Privacy

GP Passes collects no data. Its App Store privacy label is Data Not Collected.^A-69^A-20 Nothing you do in the app is sent to the developer or to anyone else. The app has no account, no analytics, no advertising and no tracking.^A-20^A-29

Effective 22 October 2026. This page describes GP Passes 1.0. This policy previously lived at neogy.dev/gp-passes/privacy.^A-86

What stays on your iPhone

These are kept on your iPhone and are never sent anywhere by the app^A-22^A-23^A-30^A-54^A-62:

Your location. The app asks for it only while you're using the app ("when in use"), takes one reading to about 100 metres, and uses it to work out passes. You can also type it in or give a grid square.^A-21^A-22^A-43
The places you've named, your horizon masks, your starred satellites, your saved frequencies and your settings. ^A-86
The element-set files you download or import.^A-12b
Your reminders and alerts. They are local notifications, set on your iPhone.^A-30^A-32
Your answers in the app, such as the guided watch's "Did you see it?". That answer is kept nowhere.^A-54

Deleting the app deletes all of it. Like any app's data, it's included in your iPhone's backups to iCloud or to a computer, if you make them, and stays in a backup until that backup is deleted.^A-86

The widget reads your location and starred satellites from storage shared with the app on your iPhone, and works out its passes there.^A-23^A-38

The permission prompt says it plainly: "Your location is used on this device to work out when satellites pass over you. This app does not send it anywhere."^A-22

The one request the app makes

GP Passes uses the network for one thing: to download element sets (satellites' orbits) from CelesTrak, a free service.^A-10^A-26

It happens only when you tap Download. Nothing in the background, no automatic updates, no push notifications. ^A-10^A-26
At most once every two hours, whether or not the last request was answered.^A-25
It asks for one fixed list, the amateur radio satellites. The address is the same for everyone.^A-10
It carries no location, no account, no device ID, no cookie and not your phone's language.^A-27

This is the request, exactly as the app makes it^A-27:

GET https://celestrak.org/NORAD/elements/gp.php?GROUP=amateur&FORMAT=CSV
User-Agent: GPPasses/<app version> (+https://github.com/hneogy/GPKit; honorius@neogy.dev; one group, on the user's tap, at most once in two hours)
Accept: */*
Accept-Language: en

iOS adds its usual transport headers, such as Accept-Encoding.^A-27 Like every request on the internet, it shows CelesTrak the IP address it comes from.^X-02 The User-Agent names the app, its version and the developer's contact address. It says nothing about you.^A-27

Apple's services the app uses

The Map tab is Apple's map. Apple supplies the map for whatever area is on screen, under Apple's privacy policy. The map marks where you are, so the area on screen is often the part of the world around you.^A-28^A-86
Notifications, the widget and Live Activities are handled by iOS on your iPhone. There is no push server: nothing outside your phone sends them.^A-30^A-36
Crash reports, if you've chosen to share them. If you've turned on Share With App Developers in your iPhone's Settings (Privacy & Security, Analytics & Improvements), Apple may pass crash reports from this app to the developer. That's Apple's setting and Apple's service: the app itself sends nothing.^A-86
Sharing a pass hands plain text to the share sheet. Where it goes is your choice, and the text holds no place. ^A-62

What the app doesn't have

No analytics, no crash-reporting service, no advertising, no tracking, and no third-party code. GPKit, the open-source orbit library, is the only package the app is built with, and it makes no network request of its own.^A-29^K-03

The app's privacy manifest declares no tracking, no tracking domains and no collected data types, for the app and its widget alike.^A-20

Go deeper: how this is checked

A tripwire in the build. A script fails the build if network code appears anywhere but the one file allowed to use it, if anything is set to fetch in the background or to receive push notifications, or if an internet address outside a short fixed list is written into the app. In its own words, it is "a search for names, not a proof": it catches honest mistakes.^A-26
A test of the request itself. A test sends the download to a server on the test machine and checks the headers it actually carries.^A-27
One request, thrown away. Each download uses a fresh, private network session, with no cache, no cookies, no waiting for a connection, no retry and no redirects followed. The session is discarded afterwards.^A-27
A test of the privacy manifest checks that it declares no collected data.^A-20

Children

The app collects no data from anyone, children included.^A-86

This website

gppasses.com has no cookies, no analytics, no advertising and no third-party requests. Fonts and everything else are served from this site.^A-87 The site is hosted by Cloudflare, which, like any web host, sees each visitor's IP address.^X-03

Changes and contact

If this changes, this page will say so, with a new date, before an app that works differently is released.^A-86 Questions: honorius@neogy.dev.^A-67

Sources

A-69 The App Store privacy label, as submitted, is Data Not Collected. Source: the owner's statement (R-3, 2026-10-31); App Store Connect not seen by a session.
A-20 The privacy manifest declares no tracking, no tracking domains and no collected data types, plus UserDefaults access (reason CA92.1). The same applies to the app and the widget. Source: Passes: Passes/PrivacyInfo.xcprivacy:5-21; PassesWidgets/PrivacyInfo.xcprivacy:5-21; test PrivacyManifestTests.swift:16-34.
A-29 No analytics, no crash or tracking SDKs. GPKit is the only package dependency. Source: Passes: Modules/Package.resolved; docs/audit-2026-10/VALIDATION.md:3-4.
A-86 The app's privacy policy (neogy.dev/gp-passes/privacy, "Last updated: October 22, 2026"): no data collected; location and everything else put in the app (files, named places and horizon masks, stars, frequencies, settings) kept on the phone; deleting the app deletes it; it is in the phone's iCloud or computer backups if made, until the backup is deleted; one request to CelesTrak on the tap; Apple's map supplies the area on screen, which marks where you are; crash reports reach the developer only through Apple's Share With App Developers setting; no data from anyone, children included; a change is said on the page, with a new date, before an app that works differently is released. Source: HN-Resume (neogy.dev) gp-passes/privacy.html at 4985038, the page the app and its App Store listing link to (R-1, Q-A1); read from the repo, no request.
A-22 The location permission text reads: "Your location is used on this device to work out when satellites pass over you. This app does not send it anywhere.". Source: Passes: project.pbxproj:454.
A-23 Location is stored on the device (UserDefaults and the app group, so the widget can use it). Source: Passes: ObserverLocation.swift:4,205-217; Shared.swift:78.
A-30 Reminders are local notifications. The pass screen says under the button: "A notification from this device at the time chosen. Nothing is sent anywhere.". Source: Passes: ReminderCenter.swift:20,42,78-84; PassDetailView.swift:920.
A-54 The "Did you see it?" answer is kept nowhere. Source: Passes: GuidedWatchView.swift:22.
A-62 Share this pass: plain text to the share sheet. One line each for the day, rise, highest point, set and light; an old-data warning; the time zone. No coordinates, grid square or place name; the app sends nothing itself. Source: Passes: PassesCore/PassShare.swift:3-47; PassDetailView.swift:61-66,136-141.
A-21 Location is asked "when in use" only, at about 100 m accuracy, as one reading. Source: Passes: LocationProvider.swift:61,77,85,104.
A-43 Maidenhead grid square entry, with 4, 6 or 8 characters. Source: Passes: LocationView.swift:162-176.
A-12b An imported file is copied into the app's own folder and read again each time the app starts. Source: Passes: PassesCore/Library.swift:39-42.
A-32 Alerts can be set for every pass of a starred satellite, up to 10 days ahead, within iOS's 64 pending notifications. "Only during my hours" is optional and off by default. Source: Passes: PassAlerts.swift:4-17; AppModel.swift:82-89.
A-38 The widget computes passes itself from app-group data, fetches nothing, and looks 2 days ahead for up to 25 starred satellites. Source: Passes: NextPassWidget.swift:17-18; Shared.swift:91,205.
A-10 The app downloads https://celestrak.org/NORAD/elements/gp.php?GROUP=amateur&FORMAT=CSV, and only when you tap Download. Source: Passes: PassesCore/Download.swift:34; PassesUI/AppModel.swift:438-440 ("Nothing else in the app calls this"); callers SatelliteListView.swift:185-187.
A-26 Nothing runs in the background: a build check fails on background-task, remote-notification or background-mode code, and on download callers outside the list screen. Source: Passes: tools/check-network.sh:36-39,66-71; the script calls itself "a search for names, not a proof" (:10-11).
A-25 At most one request every two hours. The attempt is counted before it is sent, and there are no retries. Source: Passes: Download.swift:146-161; DataSource.swift:98.
A-27 The request is a GET with User-Agent GPPasses/<version> (+https://github.com/hneogy/GPKit; honorius@neogy.dev; one group, on the user's tap, at most once in two hours), Accept: */*, Accept-Language: en and no cookies. It sends no location, account or device ID. A test checks the request on the wire. Source: Passes: Download.swift:50-64; NetworkTransport.swift:11-47 (ephemeral session, no redirects); Tests/PassesUITests/RequestOnTheWireTests.swift.
X-02 Like every internet request, the download shows CelesTrak the IP address it comes from. Source: general fact of how IP works; kept on the owner's ruling (R-4).
A-28 The Map tab is Apple's map, which Apple supplies for whatever area is on screen. Source: Passes: SettingsScreen.swift:142.
A-36 There is no push server for Live Activities. Source: Passes: LiveActivityCenter.swift:12-17.
K-03 GPKit makes no network request of its own. Source: GPKit: README.md:14-15.
A-87 gppasses.com sets no cookies and has no analytics, no advertising and no third-party requests; fonts and everything else are served from the site, under a content policy that allows its own address only. Source: gp-site build.py (HEADERS: default-src 'none', each kind 'self'); shared/static/fonts/; checks.py (check 5 lists every external link; no external resource); the live check before launch.
X-03 Site A is hosted by Cloudflare, which, like any web host, sees each visitor's IP address. Source: hosting: stack.md (R-1, Cloudflare Pages); the IP part is how any web request works; wording ruled (R-7).
A-67 Support address: honorius@neogy.dev, as shown on neogy.dev/gp-passes/support (through Cloudflare's email protection) and in the app's User-Agent. Source: live page, one GET 2026-10-31 (R-4); Passes DataSource.swift:109.