Privacy policy

1. Who operates Tuduni

Tuduni (tuduni.com) is operated by Vishal Singh Bais, India. This policy covers our website, Tuduni Laboratory, satellite and sky tools, account services and Video Studio. For privacy questions or requests, contact vishalbais@gmail.com.

2. Information we collect and why

• Account information: your name, email address, verification status, optional profile image, authentication provider identifiers, preferences and account timestamps. We use these to create and secure your account, recognize you when you sign in and provide account features. Email/password accounts store a password hash, rather than your readable password.
• Session and security information: session identifiers, expiry, IP address, browser information, rate-limit records and security or administrative events. These support sign-in, abuse prevention and service operation.
• Saved content and activity: projects and versions, simulation snapshots, camera settings, saved observatory views, satellite favorites, export settings, status, file metadata and usage counts. These provide saved work, recording history and plan limits. A saved observatory view may include observer coordinates.
• Billing, if you purchase a plan: plan and subscription status, payment-provider customer and transaction references, amounts, currency, payment/refund status and relevant dates. Payment details are handled by the payment provider; Tuduni does not store full card numbers.
• Communications: information you send when requesting support, deletion, a refund or reporting a problem. Please include only information needed to resolve your request.

3. Google sign-in and Google user data

Google sign-in is optional; email/password registration is also available. When you choose Sign in with Google, we request only the basic OpenID Connect scopes openid, email and profile. Google provides your account identifier, name, email address, email verification status and profile picture when available. We use this information to authenticate you, create or recognize your Tuduni account, and display your profile.

Authentication records, including OAuth tokens returned by Google and their expiry/scope metadata, are stored in our server-side database. We do not ask for your Google password, Gmail, Google Drive, contacts or calendar access. We do not upload your recordings to Google or publish to YouTube on your behalf.

We do not sell Google user data, use it for advertising, or use it to train AI models. We use and share Google data only for the account features and security purposes described here, service processing, or legal obligations. Tuduni adheres to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can revoke Tuduni’s connection in your Google Account connections. Revocation does not itself delete your Tuduni account or end an existing Tuduni session. See data and account deletion for both steps.

4. Location and astronomy services

We ask for browser location permission only when you choose Use your location. You can instead select a city or enter coordinates manually. Live Moon remembers your chosen observer coordinates in this browser’s local storage until you use Clear location or clear site data. You can also revoke location permission in your browser.

For Live Moon calculations, coordinates rounded to three decimal places and elevation are sent to Tuduni’s server and NASA JPL Horizons to obtain the observer’s lunar position. The server uses a bounded temporary calculation cache. Account details are not included in the Horizons query. Saved observatory views can store location in your account when you explicitly save a view. Satellite catalog requests use public data from CelesTrak. See data sources and licenses.

5. Recordings and browser storage

Simulations and video encoding run in your browser. Finished video files remain in browser memory until downloaded or discarded; Tuduni stores export settings, status and file metadata, rather than uploading the video file to our servers. Simulator-area screen capture requires your browser’s screen-sharing permission. Choose the intended surface and avoid including private information. You control any later sharing of downloaded files.

We use necessary sign-in/security cookies and browser storage for preferences, observer location and local work. Blocking them may prevent sign-in or saved settings. The site does not currently include advertising cookies or third-party marketing analytics. Clear site data to remove browser-stored preferences; this also signs you out and can remove unsaved work. Downloaded files remain on your device.

The installable app stores its public icons and an offline help screen on your device. Its service worker does not cache account pages, API responses, saved projects or live astronomy data. Reconnect to use those services; installing the app does not back up unsaved work or recordings.

6. Sharing and service providers

Railway provides application hosting and PostgreSQL database infrastructure. Google processes sign-in when you choose it. When account email delivery is configured, Resend processes recipient addresses and transactional email content. If paid checkout is enabled, Stripe processes payments and subscriptions. NASA JPL receives the observer query described above. These providers process data under their own terms and privacy notices: Railway, Google, Resend, Stripe and NASA.

Authorized administrators can access account, project and activity records to operate the service, assist users and investigate abuse. We may disclose information when legally required or to protect users and the service. We do not sell personal information. If you choose to share project content publicly, others may view or copy it; keep private information out of shared content.

7. Storage, security and retention

Information is processed in India and in the countries where our infrastructure and service providers operate. Production hosting is currently in Singapore. We use HTTPS, server-side authentication and access controls. No storage or transmission system can guarantee absolute security.

We keep account records and saved work while your account exists and they are needed to provide the service. Deleting a project may initially archive it; permanently deleting it or deleting the account removes the related live database records. Account deletion removes authentication records, sessions, projects and versions, saved views, favorites, usage and export history.

Payment transaction records and administrative audit records may remain after account deletion for accounting, legal, fraud-prevention and security purposes. Their account link is detached; transaction/provider references and existing audit details may remain. Deletion from the live database does not guarantee immediate removal from provider backups or legally required records. Those copies remain subject to the provider’s backup lifecycle and applicable retention requirements.

8. Your choices and privacy rights

Update your name and preferences, sign out, and request email-confirmed deletion in Account settings. Export saved scenarios before deletion if you want to keep them. If you cannot sign in, receive a deletion email, or need a copy, correction or deletion of your information, contact vishalbais@gmail.com. We may ask for proportionate proof that you own the account; never send your password or a verification code. See the public deletion guide.

Depending on your location and applicable law, you may have rights to access, correct, erase or obtain a copy of your information, object to or restrict processing, withdraw consent, or complain to the relevant authority. We process information to provide the service you request, with consent where needed, to secure and operate the service, and to meet legal obligations. Withdrawal of consent does not invalidate earlier lawful processing.

9. Children and policy changes

Tuduni provides general educational and creative tools. Children should explore with a parent, guardian or teacher and should not submit personal information or create an account without the authorization required by applicable law. If you believe a child has provided information without required consent, contact us to request review and deletion.

We will update this page and its date when practices change. Material changes to Google data use will be disclosed before that new use and additional consent requested where required.