← Sky Score

Privacy Policy

Last updated: 2026-07-23 · Effective: 2026-05-09

1. Who we are

Sky Score is operated by Bilal Khizar, an independent developer based in the United Kingdom. Web: skyscore.co.uk. Contact: support@skyscore.co.uk.

For data protection purposes, we act as the data controller for the limited data described below.

2. What data we collect

2a. Data you actively give us

Browsing and scoring: none. Using the Sky Score website or apps does not require an account, email address, name, phone number, or any other identifying information. There are no payment forms or surveys.

API key signup (optional): if you request a free API key on the developer demo page, we collect the email address you enter (and a display name if you choose to give one). We use it solely to issue your key, enforce the one-key-per-email limit, contact you about your key if we ever need to (for example abuse or deprecation notices), and revoke the key on request. Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)), you are asking us to issue and operate the key, with our legitimate interest in preventing abuse (Article 6(1)(f)) for the rate-limit and one-key-per-email checks. The address is stored in our AWS account in eu-west-2 (London), in the signup register (DynamoDB) and in the API key's own metadata; it is never sold or shared for marketing, and is kept for as long as the key remains active. Email support@skyscore.co.uk to delete it; we revoke the key and remove the record within 30 days.

2b. Data the app uses temporarily, on your device only

When you tap "Score where I am" in the native iOS or Android app:

• Your device's GPS coordinates (latitude + longitude) are read by the app
• The coordinates are sent to api.postcodes.io (a free UK government postcode lookup service operated under the Open Government Licence)
• The response (your nearest UK postcode) is shown to you and used to fetch a Sky Score
• The coordinates are not stored, logged, profiled, or shared anywhere else

If you deny the location permission, the rest of the app works normally — you just have to type a postcode manually.

2c. Anonymous usage analytics

We use GoatCounter, an EU-hosted privacy-respecting analytics service. GoatCounter sets no cookies, doesn't log IP addresses, doesn't track users across sites, and stores aggregate counts only (page views, referrers, screen sizes). Comparable to a server-side log of HTTP requests with personal data scrubbed.

2d. Server logs (AWS)

Sky Score's backend runs on AWS Lambda + API Gateway in the eu-west-2 region (London). API Gateway logs include request timestamps, paths, response codes, source IPs, and user agents. Logs are retained for 7 days then automatically deleted. Used solely for debugging and to investigate suspected abuse. We do not link logs to identities.

3. What data we do NOT collect

• We do not track you across other apps or websites
• We do not build advertising profiles
• We do not sell, rent, or license any data to third parties
• We do not use third-party analytics that profile users (no Google Analytics, no Facebook Pixel, no Mixpanel, no Segment)
• We do not use cross-app identifiers (no IDFA, no ADID, no device fingerprinting)
• We do not access your messages, photos, contacts, calendar, microphone, or camera

4. Subprocessors

Subprocessor	Purpose	Data	Region
Amazon Web Services (AWS)	Backend compute, API Gateway, DynamoDB	Anonymous request logs (7-day retention)	eu-west-2 (London)
S3 + CloudFront	Static asset delivery	Standard CDN logs	Multi-region
api.postcodes.io	Postcode lookup from coordinates	Lat/lon (transient)	UK
GoatCounter	Anonymous analytics	Aggregate counts	EU (Berlin)
Codemagic	Building iOS / Android binaries	Source code only — no user data	EU
Apple App Store / Google Play	App distribution + crash reports if you opt in	Standard store telemetry	Various

Full list with their respective privacy policies: SUBPROCESSORS.md in our public repo.

5. Public source data

Sky Score's content (the underlying scores) is computed from public datasets: DEFRA Strategic Noise Maps, HM Land Registry Price Paid Data, EPC certificate register, ONS National Statistics Postcode Lookup, NHS facility data (via OpenStreetMap), TfL Open Data. All under the Open Government Licence v3.0. We don't request data about you from any of these sources.

6. Your rights (UK GDPR)

Even though we hold very little data about you, your UK GDPR rights apply. You can:

• Ask what data we hold about you (almost certainly: nothing)
• Ask us to delete any data we do hold (we'll do it within 30 days)
• Withdraw consent to anything we're processing under consent (uninstalling the app revokes location consent)
• Lodge a complaint with the Information Commissioner's Office: ico.org.uk

To exercise these rights, email support@skyscore.co.uk.

7. Children

Sky Score has no minimum age requirement and does not knowingly collect data from anyone, including children. The iOS app is rated 4+ on the App Store.

8. Cookies (web only)

The Sky Score website (skyscore.co.uk) does not use cookies. The native iOS and Android apps do not use cookies either.

9. Security

All API calls use HTTPS (TLS 1.2+). AWS infrastructure is hosted in eu-west-2 with standard AWS security controls. API rate limiting is in place. Full security posture: SECURITY.md. Security issues: support@skyscore.co.uk (we acknowledge within 48 hours).

10. Changes to this policy

Material changes (new subprocessors, new data types) trigger an update to the "Last updated" date and an in-app notice. Non-material changes (typos, formatting) won't trigger a notice.

11. Contact

Privacy questions: support@skyscore.co.uk. We aim to reply within 5 working days.