Privacy Policy

Last updated: 2 October 2026

In short: this site keeps as little as it can. No advertising, no analytics, no trackers, nothing sold. If you only look at the public pages, all that is kept is the short technical record every web server keeps. There is one cookie, and only when you sign in.

Who is responsible

Ice Halo Tracker, an independent project run by Runnan Lin in Vancouver, Canada. Contact: china.skywonders@gmail.com.

1. Looking at the public pages

• No account and no cookies. Like any web server, the server notes each request: the IP address, the time, the page or file asked for and the browser's description of itself. This is used only to keep the site working and safe, and it is deleted automatically after at most 30 days.
• Your browser's local storage keeps a few of your choices (light or dark, which reference rings are shown, the forecast range). They stay on your device and are never sent to the server.

2. If you have an account

• What you give: your name, username, email address and, if you write one, a note about yourself. Your password is kept only as a salted hash, which nobody can read back.
• Settings: your role, theme, which emails you want, and when you accepted the terms.
• Signing in: a session for each device you sign in on, with its IP address and browser description, deleted when you sign out or 14 days after your last visit. Failed sign-in attempts are kept one hour, against password guessing. Sign-ins and sign-outs appear in the activity log; their IP addresses are removed from it after 90 days.
• Asking for an account: the form's contents until the owner decides, and 180 days after. The address the form came from is kept only as a one-way hash, to stop abuse.
• What you do on the site: your messages, halo alerts, halo marks and reviews, and for operators every camera command with its time and result. The people signed in see your name next to what you post. The record of operator actions is part of the instrument's scientific log and is kept as long as the project runs.
• Emails: for each email the site sends, the time, its kind and its subject (not its text), kept 180 days.

3. What it is used for

To run your account and the site, to keep them safe and stop abuse, to send the emails you asked for (and the ones your account needs, such as codes and the owner's answers), and for the project's research records. Nothing else: no profiling, no advertising, no selling.

4. Who else handles data

• OVHcloud hosts the site on servers in Canada.
• Google (Gmail) delivers the site's emails, so it handles the address and content of each email sent.
• YouTube (Google) hosts the timelapse videos, which show only the sky.
• Cloudflare answers DNS queries for the domain name; it does not see the site's traffic.
• GitHub keeps a private copy of the site's program code, which contains no personal data.

Some of these companies may handle data outside Canada. Personal data is not shared with anyone else unless the law requires it.

5. Cookies and local storage

The site sets a single cookie, iht_session, and only when you sign in. It is strictly necessary: it keeps you signed in. It is sent only to this site, cannot be read by scripts, and ends when you sign out or 14 days after your last visit. Because there are no other cookies (no analytics, advertising or third-party cookies), the site does not ask for cookie consent. Local storage also remembers, on your device, which announcements you have hidden, which messages you have read and the speed you chose for the timelapse player.

6. How long

Account data stays while your account exists. If you ask us to delete your account, your personal data is deleted or anonymised within 30 days; what you posted in the shared records (messages, halo marks, the operator log) then shows as from a former member. Everything else is kept for the times given above.

7. Your rights

You can see and change most of your data on your Me page, and switch any email off there. You can ask for a copy of your personal data, for a correction or for its deletion by writing to the address above. If you are not satisfied with the answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or the data-protection authority where you live.

8. Security

Passwords are hashed, every connection is encrypted (HTTPS), sign-in is protected against guessing, and access to the servers and the camera is restricted to keys held by the owner. No system is perfectly safe; if something goes wrong that affects your data, you will be told.

9. Children

Accounts are for people aged 16 or more. The site does not knowingly keep data about younger children.

10. Changes

If this policy changes, the date at the top changes, and important changes are announced on the site.

This policy describes how the site actually works. It is written in plain language and is not legal advice.