Composite Sky Privacy

What we collect

Nothing. No accounts, no sign-in, no profiles. No analytics and no telemetry. No advertising identifiers and no ad networks. No third-party SDKs or packages — the app has zero dependencies. There is no server of ours for any of that to go to.

The app adds no crash reporting of its own. Whatever tvOS itself sends is governed by the analytics setting in tvOS Settings, which you control there, not here.

Where your data goes

You type a location. Apple's geocoder turns it into coordinates. Those coordinates then travel as query parameters to the weather services below, because that is how a forecast works — a forecast for a place requires sending the place. So your location does leave the device. It goes to the providers listed here, and nowhere else.

These are requests the app makes on your behalf to answer the question you asked it. Seven services, and that is the entire list:

• Apple WeatherKit Current conditions, the forecast and the almanac. See Apple's Privacy Policy.
• api.weather.gov — National Weather Service Watches, warnings and advisories. The request carries a descriptive user agent identifying the app. See the NWS privacy policy.
• mapservices.weather.noaa.gov — NOAA Radar imagery. See NOAA's privacy policy.
• tidesandcurrents.noaa.gov — NOAA CO-OPS Tide predictions for the nearest station, or the one you pick. See NOAA's privacy policy.
• data.rcc-acis.org — NOAA Regional Climate Centers Daily record high and low temperatures. See NOAA's privacy policy.
• swd.weatherflow.com and ws.weatherflow.com Readings from your own WeatherFlow Tempest station — only if you connect one. If you do not, the app never contacts WeatherFlow. See the WeatherFlow-Tempest privacy policy.
• Apple Music — MusicKit Playback from your own library — only if you pick a playlist. If you use a stream URL instead, or no music at all, the app never contacts Apple Music. See Apple's Apple Music privacy notice.

What those providers do with a request is covered by their own policies, linked above. None of it passes through us.

What stays on your device

Your location is stored on the device, in the app's own preferences. So is every setting — units, voice, station override, stream URL. Weather, tide and climate data are cached on the device too, so the loop keeps running when the network drops.

If you connect a Tempest station, the API token is yours: you enter it, it lives in the system Keychain, and it is sent to WeatherFlow and to no one else. We never receive it.

Music and audio

Music comes from your own Apple Music library through MusicKit, or from a stream URL you type in yourself. The app ships no URLs of its own. Nothing about what you play is recorded, transmitted or shared.

Children

Composite Sky is rated 4+. It collects nothing from anyone, at any age. There are no accounts, no user content and no advertising. Because no personal information is collected from anyone, no COPPA obligations arise.

Data retention

We retain nothing, because we receive nothing. The caches and settings on your device belong to the app and are removed when you delete it.

Changes to this policy

If the app's behavior changes — a new data source, say — this page changes with it, and so does the date below. The current version is always the one here.

Contact

Questions about any of this go to hello@penpoint.dev.

Last updated: August 3, 2026

Back to Composite Sky →