Orbital Atlas Privacy Policy

Orbital Atlas Privacy Policy

Last updated: October 4, 2026

1. Privacy Policy

Orbital Atlas is a Meta Quest application for exploring planets, moons and planetary imagery. It streams imagery and terrain from our backend infrastructure. This policy explains how information is processed when you use the app and its content services.

The developer and operator, Finn Stefansen, Denmark, is responsible for deciding how personal information is used for these services. In data-protection terms, we are the data controller. In this policy, “we”, “us” and “our” refer to that business.

2. Information We Process

When ownership or entitlement verification is required, we process:

Your app-scoped Meta User ID and Meta proof or verification information.
Network and request information, such as IP address, request timestamps and basic request metadata, which may be processed when you connect to the service.
Verification results identifying the app or content you are entitled to access.
Temporary access information, including a randomly generated session identifier, content permissions and an expiry time.
Requests needed to deliver imagery and terrain, and limited operational or security log information needed to run and protect the service.

The system is designed to minimize personal information. Orbital Atlas does not operate a separate username-and-password account system.

3. How We Use Information

We use information as necessary to:

Verify that you are a valid Meta user and have access to the app or its content.
Check ownership of purchased or unlocked content.
Issue temporary access capabilities and deliver requested imagery and terrain.
Prevent unauthorized access or abuse, troubleshoot problems, and operate and secure the service.
Meet applicable legal obligations.

Where European data-protection law applies, processing necessary to provide the service you request is based on performing our contract with you. Security and abuse prevention are based on our legitimate interests in operating a secure, functioning service. Processing required by law is based on the relevant legal obligation.

Orbital Atlas does not intentionally use advertising, behavioral advertising, third-party analytics, marketing trackers, social tracking or user profiling.

4. Meta Account and Entitlement Verification

The Quest app sends your Meta User ID and proof or verification data to our Go backend. The backend checks the information and your app or content entitlement with Meta before authorizing protected downloads.

Our backend processes Meta identity information only as necessary for authentication, entitlement verification, security and service operation, including delivery of purchased or unlocked content. Meta also processes information through its platform and verification services under its own privacy policies.

5. Tile Streaming and Temporary Access Tokens

After successful verification, our backend creates a signed, short-lived capability that permits access to particular imagery or terrain datasets. It contains a randomly generated session identifier, content permissions and an expiration time.

The tile capability does not contain your raw Meta User ID or Meta proof nonce. A Cloudflare Worker checks the capability and serves only the content it permits. The Worker serving tiles does not receive the raw Meta User ID.

The random identifier helps manage temporary access and prevent abuse. It is not a traditional app account, and we do not describe it as completely anonymous. When a capability expires, further protected downloads require valid authorization.

6. Service Providers

We use Cloudflare as an infrastructure service provider and data processor for HTTPS proxying, content delivery, Workers and R2 object storage.

Infrastructure providers such as Cloudflare may process network and request information, including your IP address, request timestamps and basic request metadata, as necessary to deliver and secure the service.

Cloudflare proxies requests to our Go API. It may therefore process authentication requests containing your Meta User ID and verification data, even though the tile-serving Worker does not receive the raw ID. Cloudflare operates a global network; its processing is not limited to Denmark or the European Economic Area.

See Cloudflare’s privacy information and data-processing terms for information about its processing and international-transfer safeguards.

Meta provides the Quest platform and identity, ownership and purchase-verification mechanisms. See Meta’s privacy information for Quest for its own data practices.

7. Data Retention

Meta identity and verification information is retained only for as long as reasonably necessary for authentication, entitlement verification, security, legal obligations or service operation. Temporary access capabilities expire automatically.

Operational and security logs may be retained for a limited period as necessary for security, abuse prevention, troubleshooting or legal obligations. Retention depends on the information and why it is needed. Provider retention also depends on the applicable service terms, settings and privacy information.

We do not sell personal information. Information may be processed by service providers as necessary to operate and secure the service, and exchanged with Meta for identity and entitlement verification.

Information may also be disclosed where legally required. Our handling of public-authority requests is described below.

9. Security

We use HTTPS, signed access capabilities and checks on content permissions to protect access to the service. Short-lived capabilities limit the duration and scope of access. These measures reduce risk, but no online service can guarantee absolute security.

10. Your Privacy Rights

You can contact us about access to, correction or deletion of your personal information, restriction of processing, objections, and other applicable data-protection rights, including portability where it applies.

To request access to or deletion of your personal information, email [email protected] and state that your request concerns Orbital Atlas.

If you are in the European Economic Area, you may have these rights under applicable European data-protection law. The rights available depend on the circumstances and the legal basis for processing. We may need limited information to verify a request and respond appropriately.

For information Meta processes under its own responsibility, its privacy tools or contact channels may be relevant. You may also complain to your data-protection authority; in Denmark this is Datatilsynet.

11. Requests From Public Authorities

Requests from public authorities for user data will be reviewed for legal validity, challenged where appropriate and legally permitted, limited to the minimum information legally required, and documented.

12. Children’s Privacy

Orbital Atlas is not designed to intentionally collect additional personal information from children beyond information required by the platform and service operation. Meta’s account and platform requirements apply. Contact us if you have a concern about a child’s information.

13. Changes to This Policy

We may update this policy when the app, its services or relevant requirements change. The revised policy and its updated date will be posted on this page.

14. Contact

Finn Stefansen
Denmark

Contact email: [email protected]
Website: https://valis.dk/