
GoldenLight is sold through the App Store on iPhone and through Google Play on Android. When you subscribe or purchase, Apple or Google handles the entire transaction — we never see or receive your name, email, payment card, or billing address. The app receives only a confirmation from the store that this device is entitled to the paid features, checks it on your device, and keeps it there.
We do not operate accounts, so there is nothing to sign in to and nothing of yours held on a server. Restoring purchases on a new device works through your Apple Account on iPhone and your Google account on Android. Subscriptions are managed and cancelled in iOS Settings → your name → Subscriptions on iPhone and in the Play Store → Payments & subscriptions → Subscriptions on Android, not by us. Refunds are handled by Apple or Google. A purchase made in one store does not carry over to the other.
6. Storage and retention
Your data lives on your device. We do not maintain user accounts.
- Profile, pins, plans — stored locally in the app's own database. Removed when you delete the app.
- Preferences — stored locally in the app's settings. Removed when you delete the app.
- Cached forecasts — held briefly for performance, then discarded.
- Terrain tiles — kept on your device so the app works offline. Removed when you delete the app.
- Our server's error logs — coordinates only, deleted after 30 days. Successful requests are not logged at all (Section 4.1).
- A sky-rating log you chose to email us — kept while it is useful for improving the model. Email us to have yours deleted.
- Your phone's backup — if turned on (iCloud Backup on iPhone, Google's backup on Android), includes the app's local data, under Apple's or Google's standard backup process.
To delete everything the app has stored, delete the app.
7. Analytics, advertising, and tracking
GoldenLight contains none of the following:
- Third-party analytics SDKs (no Firebase, Google Analytics, Mixpanel, Amplitude, or equivalent)
- Crash reporting of our own — we see only the reports Apple (iPhone) and Google Play (Android) pass on from people who chose to share diagnostics with them, with nothing that identifies you
- Advertising networks or ad SDKs
- Advertising identifiers — on iPhone the app never requests the IDFA or shows the App Tracking Transparency prompt, and on Android it never reads the advertising ID, because it has nothing to track you with
- Cross-app or cross-site tracking of any kind
8. Children
GoldenLight is rated for all ages (4+ on the App Store) and is not directed at children. We do not knowingly collect personal information from anyone, of any age. If you believe a child has sent us information through the app, email us and we will delete it.
9. Your rights
Because your data stays on your device, you already control nearly all of it: delete the app and it is gone. For the limited data described in Sections 2.7 and 4.1, you have the right to ask what we hold, to have it corrected or deleted, to object to or restrict our use of it, and to receive a copy. Email andrew@andrewsambucetophotography.com and we will respond within 30 days. We will not charge you or treat you differently for asking.
If you are in the EU or UK, our legal basis is legitimate interest — providing the forecast you requested and keeping the service secure — under Article 6(1)(f) GDPR. You may object to that processing at any time, and you have the right to complain to your national supervisory authority (in the EU, find yours here; in the UK, the Information Commissioner's Office).
If you are in California, we do not sell or share personal information as the CCPA defines those terms, and we have not done so in the preceding twelve months.
10. International users and data transfers
We are based in the United States, and the server described in Section 4.1 is located in Oregon. If you use GoldenLight from outside the United States, the coordinates you request forecasts for — and your IP address — are transferred to and processed in the United States, which may not provide the same level of data protection as your home country.
We rely on the UK and EU Standard Contractual Clauses where they apply. Given how little data is involved — coordinates and an IP address, never linked to you — we consider the risk to you minimal, but you should know it happens before you rely on the app.
11. Changes to this policy
If we change what data the app sends or where it goes, we will update this policy and change the "Last updated" date above. Material changes will also be noted in the app's release notes.
12. Contact
andrew@andrewsambucetophotography.com — Andrew Sambuceto Photography, Canby, Oregon. I read everything.