Deep Sky Creations

Plain language

Privacy

A short, plain-language explanation of what this site does and doesn't do with information about you. No legalese where I can avoid it.

Last updated

Browsing Deep Sky Creations anonymously is possible: no third-party analytics, no tracking pixel, no advertising network, no profile of you. Reading a page does not record that you read it.

There is one exception, and it is small enough to describe completely: clicking a handful of specific buttons — a game download, the store, support, the forums — sends a one-line message to my own server saying that button was clicked. It carries no identifier of any kind. See interaction measurement below for the exact list of what is stored.

If you choose to sign up for an account (the small "Sign up" button in the header), then the following is stored on a Postgres database I run, in support of the account:

  • Account record. Your username, email address, and an Argon2id hash of your password (the password itself is never stored or transmitted in plain text after submission).
  • Email verification. A short-lived 6-digit code tied to your account so we can confirm the email address is really yours. Stored hashed; expires after 15 minutes.
  • Session. A server-side record that says "this browser is signed in as you," referenced by an opaque token in an HTTP-only cookie called dsc_session. Sliding 30-day expiry. The cookie is set only after successful email verification.
  • Settings. Theme, locale, observing locations, notification preferences. Synced to the server only for signed-in users; anonymous visitors keep using local storage.
  • Newsletter subscription, only if you ask for one. Kept separately from your account settings and described in full below — you can also subscribe without an account at all.
  • Audit trail. Account creation, email verification, login, and logout events are recorded with your IP address and user agent so I can investigate abuse.

And — as before — anything you set on /space/observer/ while signed OUT lives only in your browser's localStorage:

  • Observing location. Your saved coordinates and label, used to compute when objects rise from where you are. Clearable from /space/observer/ at any time.
  • Cookie / consent preference. Once the cookie consent banner is active (currently dormant — see below), your choice is stored in localStorage so you aren't asked again.
  • No name, email, or contact information from anonymous visitors. Account holders' email is collected only because the account requires it.
  • No third-party analytics service. Nothing on this site is operated by Google, Meta, or any analytics or advertising company. The interaction counts described below are recorded by my own server and shared with nobody.
  • No page-view tracking. Which pages you read is not recorded — the only thing measured is a click on one of the specific buttons listed below.
  • No behaviour profiling. Nothing links two actions together as having come from the same person, because nothing identifies a person in the first place.
  • No advertising identifiers.
  • No social-media tracking pixels or share-button beacons.
  • No fingerprinting.
  • No scroll tracking, no mouse or pointer recording, no session replay.
  • No marketing email unless you explicitly ask for it. The default is OFF, an account is never opted in by being created, and an address is never added from anywhere else — not from a purchase, not from a bug report, not from a forum post.
  • No open tracking, click tracking or tracking pixels in the newsletter. The studio cannot tell whether you opened an email, and does not want to be able to.
  • No mailing list is ever bought, sold, rented, shared or handed to a third-party newsletter provider.

Deep Sky Creations is an independent studio, and until recently I had no way of knowing whether anyone actually used the things this site is built around — whether the game gets downloaded, whether the store gets opened, whether players find support. Rather than install an analytics product to answer that, I record six specific actions myself.

When you click one of these, the site records that it happened:

  • A game's download or primary button was used.
  • A Shop button opened the store.
  • A link into player support was followed.
  • A link into the community forums was followed.
  • The studio logo was downloaded from the press page.

A record consists of exactly these fields and nothing else:

  • Which action it was, as one of six fixed names (for example game_download).
  • Which game it concerned, as a published title's short name, where the action concerns a game at all.
  • Which part of the site the click came from, as one of ten fixed names (for example game_detail, site_footer). This is not a page address and not a browsing history — it is a coarse label chosen from a fixed list.
  • What kind of destination it led to — a download, a storefront, a page on this site.
  • The time the server received it.

There is no visitor identifier. No cookie is set for this. No random ID is generated and stored in your browser. No IP address, and no derivative of one, is written to this record. If you are signed in, your account is not attached — the server does not even look up your session when handling these messages. Two clicks by you and one click each by two other people are indistinguishable.

The consequence is deliberate: I can tell you how many downloads happened. I cannot tell you how many people downloaded, whether anyone came back, or what any individual did. That was the trade-off I wanted.

Network addresses. Like any web server, mine necessarily sees the IP address your request arrives from — that is how the reply gets back to you. For this feature specifically, the address is used only to apply a rate limit (a cap on how many of these messages one address can send in ten minutes, so a bug or a script cannot flood the database). It is held in a short-lived rate-limit record that is deleted once the window closes, and it is never written into the interaction record itself. This is separate from the ordinary server and infrastructure logs that any hosting provider keeps.

Retention. Interaction records are kept for 18 months and then deleted automatically.

Who sees them. Nobody outside the studio. They are stored in the same Postgres database, on the same Azure infrastructure, as everything else described on this page, and are readable only as totals on an admin-only page. There is no export, no third-party processor, and nothing is sold or shared.

If you would rather not be counted. Blocking JavaScript for this site, or any content blocker that stops background requests, prevents these messages entirely — and every button on the site keeps working exactly as it does now. The measurement is never allowed to sit between you and a download.

You can ask to be told when Deep Sky Creations has something to announce. It is entirely optional, it is off unless you ask, and you do not need an account — the studio is not going to make you register in order to hear from it.

What is stored, if and only if you subscribe:

  • Your email address.
  • Whether you are awaiting confirmation, confirmed, or unsubscribed.
  • Whether the subscription belongs to an account, and which one, if you subscribed while signed in.
  • Whether it began from the website form or from your account.
  • The times you confirmed and, if you leave, unsubscribed.

That is the whole record. There is no name, no IP address, no user agent, no location, no interest categories, no engagement score and no history of what you have been sent.

Confirmation. Subscribing from the website sends one email asking you to confirm. Until you open that link, nothing else is ever sent to the address — so somebody typing your address into the form cannot sign you up. If you subscribe from inside an account whose email is already verified, no second confirmation is needed, because the address was already proven to be yours.

One address, one subscription. The record is keyed on your email address, so having an account and using the public form cannot produce two subscriptions or two copies of the same email.

Leaving. Every newsletter carries an unsubscribe link in its footer and an unsubscribe header your mail client can act on. It needs no login and no password. Account holders can also turn it off from the account page. When you unsubscribe, the record is kept — marked as unsubscribed rather than deleted — so that a future import cannot accidentally put you back on the list.

Unsubscribing also applies to anything already prepared but not yet delivered. An announcement is written for every subscriber at once and sent in small batches over the following minutes; if you leave during that window, your copy is cancelled rather than sent.

Copies of what was sent to you. Outgoing messages sit in the studio's own queue while they are delivered, and are kept for 90 days afterwards so that delivery problems can be diagnosed. They are then deleted. Nothing records whether a message was opened.

No measurement of any kind. The newsletter contains no tracking pixel, no open tracking, and no click tracking. Links in it are ordinary links. The studio cannot tell whether you opened an email or which links you followed.

Deleting your account removes the newsletter subscription outright, address and all, in the same operation.

Who sends it. The studio's own server, over its own SMTP credentials. There is no Mailchimp, no ConvertKit, no HubSpot and no other newsletter provider — your address is never handed to a third party for this.

Deep Sky Creations runs a closed testing programme for software that is not publicly released. It is by invitation, it requires an account, and nothing in this section applies to you unless you have joined it.

Redeeming an access code records that your account holds access: which product, which release channel, which testing group you were invited into, when it was granted, and when it expires. Access codes themselves are stored only as a keyed hash — the code you were given is not recoverable from the database, which is also why a lost code has to be reissued rather than looked up.

Downloading a build records five things: your account, your entitlement, which release, whether the request was authorized, and when. That is the entire row. There is no IP address, no user agent, no referrer, no device or hardware fingerprint, no installation identifier and no download link stored against it — not filtered out at display time, but absent from the table, so there is no column that could join a download to a network identity. These records are deleted after 90 days.

Compatibility results — telling us whether a particular game runs — store the release, the emulated system, the emulation core, a rating, your testing group, the title you type and any notes you write. The title is typed by you: the software does not read, scan, list or transmit the files on your machine, and no filename, file path, directory listing, checksum of your files or BIOS/firmware hash is ever collected. These are kept for 24 months.

Nothing is transmitted that you did not choose to send. The application does not report usage, does not phone home on a timer, and sends no background telemetry. Bug and crash reports go through the same system described elsewhere on this page, and only when you submit one.

If you delete your account, your alpha access is deleted with it, and your compatibility results are kept with the account reference removed — the finding about a game remains useful, the link to you does not exist.

Anonymous browsing sets no HTTP cookies. The only cookie this site ever sets is dsc_session, written when you complete signup + email verification. It carries an opaque random token (no personal data inside it), is HTTP-only and Secure, has SameSite=Lax to mitigate CSRF, and expires 30 days after your last activity.

Browser storage (the localStorage values described above) is used for preferences you set yourself.

The interaction measurement described above sets no cookie and writes nothing to your browser — no analytics cookie, no local storage, no visitor ID. That is why there is no consent prompt for it: there is no storage on your device to ask about, and no identifier to consent to.

Once the planned store launches, cart and checkout functionality will require additional browser storage set by Shopify, which hosts the storefront and checkout. Printful handles print-on-demand production and order fulfilment behind the scenes and does not set storage in your browser from this site. At that point a consent banner will activate and you will be asked before any commerce-related cookies are set.

The site connects to a small number of outside services. Each is listed below with what it's used for and whether it sees any information about you.

OpenStreetMap Nominatim
Used by /space/observer/ to turn your latitude/longitude into a city name. Your coordinates are sent to nominatim.openstreetmap.org for this lookup. No identifying information goes with them. Falls back silently if the service is unreachable.
NASA APOD
The site's daily APOD feature is rebuilt server-side from api.nasa.gov each morning. Your browser never connects to NASA on your behalf — the imagery is served from this site's own CDN.
Shopify v1.1
Storefront and checkout. When the store launches, product browsing, cart, checkout and payment processing happen on Shopify's hosted commerce platform, and the details you enter to complete an order are submitted to Shopify rather than to this site. Shopify will set its own commerce cookies; you will be asked before they are loaded.
Printful v1.1
Production and fulfilment. Printful prints items on demand and ships them, and so receives the order information needed to produce and deliver it. It is not part of the storefront or the checkout, and it is not involved in browsing this site. Will not be active until the store launches.

For anonymous browsing, the data you can control all lives in your own browser:

  • Clear /space/observer/ to remove your saved observing location.
  • When the cookie consent system is active, this page will offer a button to revoke any choices you've made.
  • Use your browser's "clear site data" tools to remove everything Deep Sky Creations has stored locally.
  • Block JavaScript or background requests for this site to stop the interaction counts described above. Everything on the site keeps working.

One honest limitation: an interaction record cannot be shown to you, corrected, or deleted on request, because there is nothing in it that identifies you or connects it to any other record. It is a tally mark. That is the point of it, and it is also why it cannot be looked up — including by me.

For account holders, you also have:

  • Access. Email me from the address on file and I will export everything we hold about your account in a machine-readable format.
  • Correction. The account page (when it ships) will let you edit your email, username, and settings directly. Until then, email me.
  • Deletion. Email me to delete your account. Hard deletion removes the account row, sessions, settings, observing locations, reactions, and saves; forum posts you authored stay with their author column set to NULL so the conversation history isn't shredded for everyone else.

If the store launches and you make a purchase, that order is placed and paid for on Shopify and is held by Shopify under their privacy policy; they have their own deletion/access tools. Where an item is printed on demand, the information needed to produce and ship it is also passed to Printful, under theirs.

Privacy questions can go to Mike at [email protected]. I read everything I'm sent.