Privacy policy

1. Who we are

Heliocodex, at heliocodex.com, is run by FALLINGHIPPO LIMITED, which trades as FallingHippo. In this policy “we”, “us” and “our” mean that company. We decide why and how the personal data described here is used, which makes us its “controller” under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We haven’t appointed a data protection officer. The law only requires one for public bodies and for organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data, and we do neither. Privacy questions sent to the address above are read and answered by a person.

2. What this policy covers

This policy covers personal data we handle when you:

• visit heliocodex.com or any page on it, including the 3D view, the sky map and the star pages;
• email us, or write to us by post, for example to report a mistake or ask about a licence.

It doesn’t cover other websites that we link to, such as NASA, the Solar System Scope or the scientific papers we cite. They are run by other people and have their own policies. Our other websites and apps, such as fallinghippo.com, have their own privacy policies as well.

3. A few terms we use

• Personal data means any information about you from which you can be identified, directly or indirectly. Your name, email address and IP address are all personal data.
• Controller means the organisation that decides why and how personal data is used. For this policy that’s us.
• Processor means a company that handles personal data on a controller’s behalf and only on its instructions, such as our web host.
• Processing means anything done with personal data, including collecting, storing, reading, sharing and deleting it.

4. What we collect and where it comes from

When you visit the site

You don’t have to sign up or give us anything to use Heliocodex. When your browser asks for a page, an image or one of our data files, our web host, Cloudflare, automatically receives and logs some technical information, as any web server does. This usually includes:

• your IP address, which can show your approximate location (country or town, never your street);
• the date and time of the request and the page or file requested;
• your browser type and version, operating system and device type, as your browser reports them;
• the address of the page that linked you here, if your browser shares it;
• security information, such as whether a request looks like it comes from an automated attack.

This comes from your device. We don’t combine it with anything else to work out who you are. We don’t download, copy or keep these logs ourselves, and we don’t use them to follow what individual visitors do.

If your browser reports a network problem

Cloudflare asks some browsers to send it a short report when a page fails to load because of a network fault. The report contains the address of the page, your IP address, your browser type and what went wrong. It is sent by your browser, not by any script of ours, only when something has failed, and only by browsers that support the feature. It lets Cloudflare find and fix faults on its network. You can’t see these reports from our side and we don’t use them.

Counting visits

So that we can see which pages people read and whether the site loads quickly, we use Cloudflare Web Analytics. When a page loads, a small script from Cloudflare (served from static.cloudflareinsights.com) reads timing measurements from your browser and sends Cloudflare a short report. The report says which page was loaded, how long it took, and, from your browser and connection, roughly where in the world you are (the country), what kind of device and browser you use and which page sent you here. Cloudflare says the script does not set cookies or use your browser’s storage, that the report doesn’t carry your IP address into its records, and that it doesn’t track individual visitors across the sites of its customers. We get the totals in a dashboard. We cannot see who any visit was.

We don’t use these figures for adverts, to build a profile of anyone or to work out who you are. If you would rather not be counted, you don’t have to do anything if your browser sends a Do Not Track or Global Privacy Control signal, because the script is not loaded at all. Otherwise, use the switch on the cookies and storage page, which stops the script loading in that browser. The site works the same either way.

Videos from YouTube

Some lessons carry a video that is hosted on YouTube, which is run by Google. A video loads only when you press its Play button. Until then your browser makes no request to YouTube or Google: the still picture on the poster is kept on our own server, and a line beside the button says what pressing play does. When you press play, your browser loads YouTube’s player from youtube-nocookie.com, which is YouTube’s privacy-enhanced mode. Google then receives your IP address and details of your browser and device, and it may store or read information on your device to run the player. Google says that in this mode, views of embedded videos are not used to personalise your YouTube experience or the adverts it shows you outside the embed.

For what happens at that point Google is its own controller, under Google’s privacy policy, not ours. We receive nothing from it and we cannot see who has played a video. Pressing play is how you consent, and if you don’t want that, don’t press play. Every video carries its credit and licence beside it (see licences and credits).

The sky map, the star pages and “Use where I am”

The sky map at /sky works out which stars, planets and constellations are above you from a place and a time. To do that it needs a place, and you can give it one in four ways:

• By doing nothing. The page makes a first guess at a city from the time zone your device is set to. That guess is made inside your browser. It is not sent anywhere, and nothing is stored for it.
• By choosing a city from the list.
• By typing a latitude and longitude.
• By tapping Use where I am. Your browser then asks whether it may share your position with this site. If you say yes, your device gives your position to the page and the page uses it to draw your sky. If you say no, nothing happens and you can choose a city instead.

In every case the position is used inside your browser. We don’t receive it, we can’t see it and it is not added to any server log, because the star data the page needs is the same for everyone and is downloaded as ordinary files.

When you choose a place yourself, the page remembers it in your browser’s local storage, so that the star pages and the birthday-star finder can use it too and so that the sky map is ready next time. What is kept is the name of the place and its latitude and longitude. If you used your device’s position, we round it to about 11 km before keeping it, which is more than precise enough for the sky. It stays on your device until you tap Forget my place on the sky map, clear this site’s data in your browser, or your browser clears it. It is never sent to us. Our cookies and storage page has the details and the legal basis.

If you type your age into the birthday-star finder on the stars page, it is used by the page to pick a star and is thrown away. It isn’t sent anywhere and it isn’t kept.

Because we never receive this information, it isn’t personal data that we hold, and this policy mostly describes it so that you can see exactly what happens.

When you email or write to us

We receive your email address, your name if your email shows it, the content of your message, any attachments, and the technical details that come with any email, such as the time it was sent. If you write by post, we receive your name and address and what you write. We only get what you choose to send. Please don’t send us sensitive information, such as details about your health, unless we’ve asked for it.

What we don’t collect

There are no accounts, comments, forums, forms that send data to us, newsletters, surveys or competitions on this site. We don’t use advertising, social media buttons or fingerprinting, and our only analytics is the visit counting described above. We don’t collect sensitive (“special category”) data such as health, religious beliefs, ethnicity or sexual orientation, and we don’t collect information about criminal convictions. We don’t buy personal data from data brokers or anyone else. Our fonts, images, maps and own scripts are all served from heliocodex.com, so loading a page doesn’t send your details to Google or any other company. There are two exceptions: the visit-counting script from Cloudflare, which you can switch off, and a video from YouTube, which loads only if you press its Play button (see below).

5. How we use it and our lawful basis

Data protection law only lets us use personal data where we have a lawful basis. The table lists every way we use the data in section 4, the basis we rely on and how long we keep it. Section 6 explains our legitimate interests.

You don’t have to give us any personal data to use this site. If you want a reply to a message, we need a way to contact you. We don’t use your data for any purpose that isn’t in this table. If we ever want to use it for a new purpose, we’ll check it’s compatible with the original one, or ask for your consent, and update this policy first.

The use of your device’s storage and position described in section 4 is covered by the Privacy and Electronic Communications Regulations 2003 rather than by a lawful basis under the UK GDPR, because the data stays on your device. See section 7.

6. Our legitimate interests

“Legitimate interests” is a lawful basis that lets an organisation use personal data for a genuine reason, as long as that use is necessary and isn’t outweighed by your interests, rights and freedoms. Where we rely on it, we have done this balancing exercise. In summary:

• Running and securing the site. Every website has to receive basic technical information to send pages to your browser. Using it to spot attacks protects you as well as us. The data is limited, short-lived and not used to identify or profile you. Protecting the security of networks and systems is one of the “recognised legitimate interests” listed in the Data (Use and Access) Act 2025.
• Answering messages. If you write to us, you expect a reply. We only use your message for that conversation and the record of it.
• Keeping the site accurate. If you tell us about a mistake, you expect us to look at it and perhaps to write back. We keep a note of what was changed and why.
• Legal claims. Keeping relevant records for the time a claim could be made protects both sides.

You have the right to object to any use based on legitimate interests (see section 13). If you’d like a copy of our assessment for a particular use, email us.

7. Cookies and similar technologies

Cookies are small files a website saves on your device. Similar technologies include local storage, pixels and device fingerprinting. The Privacy and Electronic Communications Regulations 2003 (PECR) say a website must ask for your consent before storing or reading anything on your device, unless it’s strictly necessary for a service you asked for or falls within another exception listed in the regulations. Since 5 February 2026 those exceptions include one for adapting how a website looks or works to your preferences, as long as you are told and can easily object.

Heliocodex sets no cookies. It keeps up to four small things in your browser, all described in full on the cookies and storage page:

• the place you chose on the sky map, in local storage, so that the sky map and star pages can show your sky;
• your choices in the 3D view’s View menu (planet sizes, motion and the map), in local storage, but only once you change one;
• a one-word note in session storage, kept only until you close the tab, if the 3D view’s graphics fail on your device and the page has to restart on a different graphics method; and
• a note in local storage that says you have chosen not to be counted, which exists only if you use the switch on the cookies page.

None of them is used for advertising or tracking, and none is sent to us. You can remove the first with Forget my place or by clearing this site’s data in your browser.

The site also reads a few facts about your device inside your browser, such as the size of the screen, whether you use a touch screen, how much memory and how many processor cores it has, whether it can run WebGPU or WebGL, whether you have asked for reduced motion and the time zone it is set to. They decide how detailed to make the 3D scenes and which city to guess. They stay in your browser.

Visit counting is covered by the exception in PECR for statistics, which came into force on 5 February 2026. It applies where the only purpose is to collect statistics to improve the site, the figures are shared with no one else, visitors are told, and they have a simple, free way to object. This page is the telling, the script doesn’t load if your browser sends a Do Not Track or Global Privacy Control signal, and the switch on the cookies page is the way to object. Cloudflare’s script uses your browser’s performance measurements and, according to Cloudflare, doesn’t store anything in your browser. A video from YouTube is different: nothing from YouTube loads until you press a video’s Play button, and the line beside the button tells you what that does, so pressing play is your consent. If we ever decide to add anything else that stores or reads information on your device, we’ll update this section first and ask for your consent where the law requires it. That is also why there is no cookie banner.

8. Marketing

We don’t have a mailing list for this site and we don’t send marketing emails. If you email us, we won’t add you to a list. If we ever start a newsletter, we’ll only send it to people who have actively signed up, and every email will have a simple way to unsubscribe, as PECR requires.

9. Who we share it with

We don’t sell personal data, rent it or share it with advertisers. We share it only in the situations below.

Companies that process data for us

These companies act as our processors. They may only use personal data on our instructions and to provide their service to us, under written terms that meet the requirements of Article 28 of the UK GDPR.

Professional advisers

We may share relevant information with our accountants, lawyers and insurers where they need it to advise us or provide their service. They are bound by professional duties of confidentiality and act as controllers in their own right.

The authorities

We’ll disclose personal data to the police, a court, a regulator or another public body if the law requires us to, or where it’s necessary to prevent or detect crime or to protect someone’s safety. We share only what is needed and check that each request is lawful.

If the business changes hands

If we sell or transfer all or part of our business, or merge with another company, personal data may pass to the buyer or new owner, and to their advisers during the process under confidentiality terms. The new owner would have to use it in line with this policy, and we’d tell you if what happens to your data changed.

Other websites

Some pages link to other websites, such as NASA, the European Southern Observatory, scientific journals and open data projects. If you follow a link, that site receives your IP address and the address of the page you came from, and its own policy applies from then on. We don’t pass them anything else.

10. Data sent outside the UK

Cloudflare runs a global network and is based in the United States, and Google can process data in the United States and other countries. This means personal data may be transferred outside the UK. UK law allows this only where the destination has been found to give adequate protection, or where a safeguard approved by UK law is in place.

• The UK has made “adequacy regulations” for the countries of the European Economic Area and some others, so data can flow there freely.
• For the United States, both companies take part in the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving adequate protection to data sent to certified companies.
• Both companies’ data processing terms also include standard contractual clauses with the UK’s International Data Transfer Addendum, which apply where the Data Privacy Framework doesn’t.

Because Cloudflare serves pages from the data centre nearest to you, your request will usually be handled close to where you are, wherever that is. If you’d like more detail on the safeguard that applies to a particular transfer, or a copy of the relevant terms, email us.

11. How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, including any legal, accounting or reporting requirements. The table in section 5 gives the period for each use. When a period ends we delete the data, or anonymise it so it can no longer identify you.

Cloudflare doesn’t publish a fixed retention period for the server logs it keeps when serving a customer’s site. Its privacy policy says it keeps personal information for a period that is consistent with its business purposes and then deletes it. We don’t download, copy or keep these logs ourselves.

The place saved on the sky map stays on your device for as long as you leave it there. We can’t delete it for you, because we never have it, but you can remove it yourself in a second with Forget my place.

Emails deleted from our mailbox may remain in Google’s backups for a short time before they are permanently removed, in line with Google’s data processing terms.

12. How we keep it safe

We use technical and organisational measures that are appropriate to the risk, including:

• serving the site over HTTPS, and redirecting any request made over plain HTTP, so pages can’t be read or changed on their way to you;
• collecting nothing from you that we don’t need, which is the surest way to keep it safe;
• keeping third-party scripts off the site, apart from the single Cloudflare visit-counting script, which you can switch off, which removes a common route for data leaks;
• limiting access to our mailboxes and accounts to the people who need it;
• keeping passwords in a password manager and never sharing them by email or chat;
• choosing providers that offer strong security commitments and written data processing terms.

No system is completely secure. If a breach of security led to personal data being lost, changed or disclosed, we would assess it straight away. Where the law requires, we’d report it to the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach was likely to put you at high risk, we’d also tell you directly and explain what you can do to protect yourself.

If you think you’ve found a security problem with this site, please tell us at [email protected].

13. Your rights

The UK GDPR gives you the following rights over your personal data. Some only apply in certain situations, and we’ll explain if one doesn’t apply to your request.

Most of these rights are about data we hold. For the place saved on your device, you don’t need to ask us for anything: Forget my place on the sky map, or your browser’s own controls, do it immediately.

14. How to use your rights

Email [email protected] with “Privacy request” in the subject line, or write to us at our registered office. Tell us which right you want to use and give us enough detail to find the data, such as the email address you wrote from. You don’t have to use a particular form or particular words, and you can ask someone else, such as a solicitor or relative, to make the request for you with your written permission.

• Checking it’s you. We may ask for information to confirm your identity, so we don’t give your data to someone else. We’ll only ask for what we need.
• How long it takes. We’ll respond without undue delay and within one month of receiving your request. If we need to confirm your identity or ask you to clarify the request, the month starts when we get your reply. If a request is complex, or you’ve made several, we can extend this by up to two further months. We’d tell you within the first month and explain why.
• How we search. For access requests, we’ll make reasonable and proportionate searches for your data, as the law requires.
• Cost. It’s free. If a request is clearly unfounded or excessive, we can charge a reasonable fee based on our costs or refuse it. We’d explain why and tell you about your right to complain.
• If we can’t do what you ask. We’ll tell you why, unless the law stops us, and tell you how to complain.
• Server logs. If you ask about data in Cloudflare’s logs, we’ll tell you what we can, but we don’t hold those logs ourselves and can’t search them by visitor. Cloudflare says it has no direct relationship with the people who visit its customers’ sites and refers them to the customer, which is us. Please include the date, the page and your IP address if you want us to ask Cloudflare.

15. Automated decisions

We don’t make any decisions about you by automated means alone, and we don’t use your data to build a profile of you. The sky map and the birthday-star finder do sums with the place and age you give them, but only to draw a sky and pick a star. Nothing is decided about you.

16. Children

Heliocodex is an educational site, and many of the people who use it will be children. It is built to need nothing from them. There are no accounts, no ads, no tracking and no way to talk to other visitors, and nothing a child types into the sky map or the birthday-star finder leaves their device. We have kept the ICO’s Age-Appropriate Design Code (the “Children’s code”) in mind in building it: we collect as little as we can, we don’t profile anyone and we don’t use nudges to keep people on the site.

If you are under 13, please ask a parent or carer before you email us. If you’re a parent or carer and believe a child has sent us personal data, email us and we’ll delete it. We never knowingly ask children for personal data.

17. Other websites

This site links to other websites, including NASA and other science sites, and to our own other sites. Those sites have their own privacy policies and we’re not responsible for how they use your data. Check their policies before you give them any personal data.

18. Complaints

If you’re unhappy with how we’ve handled your personal data, please tell us first so we can try to put it right. You can complain in any way you like, but the quickest is to email [email protected] with “Complaint” in the subject. We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it without undue delay and keep you updated on our progress;
• tell you the outcome and what we’ve done about it.

You also have the right to complain to the Information Commission, which regulates data protection in the UK. It took over from the Information Commissioner’s Office (ICO) on 30 September 2026 and still uses the ICO name and website. Its website is ico.org.uk/make-a-complaint and its helpline is 0303 123 1113. It will usually expect you to have raised the matter with us first. You also have the right to go to court if you believe your rights have been breached.

19. Changes to this policy

We review this policy at least once a year and whenever we change how the site handles personal data. If we make a change, we’ll update this page before the change takes effect and change the date at the top. If a change significantly affects how we use data we already hold about you, and we have your contact details, we’ll tell you directly. Earlier versions are available on request.

• 11 November 2026. Added visit counting with Cloudflare Web Analytics.
• 11 November 2026. First version, written for the launch of the new Heliocodex.

20. Contact us

For anything about this policy or your personal data, email [email protected]. For anything else, email [email protected]. You can also write to FALLINGHIPPO LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ. That is our registered office address, which is used for official post, so email is quicker.