Privacy notice
Who we are
Nightsky.pics is a website for astronomy images. The controller of your personal data is Parsec VZW, a Belgian non-profit association, Cijnsstraat 9/B, 9880 Aalter, Belgium. Enterprise number: BE 0674.747.341.
Contact for privacy questions: [email protected], or the contact form on this site. Parsec VZW is a small association and has no data protection officer.
The site is for people of 13 years and older. We do not knowingly store data of younger children. If you know of such an account, write to us and we delete it.
What we store
Account: your email address, display name, alias, profile text, profile photos and setup photos. A hash of your password (we cannot read the password). If you use two-factor login, the secret key (encrypted) and the recovery codes (as hashes). If you sign in with Google or Discord, the account number from that site and the email address it gives.
Images: the files that you upload, the web sizes that we make, and the data that you type or that the file contains, for example the telescope, the date and the exposure.
Position: if an image file contains a GPS position, we keep the exact position. It stays private. We use it to find the Bortle class of the sky. Other visitors see only a rounded place (a grid of 1 to 50 km, which you choose) or nothing. We remove the GPS data from the stored files and the downloads.
Activity: your likes, bookmarks, comments and follows, your showcase, your challenges and the objects that you tag in your images. Your bookmarks are private. Only you see them. The owner of an image sees only how many people bookmarked it.
Groups: the groups that you make and their logos, the groups that you join and the images that you add to a pool. Your groups show on your profile. Everybody sees the members of a group. When we erase your account, a group that you made with other members stays for them, without your name.
Views: we count the views of each image page. A view counts once for each person, image and day. For a signed-in person we use the account number. For other visitors we make a hash of the IP address and the browser name with a random key of the day. The key and the hashes are in memory only, and they go at the end of each day. We store the number of views of each image for each day and each country. Cloudflare gives us the country from the IP address. We do not store the IP address, and we set no cookie for this. The owner of the image, staff and search engines do not count.
Downloads and shares: in the same way, we count the downloads of each image and the clicks on its share buttons, for each day and each country. We do not store who downloaded or shared. The owner of an image on a paid plan sees these numbers for the last 90 days. A country shows only when it has 5 or more views. We delete the numbers of each day after 1 year.
Moderation: the reports that you send, and the reports about your images and comments. Staff actions (hide, delete, suspend) go in a moderation log with the date and a short description of the item.
Support access: for support and moderation, staff can view your account read-only, as you see it, and each view is logged.
Payments: if you buy a paid plan, we store your customer number at Stripe, the plan, the billing period, the currency, the status of the subscription, and the dates of the first payment, of a refund and of the next renewal. Stripe keeps your name, your billing address, your payment details and the invoices. We never see your full card number. If you made your account through a referral link, we store which account sent you.
Donations: if you donate, Stripe asks your email address and, for the invoice, your name and address. Stripe keeps these and sends you the invoice. We store nothing about a donation on our server.
Technical data: the IP address and the browser name of each login session, stored with the session. To stop attacks, we count requests for each IP address and each account. These counts are in memory only, for at most one hour.
Cookies
nsp_session keeps you signed in, for 30 days or until you sign out. nsp_mfa holds a login that waits for the two-factor code, for 10 minutes. nsp_oauth holds the state of a Google or Discord login, for 10 minutes.
Only on the checkout page, the page loads the script of Stripe. There Stripe sets its own cookies (for example __stripe_mid and __stripe_sid) to stop payment fraud. They are necessary for the payment that you ask for.
These cookies are strictly necessary for the site. We use no analytics, advertising or tracking cookies. So the site does not ask for cookie consent.
Why we use your data
To give you the service that you ask for: your account and your images (GDPR article 6(1)(b), contract).
To keep the site and the accounts safe, for example with rate limits and the list of login sessions (GDPR article 6(1)(f), legitimate interest).
To sell and bill the paid plans, and to keep the invoices that the tax law asks for (GDPR article 6(1)(b), contract, and article 6(1)(c), legal obligation).
To show you a weather forecast on Tonight, or to copy your Gravatar photo, only when you ask for it (GDPR article 6(1)(b)).
To moderate the site and to keep the moderation log (GDPR article 6(1)(f), legitimate interest).
Your email address and a password are necessary for an account. All other data is optional. We make no automated decisions with legal effect about you, and we do not sell your data.
Who processes your data for us
Contabo GmbH, Germany: the server and the database.
Cloudflare, Inc. (United States): all requests to the site go through Cloudflare. Cloudflare protects the site, keeps the public files in its cache and gives us the country of each request. Cloudflare R2 stores the image files. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and we have its data processing agreement with the EU standard contractual clauses.
Amazon Web Services EMEA SARL (Luxembourg): Amazon SES sends the mail of the site, from the EU region Frankfurt (eu-central-1). Amazon S3 in the same region holds our encrypted backup. Amazon is certified under the EU-US Data Privacy Framework, and we have its data processing agreement with the EU standard contractual clauses.
Stripe Payments Europe, Limited (Ireland): the payments, the invoices and the VAT of the paid plans. Stripe can send data to Stripe, Inc. in the United States. For its own fraud checks and legal duties, Stripe is also a controller. Stripe is certified under the EU-US Data Privacy Framework, and we have its data processing agreement with the EU standard contractual clauses.
Google and Discord get data only when you choose to sign in with them.
Gravatar (Automattic Inc., United States) gets a hash (SHA-256) of your email address only when you click "Use my Gravatar". We copy the photo to our server one time. Visitors of the site never load images from Gravatar.
Tonight sends the position, rounded to about 10 km, from our server to MET Norway (Norwegian Meteorological Institute) for the weather forecast.
How long we keep your data
We keep your data while you have an account. When you delete the account, it goes off the site at once: your profile, images and comments no longer show. We keep the data and the image files, so that we can give the account back. Staff read the reason that you give in the delete form. To erase the data and the files for ever, write to us. When you delete an image, we delete its files at once. We keep its data, its likes, ratings and comments for the statistics, and nobody sees them.
One exception: the moderation log keeps the date and the short description of a staff action for 1 year after the erasure of the account. Then we delete the log line.
A second exception is for payments: when you delete your account, we end your subscription at once, without a refund. Stripe and our bookkeeping keep the invoices and the payment records for 10 years after the end of the year of the invoice, as the Belgian VAT and accounting law asks.
Login sessions end after 30 days. Mail links end after 1 to 48 hours.
Backups: each night an encrypted copy of the database and of the new files goes to Amazon S3 in Frankfurt. A deleted file leaves the backup within 6 months. A copy of the database leaves the backup within 1 year.
Server logs: the web server logs each request with the IP address, the page and the browser name, to find faults and attacks. We keep these logs for at most 30 days.
Your rights
Access and portability: in Settings, Account, click "Data" (a ZIP file with all your data, once a day) or "Full archive" (the data and your original files, once every 30 days). Before you delete your account, you can download one more full archive.
Correction: change your data in Settings and on your images.
Deletion: in Settings, Account, use "Delete my account". To erase your data for ever, write to us.
Objection and restriction: send us a mail at the contact address above.
Complaint: you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, [email protected].
Changes
If this notice changes, we show the new version on this page. For a large change we also send you a mail. Last change: 11 October 2026.