Privacy Policy

Last updated: 9 October 2026

Skyshot is a sunlight alarm clock for iPhone. It was built to know as little about you as possible. This policy explains what the Skyshot app and this website process, why, and what rights you have under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).

In short

  • No account. We never ask for your name, email address, phone number or contacts.
  • Your photos never leave your device. The sky check runs on your iPhone using Apple's Vision framework.
  • Anonymous usage analytics are sent only if you consent, and are tied to a random install ID, not to you.
  • We do not store IP addresses, do not use advertising identifiers, do not track you across apps or websites, and never sell data.

Who is responsible

The data controller is Melih Arık, Tallinn, Estonia (“we”, “us”). You can reach us any time through the support form.

Camera, photos and the sky check

When an alarm rings, Skyshot asks you to point your camera at the sky. Camera frames are analysed on your iPhone with Apple's on-device Vision framework to confirm that you are looking at real daylight. Frames and photos are never uploaded to us or to anyone else. When a sky check succeeds, one small photo of that sky is stored only in the app's storage on your device (and in your own iCloud or device backup, if you use one) to build your Sky Collage. It is not added to your photo library, and it is removed when you delete the app.

Location (optional)

If you turn on Use location for sunrise in the app's Settings, your iPhone's location is used on the device only, to work out whether the sun is up (so the sky check can switch to window mode before sunrise). Your location is never sent to us. Without it, the app estimates this from your time zone. With analytics consent, sky-check events include the calculated sun altitude in degrees, never coordinates.

Analytics (only with your consent)

On first launch the app asks whether you want to share anonymous usage statistics. Nothing is sent before you answer, and if you say no, nothing is sent at all. If you say yes, the app sends events such as “onboarding step completed”, “alarm created”, “sky check succeeded or failed (with reason)” or “paywall viewed”. Each batch contains:

  • a random install ID generated on your device on first launch (not linked to your Apple ID or identity) and a random session ID;
  • app version, iOS version, device model, language/region setting, time zone and whether Skyshot Pro is active;
  • event names, timestamps and technical properties (for example alarm hour, number of attempts, sky-confidence score).

We never collect photos, names, email addresses, precise location, contacts or anything you type. Our server does not store your IP address. If our network provider supplies a country code with the request, we store that country code only.

Purpose: understand which parts of Skyshot work and improve the app. Legal basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). You can withdraw consent at any time in the app (Settings → Privacy → Share anonymous analytics); the app then stops sending analytics immediately and discards events it has not sent yet. The same screen shows your install ID.

Purchases (Apple and RevenueCat)

Payments are processed by Apple; we never see your payment details or your Apple Account. Purchases are made with Apple's StoreKit, and the random install ID is attached to them as an anonymous account token so a purchase can be matched to an install. For subscription management the app can also use RevenueCat (RevenueCat, Inc., USA): when it does, RevenueCat receives the install ID as an app user ID together with purchase information from Apple (product, price, currency, store country, transaction dates), and we receive the same information through RevenueCat webhooks to understand trials, renewals and cancellations. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Crash and performance diagnostics (Apple MetricKit)

If you enabled Share with App Developers in iOS Settings, Apple delivers aggregated crash and performance reports (MetricKit) to the app, which forwards them to our server together with the app version and the install ID. These reports contain technical data only (for example stack traces, launch times, battery and memory metrics). Legal basis: our legitimate interest in a stable app (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). This depends only on the iOS setting, not on the in-app analytics choice. You can turn it off in iOS Settings → Privacy & Security → Analytics & Improvements.

This website

skyshot.meliharik.dev uses no cookies and no third-party trackers. We count page views (page path, the referring website's domain and a campaign tag if present) and clicks on App Store links (campaign, browser family and whether the device is an iPhone). We do not store IP addresses or any identifier that could recognise you on a later visit.

Support messages

If you contact us through the support form we store your message and, if you choose to provide them, your email address and install ID, so that we can answer and act on your request. Legal basis: legitimate interest / steps at your request.

Processors and international transfers

  • Railway (Railway Corporation, USA): hosting of our server and database.
  • RevenueCat (RevenueCat, Inc., USA): subscription management.
  • Apple: App Store distribution, payments, MetricKit diagnostics.

Where data is transferred outside the EEA or Türkiye, the transfer is based on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, and on the safeguards required by KVKK Art. 9.

Retention

Analytics events, install records, diagnostics, support messages, website page views and App Store link clicks are kept for 18 months and then deleted automatically (a cleanup job runs on every server deployment and on a schedule). Purchase records are kept as long as required by tax and accounting law.

Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Under KVKK Art. 11 you may learn whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction or deletion, object to outcomes of automated analysis, and claim compensation for unlawful processing.

Because we don't know who you are, please include your install ID (shown in the app under Settings → Privacy, where Contact support opens the form with it filled in) when you send a request through the support form. We will delete all events, installs and diagnostics linked to that ID and reply within 30 days. You also have the right to lodge a complaint with a supervisory authority, such as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the authority of your EU country of residence, or Türkiye's Personal Data Protection Authority (KVKK).

Children

Skyshot is not directed at children under 13 and we do not knowingly process their data.

Changes

If this policy changes we will update the date above and, for material changes, tell you in the app.