Privacy Policy

OVERHEAD ("the App", "we", "us") is a browser-based live sky projector at overhead.world, operated by Jash Patel. This policy explains what data the App touches and why. OVERHEAD is designed to be privacy-first and stateless: it has no user accounts, and it does not store your location or build a profile of you.

Location

• If you allow it, the App reads your approximate position through your browser's Geolocation API, purely to calculate the sky above you.
• Your coordinates are processed in your browser and held only for the current session. We do not save them to a database or associate them with you.
• To turn coordinates into a place name, a coordinate rounded to about 110 m is sent to the OpenStreetMap Nominatim geocoding service, through our proxy.
• To show nearby aircraft, a coordinate deliberately coarsened to about 11 km is sent to the adsb.lol aircraft-data service, through our proxy. The aircraft query covers a 150 nautical-mile radius, so it does not need your exact position — and the coarser value also lets many nearby visitors share one cached result. Your full-precision position never leaves your browser.
• If you search for a place in ZENYTH, the text you type is sent to Nominatim (through our proxy) to find matching places. Searches are only sent once you pause typing, not on every keystroke.
• If you tap an aircraft, its public callsign — not your location — is sent to adsb.lol's static route dataset to look up the origin and destination airports.
• If you deny location, the App still works — you set a location yourself via ZENYTH, and nothing is read from your device.

Our proxy & server logs

Every live-data request the App makes goes through OVERHEAD's own caching proxy — aircraft positions, the ISS, place-name lookups, place searches and flight-route lookups. There is no fallback that contacts a data service directly, so those services never receive your IP address or a connection from your browser. The trade-off is that live data needs the proxy: if you run OVERHEAD from a local file or host a copy somewhere without the proxy, the App tells you live data is unavailable, and the offline sky (stars, planets, the Moon, the Milky Way) keeps working.

As with any internet service, the underlying hosting infrastructure may transiently log standard request metadata (such as IP address and the requested URL) for operation and abuse-prevention. This is not used to track you or build a profile.

The proxy only ever talks to four allow-listed hosts, and rejects anything else:

• api.adsb.lol — live aircraft positions.
• api.wheretheiss.at — the International Space Station's position.
• nominatim.openstreetmap.org — place names and place search.
• vrs-standing-data.adsb.lol — adsb.lol's static flight-route dataset, queried by callsign when you tap an aircraft. It receives no location data.

On-device storage

• The App uses your browser's local storage to remember a few non-identifying preferences: render scale, projector corner calibration, Ceiling Mode settings (mirroring, compass rotation, sky preset), whether alerts are muted, whether the "up next" panel is shown, whether you have seen the intro tour, and your time-lapse settings. This stays on your device. Your location is not among them — it is never written to storage, and you set it again each visit.
• Time-lapse recordings are created and stored locally (your Downloads folder and a private in-browser file area). They are never uploaded to us.
• The optional mobile facing compass reads your device's orientation sensor when you enable it (a tap, which on iOS also grants sensor permission). That reading is used live, on your device, only to show which way you're facing — it is never stored or transmitted. The separate orient control that rotates the sky is set by hand (a dial or a typed bearing) and uses no sensor.

Analytics

The only analytics OVERHEAD uses is Vercel Web Analytics, the first-party, privacy-focused analytics built into our host. We use no other analytics, and no advertising or behavioural tracking of any kind.

• It is cookieless — it sets no cookies and stores nothing on your device to identify or follow you.
• Visitors are counted using a temporary hash derived from the incoming request, which is reset every 24 hours, so you cannot be tracked across days, sessions, or other websites.
• Only anonymous, aggregated figures are recorded — for example page views, referrer, country and browser/device type. No IP address or personal identifier is stored against this data, and an individual's browsing cannot be reconstructed from it.

Full details are in Vercel's Web Analytics privacy notice.

What we do not do

• No accounts, sign-in, or passwords.
• No advertising, no cross-site tracking, and no tracking cookies.
• No selling or sharing of personal data.
• Fonts are self-hosted — no request is made to Google Fonts or any font CDN.

Third-party services

When the App contacts adsb.lol (live positions and the static route dataset), wheretheiss.at or OpenStreetMap/Nominatim, those services receive the request from our proxy and operate under their own privacy terms. See the attribution notice for links.

Your rights (UK/EU GDPR)

Because the App does not store personal data about you, there is normally nothing for us to retrieve, correct or erase. Where applicable, the lawful basis for reading your location is your consent, which you can withdraw at any time in your browser. To make a request or ask a question, contact us below. You may also complain to your local data-protection authority (in the UK, the ICO).

Children

OVERHEAD is a general-audience tool and is not directed at children. It does not knowingly collect personal data from anyone.

Changes

We may update this policy; the "last updated" date above reflects the current version.

Contact

Questions about privacy: github.com/Jash2204.