What We Collect
Nothing. No accounts, no sign-in, no profiles. No analytics and no telemetry. No advertising identifiers and no ad networks. No third-party SDKs or packages — the app has zero dependencies. There is no server of ours for any of that to go to.
The app adds no crash reporting of its own. Whatever tvOS itself sends is governed by the analytics setting in tvOS Settings, which you control there, not here.
Where Your Data Goes
You type a location. Apple's geocoder turns it into coordinates. Those coordinates then travel as query parameters to the weather services below, because that is how a forecast works — a forecast for a place requires sending the place. So your location does leave the device. It goes to the providers listed here, and nowhere else.
Which country's services answer depends on the location you set, not on your Apple TV's language: a US location reaches the US services, a Canadian one the Canadian services, a Japanese one the Japanese services, and none of them reaches another country's. These are requests the app makes on your behalf to answer the question you asked it. Thirteen services, and that is the entire list:
- Apple WeatherKit Current conditions, the forecast and the almanac. See Apple's Privacy Policy.
- Apple MapKit Turning what you type into coordinates, one reverse lookup to learn which country you are in, and the street map drawn under the radar. See Apple's Privacy Policy.
- api.weather.gov — National Weather Service US watches, warnings and advisories, and the reporting station's observations. The request carries a descriptive user agent identifying the app. See the NWS privacy policy.
- mapservices.weather.noaa.gov and opengeo.ncep.noaa.gov — NOAA US radar imagery: the national mosaic and the single-site close-up view. See NOAA's privacy policy.
- tidesandcurrents.noaa.gov — NOAA CO-OPS US tide predictions for the nearest gauge, or the one you pick. See NOAA's privacy policy.
- data.rcc-acis.org — NOAA Regional Climate Centers US daily record high and low temperatures. See NOAA's privacy policy.
- api.weather.gc.ca — Environment and Climate Change Canada Canadian watches and warnings, and Canadian long-term temperature records. See the Government of Canada privacy notice.
- geo.weather.gc.ca — MSC GeoMet Canadian radar imagery. See the Government of Canada privacy notice.
- api-iwls.dfo-mpo.gc.ca — Canadian Hydrographic Service Canadian tide predictions. This one never receives your coordinates: the gauge roster is fetched whole and the nearest one is worked out on the device, so the request carries only a gauge ID. See the Government of Canada privacy notice.
- www.jma.go.jp — Japan Meteorological Agency Japanese warnings and advisories, and Japanese radar imagery from the high-resolution precipitation nowcast tiles. This one never receives your coordinates either: the warning-area index is fetched once and the matching area worked out on the device, and every radar tile number is computed on the device from a fixed grid, so a request carries only an area code or a tile number. Source: Japan Meteorological Agency website. See JMA's legal notice and terms of use.
- www.data.jma.go.jp — Japan Meteorological Agency tide tables Japanese tide predictions. This one never receives your coordinates either: the station roster ships inside the app and the nearest one is worked out on the device, so the request carries only a two-letter station code. Source: Japan Meteorological Agency website. See JMA's legal notice and terms of use.
- swd.weatherflow.com and ws.weatherflow.com Readings from your own WeatherFlow Tempest station — only if you connect one. If you do not, the app never contacts WeatherFlow. See the WeatherFlow-Tempest privacy policy.
- Apple Music — MusicKit Playback from your own library — only if you pick a playlist. If you use a stream URL instead, or no music at all, the app never contacts Apple Music. See Apple's Apple Music privacy notice.
What those providers do with a request is covered by their own policies, linked above. None of it passes through us.
What Stays on Your Device
Your location is stored on the device, in the app's own preferences. So is every setting — units, voice, station override, stream URL. Weather, tide and climate data are cached on the device too, so the loop keeps running when the network drops.
If you connect a Tempest station, the API token is yours: you enter it, it lives in the system Keychain, and it is sent to WeatherFlow and to no one else. We never receive it.
Music and Audio
Music comes from your own Apple Music library through MusicKit, or from a stream URL you type in yourself. The app ships no URLs of its own. Nothing about what you play is recorded, transmitted or shared.
Children
Composite Sky is rated 4+. It collects nothing from anyone, at any age. There are no accounts, no user content and no advertising. Because no personal information is collected from anyone, no COPPA obligations arise.
Data Retention
We retain nothing, because we receive nothing. The caches and settings on your device belong to the app and are removed when you delete it.
Changes to This Policy
If the app's behavior changes — a new data source, say — this page changes with it, and so does the date below. The current version is always the one here.
Contact
Questions about any of this go to hello@penpoint.dev.
This site sets one cookie, and only if you pick a language from the header: it stores that choice so the site does not guess again. It holds nothing else and is sent nowhere else.
Last updated: August 18, 2026