Privacy Policy

Privacy Policy

Last updated: 28 August 2026

1. Introduction

Welcome to BalloonSpotters.net. Your privacy is important to us. This policy explains what information we collect, why we collect it, who else sees it, and what control you have over it.

This policy covers both the BalloonSpotters website and the BalloonSpotters mobile app for iOS and Android. Where something applies to only one of them, we say so.

BalloonSpotters.net is the data controller for the information described here. You can reach us at any time through our contact page.

2. Information We Collect

• Email address — for signing in, verifying your account, and resetting your password. We do not send marketing email.
• Username — how you appear to other spotters. It is shown next to any sighting or photo you mark public.
• Password — stored only as a salted hash. We never store, and cannot recover, your actual password.
• Image copyright name — optional. If you set one, it is written into the credit bar on photos you upload; otherwise your username is used.
• Sighting records — the balloon registration, the date and time, the coordinates where you were standing, the balloon’s status, and any note you add.
• Location data — the coordinates of a sighting. This is the heart of what the service does: a sighting without a location cannot be placed on a map or matched to a flight.
• Uploaded photos — including the date, time and GPS coordinates recorded by your camera in the photo’s EXIF data. See section 4.
• Balloon tags — words you apply to a balloon, and your votes on other people’s tags. Tags are public and are shown with the name of whoever added them.
• IP address and sign-in times — kept for security, abuse prevention and troubleshooting.
• Cookies — session cookies on the website only. See section 8.

We do not collect contacts, calendars, health data, financial data, advertising identifiers, or any device identifier used for tracking. We do not track you across other apps or websites, and we do not sell your data or share it with advertisers.

3. Device Permissions in the App

The app asks for permission before using anything on your device. Each one is optional — declining it limits the related feature but does not stop you using the app. You can change your mind at any time in your device settings.

• Location (while using the app) — to record where you were standing when you logged a sighting, so it appears in the right place on the map. The app never requests background or “always” location access, and does not read your location while it is closed.
• Camera — to photograph a balloon and attach the photo to a sighting. Photos are only taken when you press the shutter.
• Photo library (read only) — to let you pick an existing photo, and to read its date and location so the sighting can be placed correctly. The app never writes to your photo library and never uploads a photo you have not chosen.
• Notifications — to tell you about problems syncing your logs. You can decline this and everything else still works.

4. Photos and EXIF Data

Photos taken by phones and cameras usually carry hidden EXIF data, including the exact time and the GPS coordinates where the photo was taken. When you choose a photo, the app reads that data so it can place and time your sighting accurately, and so it can check the photo genuinely belongs with the log you are attaching it to.

If you upload the photo, that time and location are stored with your sighting. If you mark a sighting or a photo private, the coordinates are not shown publicly — but please treat any photo you make public as revealing roughly where you were standing when you took it.

Uploaded photos are automatically screened for unsuitable content before they appear publicly. See section 6.

5. How We Use Your Information

• To run the service: recording your sightings, syncing them between your devices, and building your statistics.
• To build the public record — balloon histories, the gallery, the map and community totals — from sightings you have marked public.
• To send you account email: verification, password resets, and important notices about the service.
• To keep the service safe: preventing abuse, screening uploads, and investigating problems.

We do not use your information to profile you, target advertising, or make automated decisions with legal effects. The one automated process we do run is content screening on uploaded photos, described in section 6.

6. Content Moderation

Photos uploaded to BalloonSpotters are automatically screened by Amazon Rekognition, an image analysis service, before they are shown publicly. This checks for explicit or unsuitable content and for whether the photo appears to contain a balloon. A photo that is flagged is held for a person to review.

Other users can also report a photo they think is unsuitable, from both the website and the app. Reports go to our moderators and are reviewed by a person.

If you believe a decision about your photo was wrong, please contact us and a person will look at it again.

7. Who Else Sees Your Information

We do not sell, rent or trade your personal information. We share it only with the service providers we need to run BalloonSpotters, and only as far as each one needs:

• Amazon Web Services — hosting, image storage and the automated content screening described above.
• Brevo — sending account email such as verification codes and password resets.
• OpenStreetMap — supplies the map tiles used in the app. Loading a map sends your device’s IP address and the area you are looking at to the OpenStreetMap tile servers. It does not receive your account details or your sightings.

We will also disclose information where we are legally required to, or where it is necessary to protect the rights, property or safety of BalloonSpotters, our users, or the public.

Some of these providers operate outside the UK. Where information is transferred internationally, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement or equivalent contractual terms.

8. Legal Basis for Processing

• Contract — running your account and storing your sightings, which is what you signed up for.
• Consent — device permissions, and choosing to make a sighting or photo public. You can withdraw either at any time.
• Legitimate interests — keeping the service secure, preventing abuse, and moderating content, balanced against your rights.
• Legal obligation — where the law requires us to keep or disclose something.

9. Cookies

The website uses session cookies to keep you signed in. They are temporary and are removed when you close your browser. We do not use advertising or tracking cookies. The mobile app does not use cookies at all — it stores your sign-in token securely on your device using the operating system’s own keystore.

10. How Long We Keep Your Information

• Your account — for as long as it is open.
• Sightings and photos — indefinitely, because they form the historical record of the balloons they document. See section 11 for what happens to them if you delete your account.
• IP addresses and sign-in records — kept only as long as needed for security and troubleshooting.
• Moderation records — kept for as long as the photo they relate to exists, so decisions can be reviewed.

11. Deleting Your Account

You can delete your account at any time. On the website: sign in, open your Profile and choose Delete Account. In the app: More → Settings → Account → Delete Account. You will be asked to confirm your password. You can also ask us to delete your account through our contact page.

Deletion is immediate and cannot be undone. Whatever you choose about your photographs:

• Your email address, username, password and preferences are permanently erased.
• You are signed out on every device straight away.
• Your public profile, your gallery page and your place on the leaderboards disappear. Your account stops being something anyone can look up.
• The notes you wrote on your sightings are deleted.
• Your sightings remain on the site as anonymous records. They keep the registration, the time and the place, and are not linked to any account.

We keep the sightings because they are not only a record of you — they are the record that a particular balloon flew over a particular place on a particular day, and other balloons’ histories, the map and the community totals are built from them. Removing them would take pieces out of other people’s records, and could leave a balloon with no recorded sighting at all. Once your account is deleted, nothing in those records identifies you.

Your photographs: your choice

When you delete your account we ask what should happen to your photographs, and neither answer is chosen for you:

• Remove them. Every photograph you uploaded is deleted from the site and from our storage. Your sightings stay, without the pictures.
• Donate the public ones to the archive. Photographs you had already made public stay on the site as part of our archive of hot air balloons. Anything you kept private, or that was still awaiting review, is removed either way — only what you had already chosen to publish can be donated.

If you donate, you choose again whether to keep your photographer credit. Keeping it means your name stays on the photographs, on the archive page for them, and everywhere the credit is counted — including the curator board. Donating anonymously means the credit bar drawn into each photograph is re-drawn with no name on it, no page is created for you, and nothing links the photographs to you.

The credit bar deserves a word of its own, because the name is drawn into the image itself rather than stored beside it. Where you have asked for your name to go — an anonymous donation, or removal — we re-draw or destroy the picture itself, not merely the database row. If you change your mind later, contact us and we will remove the photographs or the credit.

If you deleted your account from an older version of the app — one whose deletion screen did not offer this choice — we did what that screen said: your photographs were kept, with the credit bar re-drawn so your name is not on them, credited to “Former member” and linked to no account. We did not apply a choice you were never shown. Contact us if you would now rather they were removed.

Deleting a sighting or a photo. When you delete a sighting, it disappears from the site immediately. The image file itself is kept for up to 30 days so that a deletion made by mistake can still be undone from your device, and is then permanently destroyed.

12. Your Rights

Under UK GDPR you have the right to access the information we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable format. The app can export your full sighting log as a CSV file at any time (Log → Export), and you can delete your account from the website or app as described above.

To exercise any other right, please contact us. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

13. Children

BalloonSpotters is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, please contact us and we will remove it.

14. Security

Passwords are stored as salted hashes and are never recoverable. Traffic to the site and the API is encrypted in transit. The app stores your sign-in token in the operating system’s secure keystore. Access to personal data is limited to the people who need it to run the service.

No system is perfectly secure, but if a breach occurs that is likely to affect your rights, we will tell you and the Information Commissioner’s Office as the law requires.

15. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it last changed. Where a change materially affects how we use your information, we will tell you directly rather than only posting it here.

16. Contact Us

If you have any questions about this policy, or want to exercise any of your rights, please contact us.