Effective 29 October 2026
No ads. No tracking. No analytics of our own.
Pointing at the sky or your car keeps your location on your phone (if you pick the Map background, its map provider sees which area the map shows). Your location reaches our server only in friend mode, only during a session you said yes to, and every fix is deleted within 20 minutes. We do not sell or share your personal information.
| When | What is sent | To |
|---|---|---|
| The app is open where friend mode is offered, or you open Friends where it is not | A read of the list of places where friend mode is not offered. Where it is offered: when the app opens or you come back to it, every 5 minutes while it is open, when you open Friends, and before each location fix in a session. Where it is not: only when you open Friends. No account, no location. | Supabase |
| You pick the space station | A download of its public orbit. Nothing about you. | CelesTrak |
| You pick the Map background, on the parked-car page or in a friend session | Requests for the map of the area around you and the car or friend, with your IP address. No account, no name, no exact position. | Apple (iPhone) or OpenFreeMap (Android) |
| The app lists coming sky events | A download of our public list of events no phone can calculate, such as meteor showers. Nothing about you. | Our web server (Vercel) |
| The Events list names your town, or a reminder or alert names the place it was set for | A download of the public city-list file for the map square around you, about 200 km across, and its neighbours when no town is close. Your exact location is not sent; which squares were fetched is. | Our web server (Vercel) |
| You search for a city in Events | A download of the public city-list file for its first letters (two, or more for a common start). What you typed stays on your phone. | Our web server (Vercel) |
| You send feedback from About | Your message and a random install id | Our web server (Vercel), then Resend |
| You apply for friend mode from About | The email address you type and a random install id | Our web server (Vercel), then Resend |
| You are signed in and the app is open, while friend mode is invite-only | A check, with your sign-in, of whether your account's email address is approved, when the app opens and each time you open Friends. No location. | Supabase |
| You answer the interest question (where friend mode is not offered) | One added to a worldwide count. No account, no country. | Supabase |
| You confirm Delete my account where friend mode is not offered (an account made elsewhere, still on your phone) | A refresh of your sign-in, then the request to delete the account; then the requests to Google or Apple to remove Pointer's access. Nothing is sent before you confirm. | Supabase, Google or Apple; Vercel for Sign in with Apple |
| You sign in (friend mode only) | The identity you sign in with | Supabase, and Apple, Google or Resend; Vercel for Sign in with Apple |
| You are signed in and the app is open | Your name, friend list, nicknames and invites as you use them, and a live connection for friend-list changes and incoming requests. No location. | Supabase |
| From the moment you tap Point, or Point back, until the session ends | A location fix every few seconds | Supabase, readable only by the friend in that session |
| You are signed in and notifications are allowed (friend mode only) | Your phone's push token, so a friend's Point reaches you while Pointer is closed. No location. | Expo (which exchanges your phone's Apple or Google push token for a Pointer push token), then Supabase |
| A friend taps Point at you, and your phone has a push token | The sentence "<their name> is pointing at you", from our server to your phone. No location, no session or account id. | Expo, then Apple or Google |
Every request also reveals your device's IP address to the service that receives it.
Pointer points your phone at things: the Moon, the Sun, the planets, the space station, your parked car, and a friend who is pointing back. Pointing at the sky and at your car happens on your device, and your location stays there (if you pick the Map background, its map provider sees the area shown; see Map). Pointing at a friend needs a server, because two phones have to reach each other, and it needs you to sign in. This policy explains what leaves your phone, who receives it, why, and how long it is kept. It covers the Pointer app for iPhone and Android and the Pointer web pages at pointer.hochly.com.
Friend mode is not available in the EU, EEA, UK, Gibraltar, Jersey, Guernsey or the Isle of Man. In those places Pointer works in sky mode only, with no account and no sign-in. A few things described below work the same everywhere: the space station download, the web pages, feedback you choose to send from the About page, and, where the app shows it, the count of people who would use friend mode in their country. One small read happens there too, but only when you open Friends: the app fetches from our database the list of places where friend mode is not offered. That request carries no account and no location. Where your phone's Region setting or its location shows friend mode is not offered, the app does not make this read when it opens, when you come back to it, or while it is open.
Pointer is made by Omer Hochman, an individual developer. There is no company behind it. He is the controller of the personal data described here, and "we" in this policy means him.
Omer HochmanUsing the sky or your parked car never asks you to sign in. If you have signed in for friend mode, the app keeps that sign-in fresh with our account service while it is open, and listens for changes to your friend list and for a friend starting to point at you, so an invite, a friend's request, or a Point can reach you on any screen. Those connections carry no location. If you have not signed in, the app makes no account and sends nothing for friend mode.
This section and the next apply only where friend mode is available, which excludes the EU, EEA, UK, Gibraltar, Jersey, Guernsey and the Isle of Man.
Friend mode asks you to sign in. Nothing else in Pointer does. You can sign in with Apple (on iPhone), with Google, or with a one-time code we email to you. Signing in creates a Pointer account, identified by a random account id, and our account service keeps the identity you signed in with:
We never ask for a password or a phone number, and we never read your contacts. Your friends never see your email address or the account you signed in with: they see only the name you show them. When your phone signs in or refreshes its sign-in, the account service records its IP address and user agent in its security logs, and keeps the latest ones with that phone's sign-in until it signs out. Signing out ends the sign-in on that phone only.
Pointer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to sign you in, and never for advertising. No person reads the data we receive from Google, except with your permission, where needed for security, or where the law requires it.
You do not have to give us any of this. Sky mode and the parked car work without it, but friend mode cannot work without a sign-in, a name to invite with, and your location during a session.
There is no location history in Pointer. The data model cannot hold one, which is why there is no trail to look back at.
Where friend mode is not offered, the Friends screen may instead ask whether you would use it in your country. Opening that screen reads one worldwide count from our server. If you tap Yes, the app adds one to that count. Neither request carries an account, your country, or anything else about you, and our database keeps only the number, not who tapped. Like any request, each one reaches Supabase and its network edge, Cloudflare, with your phone's IP address, which their request logs keep for the time set out below. Your phone remembers that you answered, so it does not ask again; deleting the app forgets it.
If you write to us from the About page, the app sends what you typed, whether it is an idea or a problem, and a random install id to our web server at pointer.hochly.com. The install id is made by the app on your phone and is not your account id. Our server uses it only to limit how many messages one phone can send in a day, holds it only in memory for that, and does not put it in the email. Our server emails the message to the developer through Resend. No account, location, or name is attached, unless you type one in. Please do not include details you would rather we did not have. If you write to us by email instead, we receive your email address and what you send.
If you tap Report on a friend, your mail app opens a message to abuse@hochly.com with that friend's Pointer account id filled in. If you tap Report on a name under Nearby, our server records your account id, the account id behind that name and the time, and your mail app opens a message to abuse@hochly.com carrying only the number of that record, so the other person's account id never reaches your phone. Nothing is emailed until you send it. If you tap Block on a name under Nearby, our server records your account id, theirs and the time, so that phone no longer shows under Nearby for you and neither of you can add the other. No Pointer user can read these records, including the person you reported or blocked. We use reports only to look into misuse, and blocks only to keep a blocked phone away from you.
Friend mode is opening gradually. For now, only accounts whose email address we have approved can use it. If you apply from the About page, the app sends the email address you type, with the random install id described under Feedback, to our web server, which emails it to the developer through Resend under the subject "Pointer Friends application". We use it only to decide whether to let you in. Use the email address you sign in with: it is the one we check.
If we approve you, we add that address, in lower case, to an approval list in our database. No app can read or change that list. While you are signed in, our server checks whether your account's email address is on it when the app opens and each time you open Friends, and answers yes or no. A friend who is not approved yet cannot be pointed at. We keep the application email until we approve you or you ask us to delete it, at most 2 years, and the list entry until you delete your account, you ask us, or friend mode opens to everyone. If you sign in and are not approved, your account holds only your sign-in identity, and Delete my account removes it.
On the parked-car page and in a friend session you can pick a street map as the background. The map shows you and the car, or you and your friend, so the phone downloads the map of the area around both. The map provider receives those requests, which show that area and your IP address; no account id, name or exact position is sent. On iPhone the provider is Apple (Apple Maps); on Android it is OpenFreeMap. The map is never offered in sky mode, and nothing is downloaded for it until you pick it.
If you turn on the optional camera view, the live feed is drawn behind the arrow on your screen. When you tap Scan on the Friends add card, the camera reads a friend's invite QR code on your phone. Nothing is recorded, saved, or transmitted, and no photos or videos are created.
pointer.hochly.com is Pointer's store front: on a phone it opens the App Store or Google Play, elsewhere it shows both store badges and a QR code. It sets no cookies and stores nothing in your browser. The same domain serves this policy, the terms, the support page, the invite page a friend's link opens when the app is not installed, and the two server functions the app calls (feedback, and revoking Sign in with Apple when an account is deleted). Opening any of them sends a request to our web host, Vercel (see below). The invite page also asks our database, through Supabase, for the name of the friend who sent the link, sending the invite token; it learns that name and nothing else. Vercel uses the country it derives from your IP address to show the invite page only where friend mode is offered. On Android, the invite page's Google Play link carries the invite token, so the app can offer the invite when it first opens; Google receives that token with the link.
None of the web pages set cookies.
Friend mode is not offered there, so no account, name, friend list or location of yours reaches us. What can reach us is occasional and low risk: web page requests, the interest count, the read of where friend mode is offered when you open Friends, feedback or an application you choose to send, and, if you made an account elsewhere and delete it there, that deletion. For that reason we have not appointed a representative yet in the EU or the UK (Article 27(2) of the GDPR and of the UK GDPR). You can reach us directly at privacy@hochly.com. The Google code described under Security is part of the app in every region.
Pointer is run from Switzerland, and the Swiss Federal Act on Data Protection (FADP) is the law we follow. We rely on these grounds:
| Purpose | Legal basis |
|---|---|
| Running your friend-mode account: the sign-in identity, the account id, your name, your friend list, your nicknames, and invites | Contract: it is how we provide friend mode to you |
| Sharing your location with a friend during a session | Your consent, given for each session by tapping Point or Point back. You can withdraw it at any time, as easily as you gave it: end the session, or turn off location access for Pointer in your phone's settings. Withdrawing does not affect sharing that already happened. |
| Deciding who can use friend mode while it is invite-only: your application email and the approval list | Contract: steps you asked us to take before we provide friend mode to you |
| Reading and answering feedback you send, and counting interest in friend mode where it is not offered | Our legitimate interests: hearing from users and deciding where to offer friend mode |
| Removal records, blocks, misuse reports, preventing abuse, and security logs | Our overriding legitimate interests: keeping a removed friend removed, and keeping the service and its users safe |
We make no automated decisions about you and build no profile of you.
/i/<token>), and an approximate location it derives from your IP
address. Vercel handles these request logs as an independent controller under its own
privacy notice. On our plan, the
logs available to us are kept about 1 hour.Each service provider above receives only what it needs to provide its part of Pointer, and is bound by terms that protect your data at least as well as this policy describes.
We disclose data to authorities only when the law requires it.
Our database is in Ireland, in the EU, which Switzerland recognises as providing adequate data protection. Where Supabase or its subprocessors process data in Singapore, the USA, or another country without that recognition, the transfer relies on the EU Standard Contractual Clauses in Supabase's data processing addendum. Resend, a US company, processes the sign-in emails and feedback under its data processing addendum, which relies on the EU Standard Contractual Clauses, and Expo, a US company, relays push notifications as a participant in the Swiss-U.S. Data Privacy Framework. Vercel receives web requests directly from your browser or phone and describes the safeguards for its own transfers in its privacy notice.
| Data | Kept |
|---|---|
| Your account id, your sign-in identity (email address, Apple or Google account id, and what the provider shared), your name, your friend list, and your nicknames | Until you delete your account. A connection and its nicknames go sooner if either of you removes the other. |
| Your phone's push token | Until you sign out on that phone or delete your account, at most 90 days after that phone last opened Pointer signed in, and no longer once Apple or Google stop delivering to it |
| Push send records (your push token and the sentence) | About 1 hour in our database's log of outgoing requests, then deleted |
| Invites | At most 7 days (a Nearby invite 10 minutes), then removed within 5 minutes |
| Session records (two account ids, times, and whether it ended because you found each other; no location) | At most 1 hour, then removed within 5 minutes |
| Friend-list notices (an empty message to your phone that your friend list changed, with its time) | A few days, then deleted by our live-messaging service |
| Location fixes | Deleted within 20 minutes of being sent. Access ends the instant the session ends. |
| Removal records | Up to 7 days |
| The interest count | A single number, kept until friend mode is offered; it holds nothing about you |
| Feedback emails | Up to 2 years, then deleted, sooner if you ask |
| Misuse reports you email us | As long as needed to look into them, at most 2 years |
| Nearby report records (two account ids and the time) | 90 days, then removed within 5 minutes |
| Blocks (two account ids and the time) | Until either account is deleted |
| A friend-mode application email | Until we approve you, then deleted, or sooner if you ask, and at most 2 years |
| Your email address on the approval list | Until you delete your account, you ask us, or friend mode opens to everyone |
| Vercel request logs | About 1 hour in the logs available to us. Vercel's own retention is set out in its privacy notice. |
| Supabase sign-in and request logs (IP address, user agent) | 1 day, then deleted |
| The IP address and user agent of each phone's current sign-in | Until that phone signs out, or the account is deleted |
Every connection uses TLS encryption in transit. Every table in our database has row-level security, so the database refuses to show your data to the wrong account. The app contains no advertising SDK, no analytics of our own, no crash reporter, and no over-the-air update service. Some Google code in the app sends Google technical data for its own purposes: on Android, the QR scanner (Google ML Kit) sends device, app and performance data for diagnostics, and Firebase Cloud Messaging registers the phone with Google once you are signed in to friend mode and notifications are allowed; on iPhone, Google Sign-In sends Google its own usage data when you use it. No image from the camera leaves your phone. On Android, the app's data is excluded from cloud backup. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
Location fixes, sessions, and invites delete themselves on the schedule above. To delete everything else, open the Account page in the app and tap Delete my account. That ends any live session, then deletes your account, your sign-in identity, your name, your friend connections, your nicknames, your phones' push tokens, the blocks and Nearby report records that name you, and your email address on the friend-mode approval list at once, and asks Google or Apple to remove Pointer's access as described above. Notices already sent to your phone that your friend list changed hold only your account id and a time, and age out of our live-messaging service within a few days.
You can also email privacy@hochly.com, without the app, and we will delete them within 30 days. Delete my account works in every country, including where friend mode is not available. How to request deletion explains what to include and what is deleted. Deleting the app on its own does not delete the account on our server, but it stops all sharing: with no app, no location can be sent.
You have the right to:
To use any of these rights, email privacy@hochly.com. We answer within 30 days. We may ask you to write from the email address on the account, or for other details that show the account is yours, before acting.
You can complain to us first, or directly to the Swiss Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch, or to the data protection authority where you live.
Pointer is not directed at children under 13. To use friend mode you must be at least 13, or older where the law of your country sets a higher age for agreeing to the use of your data. Sky mode needs no account at any age. We do not knowingly collect data from children under 13. If you believe a child under 13 has given us data, tell us at privacy@hochly.com and we will delete it.
If this policy changes, the new version is posted at this URL with a new effective date. Before Pointer starts collecting something new, or using data in a new way, the app tells you.
Questions, requests, or something that looks wrong? Email privacy@hochly.com.