How Photon handles your data.

At a glance

• Analysis runs on your computer. Propagation, screening and the 3D viewer use data on your machine. The CDMs and ephemeris files you import stay there too — unless you attach an ephemeris to a fleet satellite, which uploads it (see Fleets).
• Our server holds your account, the fleets your organization saves, the ephemerides attached to them, and the results of server-side screening.
• AI features send the text of your request to an AI provider through our server. We do not store that text.
• No advertising, no analytics cookies, no sale of personal data.

For what runs where, and what needs the internet, see where your data goes.

This website

Server logs

Like any web server, ours keeps request logs: the time, your IP address, the page asked for and the result. The account service also logs account events, which include the email address involved. We use them for security, abuse prevention and debugging. We have not set a fixed retention period for these logs.

Fonts

Your browser fetches our typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so Google receives your IP address and browser details, as it would from any site that uses them. We send Google nothing else.

Cookies

When you sign in we set one cookie, photon_account. It keeps you signed in, is strictly necessary, and is HttpOnly, Secure and SameSite=Lax. We set no analytics or advertising cookies, and the site does not use local storage. Browsing the site signed out sets nothing.

Forms: access requests, contact and careers

What you type is saved on our server with a timestamp, and emailed to our team through our email provider. Our staff read submissions in an admin console.

• Request access: name, email, organization, fleet size, optional NORAD IDs and message.
• Contact: name, email, optional organization, topic and your message.
• Careers: name, email, the role you have in mind, optional links, your message, and an optional CV (PDF, Word or text, up to 12 MB). CVs are stored as files on our web server.

To keep the forms from being abused they carry a hidden field, a signed timer, and a limit on submissions per hour from one address. The address is held in memory to count them; it is not saved with your submission.

How long: nothing deletes form submissions or CVs automatically. They stay until we delete them, and we will delete yours if you ask.

Accounts

An account holds:

• your email address and your password — only as a salted hash, never the password itself;
• your sign-in sessions and password-reset requests — stored only as hashes; a reset link works for one hour;
• your plan, its expiry, seat count and status, and the activation key you redeemed (stored as a hash);
• your devices: a random install ID (not a hardware fingerprint), a device name, the platform, and when it was first and last used;
• your organization, the members and their roles, and invitations (the invitee's email).

Early access is free and we take no payment details on this site. If paid plans are introduced, card details would be entered on the payment processor's own pages, not ours.

Our staff can see an account's plan, devices and usage to support you, and every staff action on an account is written to an audit trail. From your account page you can sign out everywhere, remove devices, change your password and close the account.

Fleets, ephemerides and screening results

• Fleets you save to your organization: satellite names, NORAD IDs, element sets, the shapes and colours you assign, and revision history. This is how a team shares one fleet across machines.
• Ephemerides you attach to a fleet satellite in the Constellation Manager: the converted table of states, and its covariance if the file carried one. It is shared with everyone who can see that fleet and used by your organization's server-side screening. Other organizations' screening never sees it. It is removed when you remove it, or when you remove the satellite or the fleet. An ephemeris you only import through File → Operator ephemerides is not uploaded.
• Screening results: the close approaches found for your fleets, kept as events, re-screened every 2 hours.
• Alert settings: the destinations you configure (email addresses, Slack or webhook URLs) and API keys, which are stored as hashes and shown once.

On your computer

The desktop app keeps these on your machine and does not send them to us:

• CDMs and OEMs you import. They are never uploaded and never included in an AI request. On Linux and macOS the files are readable only by your user account; on Windows they sit in your user profile. They are not encrypted at rest. A CDM is dropped a day after its closest approach.
• Settings, catalog caches, and logs. The AI log records metadata (when and which feature) by default; full prompts are written only if you turn that on, and then only to your disk.
• Your sign-in token, in your operating system's keychain, and a random install ID.

Two things do leave the machine without an account action. The app downloads public orbit data from CelesTrak directly, so CelesTrak sees your IP address and which data sets you asked for, and nothing about your account. And at launch it asks our server whether a newer signed build exists, which carries the app's version and your platform. A crash report is sent only after the app has shown you its exact text and you press Send; it carries no element sets, prompts, fleet data or email address.

AI features

Nothing is sent unless you use an AI feature (briefings, triage explanations, foresight, maneuver narratives). When you do:

• What is sent: the text of the request, which includes the context the feature needs — your satellites' identifiers and names, orbit state, the alerts Photon computed, and candidate maneuvers. Treat it as operationally sensitive.
• Where it goes: to our server, which forwards the text to an AI model provider (xAI's Grok models, directly or through OpenRouter) and returns the reply. The forwarded request carries neither your email address nor your account ID.
• What we keep: a record that a request happened — which feature, when, the outcome, and daily token counts and estimated cost — but not its content. Our server holds recent replies in memory for up to 15 minutes, to avoid paying twice for an identical request.
• The provider processes the text under its own terms, and we do not control its retention.

Who else receives data

We do not sell personal data. We disclose it if the law requires us to.

How long we keep things

This is what the system does today. Where it says no period is set, that is a decision we have not made yet, and we would rather say so than quote a period we don't enforce.

Your choices and rights

To see, correct or delete data we hold about you, email info@xe4.space. You can also manage your account yourself from the account page. If data protection law such as the GDPR applies to you, you may also ask us to restrict or stop using your data and to give you a copy of it, and you may complain to your data-protection authority.

If you use Photon on behalf of an organization, that organization usually decides what is stored about its fleets and people, and we handle it on its behalf. Ask the organization first.

Security

• Passwords are stored as salted, memory-hard hashes; sign-in, reset and invitation tokens and activation and API keys are stored only as hashes.
• Access tokens last 15 minutes and refresh tokens rotate on every use; the website's session cookie is HttpOnly, Secure and SameSite.
• Traffic is encrypted in transit. Staff accounts are separate from customer accounts, and staff actions are logged.

No system is perfectly secure. If you find a problem, please tell us at info@xe4.space.

Changes

When what we do changes, we update this page and the date at the top.