Globe
Privacy

Legal

Privacy Policy

What Gods Eyes collects, where it goes, how long it stays, and the choices and rights you have, written from what the app actually does.

Last updated: November 13, 2026

The short version

Most of the globe works with no account. We set no cookie of our own unless you hold a paid plan, a screen you paired plays live camera video for one, you opened someone’s invite link, or you started the free preview of a live 3D landing.
We run no ads and no third-party analytics. Our own server keeps simple daily usage counts with no cookies, and leaves you out of them if your browser sends Global Privacy Control or Do Not Track. We do not sell your personal information, and we do not share it for advertising.
If you make an account, we keep your email address and what you choose to save. If you buy a plan, Stripe handles the payment and we never see your card number.
Questions you ask the AI analyst go through OpenRouter to an AI model provider. We do not store them.
Your browser connects directly to some outside services, such as Google and Esri for map tiles, Google for its sign-in prompt, YouTube for video, and a news publisher’s own server for a headline’s photo. Those services can see your IP address.

Who we are

Gods Eyes (“we” or “us”) runs the app and public pages at godseyes.io. This policy covers both. For privacy questions or complaints, email support@godseyes.io.

When you use the site

Every request to godseyes.io passes through Cloudflare and then reaches our server at DigitalOcean. A request includes your IP address, your browser’s details and what was asked for. Requests from the map also carry the area you are looking at, such as the map center used to fetch nearby flights. We do not connect any of this to your name.

Rate limits. Our server counts requests per IP address to keep the service up. Those counts are held in memory only, on one-minute windows, and are lost when the server restarts.
Logs. Our web server keeps no access log of ordinary visits. If a request fails at the web server, its error log can record that request’s details, including your IP address and browser. The app writes operational warnings, such as a data source failing, to a log capped at 50 MB that overwrites its oldest entries, and that log is not designed to record IP addresses or anything you type. Cloudflare and DigitalOcean keep logs and metrics of their own.
Usage counts. To see how the site is used, the app reports to our own server, with no third party and no cookie: the kind of page viewed, how long startup took, the tour step reached, and actions such as opening a plane or ship card, a layer, a desk or a paywall, choosing a plan, starting checkout or buying (the plan and billing period only), using a search result (only its kind, never what you typed), or following a link from one of our public pages to the live map or to pricing (only the kind of page and of link). We keep these only as daily totals. We also count each day’s visitors by device type, country (from Cloudflare), the domain of the site that sent you and any campaign source in the link. To count a visitor once a day, our server scrambles your IP address and browser details with a random value that changes every day. That scrambled ID and the random value stay in memory and are discarded when the day ends or the server restarts. This counting writes neither your IP address nor the ID to disk, and the counts hold no full addresses, exact locations, email addresses, account IDs or search text. If your browser sends Global Privacy Control or Do Not Track, the app sends none of these reports and our server keeps none.
Invite links. If you open someone’s invite link, our server counts a visit from an invite, as a total, and keeps the link’s code in a cookie on your device for 30 days. The code is random and holds no personal details. If you then make an account we add one to a total. If you then buy a plan we record that the invite led to a purchase: the code, the account that invited you, your account and Stripe customer and subscription IDs, the plan, and whether it looked like someone inviting themselves, which we work out by comparing accounts and email addresses and do not store. Whoever invited you is not told. If your browser sends Global Privacy Control or Do Not Track, we do none of this.
Place search. A place you search for goes through our server to Google. If Google has no answer, your browser sends it directly to Photon (run by komoot), and then our server sends it to OpenStreetMap’s Nominatim.
Things that stay in your browser. Drawings, imported map files, saved video walls and scenes are kept on your device and are not uploaded, and so is what you last saw on the Discover desk. So are boards, unless your plan saves them to your account (see below). A USB radio receiver, if you connect one, is decoded in your browser. A share link holds its view inside the link, and we do not store it.

If you make an account

Accounts are optional. Supabase runs sign-in and our account database. It stores:

your email address, account ID and sign-in dates, plus the IP address and browser details of your sessions, which Supabase records for sign-in
your profile: display name if you have one, units and your Stripe customer ID if you have paid
your saved places: name, latitude, longitude and radius
your watch list: an aircraft’s ICAO address or a ship’s MMSI and your label, or an area you drew
your saved boards, if your plan saves them to your account: each board’s name and its windows, including the places, cameras and flights you put in them, until you delete them

Database rules let a signed-in user read and change only their own rows. Our server has a key that could read every account’s rows. It uses that key to read and record the Stripe customer ID on your profile, and to run alerts, described below.

Sign-in emails go out through Resend, so Resend handles your email address and the message, which holds your sign-in link and code.

If you use “Continue with Google”, where offered, Google shares your email address and basic profile (name and picture) with Supabase, which stores them with your account. The app itself uses only your email address and account ID. We do not get your Google password or any access to your Gmail, Drive or YouTube account. You can remove our access at Google’s security settings page.

That option can also appear by itself, as a small prompt from Google. If you are not signed in to Gods Eyes, the app loads Google’s sign-in script a few seconds after the first-visit tour is done. Your browser then connects to Google, which sees your IP address and may recognize your Google session, whether or not you go on to sign in. Close the prompt and Google keeps it away for a while. It does not load if you are signed in to Gods Eyes, on our public pages, on a paired screen or in a popped-out window, or while a board with a video player, the kiosk tour or a recording is on screen. We only learn who you are if you choose to continue.

If you set an alert

Alerts are optional, and only you can turn them on, one watch at a time. If you use them, our account database also stores:

what you watch: a flight’s ICAO address or callsign, or a place’s name, coordinates and radius, with what you asked to hear about and how
your alert settings: the email address to send to, when to send, your time zone, any quiet hours, your plan as we last checked it, and how many alerts went out today
each alert that fired: what happened, when, and whether it was delivered
if you turn on push for a device: its push address and encryption keys, and a short description such as “Chrome on Windows”

Our server checks your watches against public data and asks adsb.lol about watched flights, without saying who is asking. While you have watches, it also asks Stripe every few hours whether your plan is still active.

Alert emails go through Resend, so Resend handles your email address and the message. Push alerts go through the push service run by your browser’s maker (Google, Mozilla, Apple or Microsoft). Messages are encrypted so that service cannot read them, but it sees your device’s push address and that a message was sent.

To stop them: every alert email has a link that stops all alert emails, with no sign-in. In the account desk you can pause or delete any watch, change or turn off email, and turn off push. Your browser’s site settings also control push on that device.

If you ask for the daily brief by email

Reading the daily brief needs no account, and nothing about you goes into writing it: it is written from public feeds, once for everybody. The email is optional, and only you can turn it on. If you do, our account database also stores the email address to send to, the hour you chose, your time zone, your plan as we last checked it, and when the last brief went out. While it is on, our server also asks Stripe every few hours whether your plan still covers it.

Brief emails go through Resend, so Resend handles your email address and the message. To stop them, use the link in any brief email, with no sign-in, or turn the brief off on the Discover desk. That choice is separate from alert emails.

If you send a window to another screen

You can send a window to a TV or other screen by opening /tv there and typing the code it shows. No sign-in is needed on that screen. Anyone who can see it can see what you send.

What our server holds. The code, for up to 10 minutes. Then, for as long as the pairing lasts: the windows you sent (their type, title and settings, such as a place, a camera or a flight), the name you gave the screen, a random ID for the pairing and your plan level. This is held in memory only and is never written to disk. It goes when you disconnect the screen, when the screen has been away for an hour, when the pairing ends, or when the server restarts.
How long a pairing lasts. 24 hours, extended while you have the app open. If you stay away, it ends and the screen goes back to showing a code.
What the screen gets. Those windows, that name, and a signed token saying which pairing it belongs to and what your plan may show. It does not get your email address, your account ID, your payment details or your saved boards. The token names you only by a code that cannot be read back.
The same providers. Windows on the screen load their maps, feeds, camera pictures and YouTube players the way they do on your own screen, so those providers see that screen’s IP address.

If you buy a plan

Checkout is hosted by Stripe. Sold through Link, LLC, a Stripe affiliate, is the merchant of record, and the sale appears as sold through Onelink. Stripe and Onelink collect your email address, name, billing address and payment details, plus a phone number if you use or create a Onelink account, and use them for payment, tax, fraud checks and receipts under their own policies: Stripe Privacy Policy and Onelink Privacy Policy. We never see your full card number.

We can see your Stripe customer record, including your email address, name, plan, status and payment history. If you are signed in when you buy, we give Stripe your email address and account ID so the plan follows your account. When you sign in, our server asks Stripe which subscription belongs to your account, including by searching for your verified email address so that a plan bought while signed out can join your account. The answer is held in memory for a few minutes.

Your plan is remembered by the ws_clearance cookie described below.

The AI analyst

When you ask the Analyst desk something, or ask what is on the map, your browser sends our server your question, the earlier messages in that conversation, the map’s center and height, the place name if known, the layers you have on, what you are tracking, data the Analyst read from the map to answer, and your language. Our server adds its instructions and passes that to OpenRouter, which passes it to the AI model provider. The model we use today is from OpenAI, and we may change it.

Our server keeps no conversation and does not log your questions. It does not send OpenRouter your IP address, email address or account ID.
Our requests set OpenRouter’s option to use only providers that do not collect user data. We rely on OpenRouter and the provider to honor that. Each handles what it receives under its own policy, so please do not type sensitive personal information into the Analyst.
The conversation is kept in your browser tab and is gone when you close the tab.
To apply daily limits, our server counts questions and tokens against your IP address, or your subscription ID on a paid plan. Those counts are held in memory until midnight UTC. Server-wide daily totals are saved to disk with no visitor details.

Your location

Some desks have a button to use your device’s location. Nothing happens until you press it and allow it in your browser’s prompt, and you can refuse or withdraw that permission in your browser at any time.

On a first visit the map opens over a busy part of the sky, near you where the flight data allows. To choose it, our server reads the rough country Cloudflare adds to the request. It does not store or log that country, and your browser is not asked for anything.

The location is used in your browser. The location brief sends your coordinates directly to the US National Weather Service to fetch local alerts. The map then moves to that spot, so its ordinary requests, described in this policy, are for that area, and the app combines your location with aircraft, hazard, weather and map data from the providers listed below. Our server does not store your device location. A saved place is stored only if you save it yourself.

Cookies and browser storage

This is what the app itself stores on your device:

Name	What it is for	How long
`ws_clearance` (cookie, HttpOnly)	Set only if you hold a paid plan. It proves your plan to our server and holds your plan level, Stripe customer ID, subscription ID, account ID if any, and check times. It is signed, not encrypted.	Up to 30 days, renewed each time it is checked. Removed if the plan lapses, or when you sign out of the account it belongs to.
`ws_screen` (cookie, HttpOnly)	Set only on a paired screen, and only if the person who paired it holds a paid plan. It holds the pairing’s signed token and is sent only to our own API routes, so that the screen can play live camera video and follow flights that plan covers, with no sign-in.	Until the pairing ends: 24 hours, extended while the sender has the app open. Removed when the screen disconnects.
`gev_invite` (cookie, HttpOnly)	Set only if you open someone’s invite link. It holds that link’s code and is sent only to our own API routes, so that a purchase can be recorded as coming from the invite.	30 days, or until you buy a plan.
`gev_landing_taste` (cookie, HttpOnly)	Set only if you start the free preview of a live 3D landing. It holds no details about you, and only remembers that this device has had its preview.	1 year.
`sb-…-auth-token`, `sb-…-auth-token-code-verifier` (local storage)	Your sign-in session (tokens, account ID, email address), and a temporary value and the address used while a sign-in link is pending.	Until you sign out or clear site data.
`gev…`, `godsEyeView…` (local storage)	Your settings and what you made: interface mode, layers, language, panel positions, map style, drawings, saved video walls, boards and scenes, whether you have seen the first-visit tour, what you last saw on the Discover desk (so it can mark what’s new), plus recent voice error notes and voice settings. If your boards are saved to your account, a copy stays here so they work with no connection. On a paired screen, its signed token, so it reconnects by itself.	Until you clear site data.
`gev:screens:v1` (session storage)	The screens you connected this session, and the windows you sent to them.	Until the tab closes.
`gev:analyst:conversation:v1` (session storage)	Your Analyst conversation for this tab.	Until the tab closes.
The address bar	The part of the address after `#` holds your current map view. Browsers do not send that part to servers.	Until you leave the page.

Others may store things on your device. YouTube’s player may use cookies or similar technology when you open it. Google may do so when you open Street View, and its “Continue with Google” prompt may set a cookie such as g_state, which remembers that you closed the prompt so that it stays away for a while. Stripe and Onelink do on their own checkout and account pages. Cloudflare can set security cookies such as __cf_bm or cf_clearance if it checks a visit for bots, and it asks browsers to report connection errors to it (Network Error Logging).

The usage counts described above store nothing on your device. We run no cross-site tracking of our own, and we honor Global Privacy Control and Do Not Track signals by leaving you out of those counts.

Who else receives data

Services that work for us

Service	What it does	What it receives
Cloudflare	DNS, HTTPS, caching and attack protection, and receiving email sent to support@godseyes.io	IP addresses, all traffic to the site, support emails in transit
DigitalOcean	Hosts our server in the United States	Everything our server handles, including its logs
Supabase	Sign-in and account database, in the United States	The account data listed above
Resend	Delivers sign-in emails, and alert and daily brief emails if you ask for them	Your email address and the message
The push service run by your browser’s maker (Google, Mozilla, Apple or Microsoft)	Delivers push alerts, if you turn them on for a device	That device’s push address, and an encrypted message it cannot read
Stripe and Onelink	Checkout, merchant of record, tax, receipts, subscriptions, fraud checks and transaction support	The payment data listed above, and your account ID
OpenRouter	Routes Analyst requests to an AI model provider (today, OpenAI)	The Analyst data listed above
Google	Hosts the mailbox that support emails are forwarded to	Your support emails

Services your browser contacts directly

When the app needs these, your browser connects to them itself. Each one receives your IP address, browser details, our site’s address as the referrer, and what was asked for. Map tile requests show roughly which area you are viewing. They handle this under their own policies.

Google: Google Fonts on every page, Google Maps Platform 3D map tiles on the 3D globe, Street View if you open it, and its sign-in script for the “Continue with Google” prompt, as described above (Google Privacy Policy).
Maps and imagery: Esri labels, imagery and charts; a Cesium credit image; and, depending on your map settings and layers, OpenFreeMap, OpenStreetMap, NASA GIBS, Re:Earth terrain and dontgetflocked.com (camera-location tiles for the ALPR layer).
Street-level imagery, if you open it: Mapillary (part of Meta), KartaView and Panoramax.
Video: YouTube, described below.
Public feeds: the US Geological Survey for earthquakes, and the National Weather Service for alerts.
What you tune or open: a radio station’s own stream host when you play it, a transportation agency’s video server for cameras that stream directly, Wikimedia for aircraft photos, and Photon for place search.

Services our server contacts

Our server fetches most live data itself, including from adsb.lol, ADSBHub, AISStream, TomTom, Overpass, Google Places and Geocoding, MET Norway, GDELT, Nominatim, Radio Browser, transit and camera agencies, and the other sources on Data sources. These services may receive the map area or search term a request is about, but from our server’s address, not your IP address.

YouTube

Gods Eyes uses YouTube API Services. The Live webcams layer plays live cameras in YouTube’s embedded player, and the TV news tiles play channels’ own live streams the same way, both from its privacy-enhanced youtube-nocookie.com address. By using these features you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to what Google collects.

What we access. Our server asks YouTube whether each video on our fixed list is public, can be embedded, is live and is not made for kids, and which video each TV news channel on our fixed list is live on. That sends only the video or channel ID and nothing about you. We keep only the video ID, the answer and when we got it, for up to 48 hours, and a video with no current answer is not played.
What we do not do. We never ask you to sign in to YouTube, and we do not access your YouTube account or its data. Our server keeps no record of what you watch. Your choice of TV news channels is saved in your browser.
What YouTube does. A player loads only after you pick a camera or switch on TV news. Your browser then connects directly to YouTube, which may collect data about you, use cookies or similar technology on your device, and show ads or other content of its own in the player. We do not control that, and we run no ads ourselves.
Revoking access. Because you do not sign in to YouTube through us, there is no YouTube access to revoke. To stop the players, close them or turn those features off. You can review and remove any app’s access to your Google account at Google’s security settings page, including the access you gave us if you used “Continue with Google”.
Questions or complaints. Email support@godseyes.io.

How we use information

We use the information above to run the service and show you what you ask for, keep your account and plan working on your devices, apply rate limits and daily limits, protect the service from abuse, see in daily totals how the service is used, answer your messages, keep business and tax records, and meet legal duties. We do not use it for advertising, and we do not build profiles of you.

Selling and sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only to the service providers and in the ways this policy describes, or when the law requires it, or to protect people or our rights, or to a buyer or successor if the business is sold.

How long we keep it

Account, saved places, watch list, alert watches and settings, and your daily brief email choice: until you remove them or we delete your account.
Alerts that fired: 90 days, or until we delete your account.
Payment records: Stripe keeps these under its own policy. Your Stripe customer ID stays on your profile until we delete your account.
Invite records: your invite code until we delete your account. A purchase recorded as coming from an invite stays as a business record with its Stripe IDs, and your account ID is removed from it when we delete your account.
IP-based counts: in memory only, on one-minute windows, or until midnight UTC for Analyst limits.
Logs: the app log until newer entries overwrite it, within its 50 MB cap, and web server error entries until we clear them.
Usage counts: daily totals for up to 400 days. They do not identify anyone. The daily visitor IDs stay in memory only and are gone by the next day.
Support emails: as long as we need them to deal with your request and keep a record of it.
Analyst conversations: not kept by our server. OpenRouter and the model provider keep data according to their own policies.

Security

Traffic is encrypted with HTTPS, our server accepts web traffic only through Cloudflare, the plan cookie cannot be read by page scripts, and database rules keep each account’s rows apart. No system is perfectly secure, and we cannot promise that yours will be.

Your choices

Use the site without an account. Most of it works that way.
Refuse the browser’s location prompt, and use the map center instead.
Remove saved places and watched items in the account desk, and sign out there.
Stop alert emails with the link in any of them, or in the account desk, where you can also pause or delete a watch and turn off push.
Stop daily brief emails with the link in any of them, or on the Discover desk.
Clear this site’s data in your browser to remove local storage and cookies from that device.
Do not open YouTube players, Street View or other optional features if you would rather not connect to those services.
Email support@godseyes.io to ask us to delete your account. The app has no delete button yet.

California privacy rights

This section applies to California residents and is our notice under the California Consumer Privacy Act, as amended by the CPRA. In the past 12 months we have handled these categories of personal information, from you, your device, Stripe, and Google if you use it to sign in, for the purposes in How we use information:

Category	Examples	Disclosed to	Kept
Identifiers	Email address, account ID, Stripe customer and subscription IDs, IP address	Cloudflare, DigitalOcean, Supabase, Resend, Stripe	Until you delete your account; IP addresses as described above
Customer records	Name, billing address, payment details	Collected by Stripe and Onelink	Under Stripe’s policy
Commercial information	Plan, subscription status, payment history	Stripe	Under Stripe’s policy, and as needed for our records
Internet activity	Requests, map area, search terms, Analyst questions	Cloudflare, DigitalOcean, OpenRouter, the AI model provider, map providers	Not stored by us beyond the logs and daily usage totals described above
Geolocation	Rough location from IP address; precise location only if you press a location button; saved places	Cloudflare; the National Weather Service for the location brief; Supabase for saved places and boards	Device location not stored by us; saved places and boards until you remove them

The only sensitive personal information involved is precise geolocation when you choose to share it, which we use only to show you what you asked for. We do not sell or share personal information, as those words are defined in the law, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

You have the right to:

Know and get a copy of the personal information we hold about you, and how we use and disclose it.
Delete personal information we collected from you. We delete your account, saved places and watch list from our database. Stripe deletes payment data for these purchases on request, and doing so cancels any subscription sold to you through it. Some records may be kept where the law allows.
Correct inaccurate personal information.
Opt out of sale or sharing, and limit use of sensitive personal information. We do neither of the things these rights cover, so there is nothing you need to opt out of.
Equal treatment. We will not treat you differently for using these rights.

How to make a request

Email support@godseyes.io with “Privacy request” in the subject and say what you want. We confirm who you are by matching your email address to your account or Stripe record, and we may ask you to reply from that address. You can also use an authorized agent, and we may ask for proof that you gave the agent permission. We aim to answer within 45 days, and if we need up to 45 more we will tell you why.

Other US states

Some other states give their residents similar rights. Use the same email address to make a request. If we turn your request down, you can reply to appeal, and if you still disagree you can contact your state attorney general.

If you are outside the United States

If you are in the UK, the European Economic Area or another place with similar data protection law, this section applies to you too.

Where those laws ask for a legal reason to use your information, ours are:

To provide what you asked for: your account, saved places, paid plan and answers from the AI analyst.
Our legitimate interests: keeping the service secure and running, such as rate limits and error logs, and seeing in daily totals how it is used.
Your consent: using your device’s location, which you can stop at any time in your browser settings.
Legal duties: records we must keep by law.

You can ask us to give you a copy of your information, correct it, delete it, limit how we use it, send it to you in a portable form, or stop using it, and you can withdraw consent you gave. Email support@godseyes.io with “Privacy request” in the subject. We aim to answer within one month.

You can also complain to your local data protection authority, such as the Information Commissioner’s Office in the UK.

Your information is handled in the United States and other countries, as described in Where data is processed. Each provider’s own policy, linked above, explains how it protects information it moves between countries.

Public data about other people

The globe shows what aircraft and ships broadcast and what public agencies publish, and public cameras can show people and vehicles. Military and government aircraft that broadcast public ADS-B are shown live, on public pages and in the app. Private aircraft whose owners opted out of public display through the FAA’s LADD or Privacy ICAO Address (PIA) programmes stay hidden, and so do private boats. Flight pages never show who owns an aircraft.

The People desk covers named public figures. It links one of them to an aircraft only after we approve a member’s suggestion that cites a public source, and never an aircraft whose owner opted out. A live position shows where an aircraft is, not who is on board, so it never proves that the person is aboard. If something on a public page concerns you, email support@godseyes.io and we will look at it.

AI voice

The AI voice operator is not available on the hosted site today, because our server refuses voice requests, so no microphone audio is sent anywhere. We will update this policy before that changes.

Children

The service is not directed to children under 13, or under a higher minimum age set by your country, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email support@godseyes.io and we will delete it.

Where data is processed

Our server and account database are in the United States. Our service providers may process data in other countries too. If you use Gods Eyes from outside the United States, your information will be handled in those places.

Changes to this policy

We may update this policy, and we will post the new version here with a new effective date. If we want to use your information in a materially different way, we will tell you first.

Contact

Email: support@godseyes.io.