Privacy Policy

The controller responsible for your personal data is SkyZone. For any privacy question or request, contact us at ahmadrazakhalid13.0@gmail.com.

We only collect what we need to create, deliver and manage your dedications:

• Account data: name, email address, a securely hashed password (we never store it in plain text), optional profile picture and language preference.
• Order data: buyer name and email, the packages you choose, prices, discounts, promo codes and order status.
• Dedication content: the place and coordinates you select, the recipient, record holder, "gifted by" name, your dedication message and certificate design.
• Stories and memories: titles, text and photos you choose to add to your zones.
• Technical data: your IP address (used briefly in memory to prevent abuse such as password-guessing, not stored in our database), and standard server logs kept by our hosting provider.

• To provide the service (creating your account, processing orders, creating your SkyZones and sky pages, sending account and order emails) — necessary to perform our contract with you.
• To keep the service secure (sign-in sessions, rate limiting, preventing fraud and abuse) — our legitimate interest in protecting you and the platform.
• To meet legal obligations, such as keeping order records for tax and accounting.

We do not sell your personal data and we do not use it for third-party advertising.

Each SkyZone has a shareable sky page. By default it is public: anyone with the link can see the place, coordinates, recipient, record holder, "gifted by" name, dedication message and any stories you marked as public. Your email address, buyer name and order details are never shown on sky pages.

Please only include names and messages you are comfortable sharing, and make sure you have permission to publish other people's names or photos. You can remove a story at any time, or revoke a dedication from your dashboard.

We use trusted providers who process data on our behalf, only as needed to run SkyZone:

• Vercel — website hosting.
• MongoDB Atlas — database hosting.
• Cloudinary — storage and delivery of photos you upload.
• Google — email delivery, and Google Maps for the location picker (when you use the map, Google receives your IP address and the searches you make).
• Payment provider — when online payments are enabled, card or PayPal details are entered directly with the payment provider; we never see or store full card numbers.

Some of these providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We only use cookies and storage that are necessary for the site to work. We do not use advertising or tracking cookies.

• skyzone_session — keeps you signed in (24 hours, or 30 days with "remember me").
• skyzone_checkout — lets the browser that started a guest checkout finish it (24 hours).
• skyzone_user — your display name and preferences, so pages load instantly.
• NEXT_LOCALE — your language choice (1 year).
• Local storage — your cart and light/dark theme, stored only in your browser.

• Account, zone and story data: until you delete them or delete your account.
• Order records: as long as required by tax and accounting law (typically up to 10 years).
• Sign-in sessions: until they expire or you sign out.
• Password reset links: 15 minutes. Account setup links: 7 days. Email change links: 24 hours.

Depending on where you live (for example under the GDPR), you have the right to:

• access your data — download a copy anytime from Settings → Export;
• correct your data — edit your profile in Settings;
• delete your data — delete your account in Settings;
• restrict or object to certain processing, and data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

For anything you cannot do yourself in Settings, email ahmadrazakhalid13.0@gmail.com. We respond within one month.

We protect your data with encrypted connections (HTTPS), hashed passwords and sign-in tokens, single-use expiring links for password resets and email changes, access controls that limit each account to its own data, and rate limiting against automated attacks. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

SkyZone is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the service evolves. We will change the "last updated" date above and, for significant changes, notify you by email or in the app. See also our Terms of Service.