Privacy Policy

This policy explains how OscarWatch collects and uses personal data when you use our website and services. We have written it in plain language. If anything is unclear, please contact us.

Who we are

OscarWatch is operated by Peter Goodhall, trading as Magicbug. For data protection law, Peter Goodhall is the data controller responsible for your personal data.

Contact: privacy@oscarwatch.org

What this policy covers

This policy applies to the OscarWatch website, user accounts, the UHM (You Heard Me) packet reporting service, community features where you share your activity, API access, and related email communications. It does not cover third-party websites we link to, such as GitHub or external documentation.

What data we collect

Depending on how you use OscarWatch, we may collect:

• Account details: name, email address, and password (stored in hashed form).
• Station profile: amateur radio callsign and Maidenhead gridsquare, if you choose to add them.
• Security data: two-factor authentication settings, passkey credentials, and session information when you are signed in.
• UHM hearing reports: satellite name, callsigns from decoded packet frames, optional decoded message text, timestamps, and related technical metadata when you use the UHM API.
• Satellite spots: your callsign and gridsquare, the callsigns and gridsquares of stations you decoded, signal reports, decoded FT4 messages, frequencies, times, and the client software you used.
• SSTV pictures: the images you upload, with the satellite, SSTV mode, reception time, and the client software you used. We keep a fingerprint (hash) of each original file to block duplicate uploads.
• Technical logs: IP address and basic request information, for example when submitting UHM reports or spots, uploading pictures, or signing in.
• Communications: emails we send you, such as account verification or password reset messages.

We do not ask for payment card details. OscarWatch accounts and core services are free.

How we use your data

We use personal data only to run and improve OscarWatch. This includes:

• creating and managing your account
• authenticating you and keeping your account secure
• operating the UHM service and confirming mutual packet copy between stations
• showing satellite spots on the public map and building pass, contact, and station summaries from them
• reviewing, compressing, and publishing SSTV pictures you share
• providing API tokens and administering access where needed
• responding to support requests and important service notices
• protecting the service against misuse

We process your data under UK data protection law. Our lawful bases include performing our service for you, legitimate interests in running a secure amateur radio platform, and legal obligations where they apply.

What we publish

Some features exist to share amateur radio activity, so parts of what you submit are public:

• Spots you report are shown publicly with your callsign and gridsquare, together with the callsigns, gridsquares, signal reports, and messages of the stations you decoded.
• Spots can include callsigns of operators who do not use OscarWatch, because they were transmitted openly over a satellite. If you would like your callsign removed, contact us.
• Approved SSTV pictures are shown publicly with your callsign, the satellite, the mode, and the reception time. Pictures waiting for review or rejected are only visible to you and our moderators.
• Your SSTV gallery page is private unless you switch it to public. When it is public, anyone can see your approved pictures and totals on one page.

What we do not do with your data

We do not sell your personal data. We do not pass it on to third parties for their own marketing. We do not use your data for advertising profiles.

Where your data is stored and processed

OscarWatch is hosted in the United Kingdom. Your account data and UHM hearing reports are stored on UK-based infrastructure.

We send transactional email (for example account verification and password reset) using Amazon Web Services (AWS) Simple Email Service. Only the information needed to deliver those emails is shared with AWS for that purpose. AWS acts as a service provider processing data on our instructions, not as an independent controller of your data.

Apart from services strictly required to operate the site, such as email delivery, we do not share your personal data with outside organisations.

How long we keep data

• Account data is kept while your account is active. If you delete your account, we remove or anonymise associated personal data unless we must keep something for legal or security reasons.
• If you sign up but never verify your email address, we send one reminder and delete the account about 7 days after sign up.
• UHM hearing reports are kept for about seven days for operations and audit, then deleted automatically.
• Individual spots are deleted automatically after 30 days. Summaries built from them, such as pass statistics, contacts, and the stations heard map, are kept long term and include callsigns and gridsquares.
• SSTV pictures are kept until you or we delete them, or you delete your account. If a picture is rejected, the image is deleted but a record of it, including its fingerprint, is kept to stop the same file being uploaded again.
• Session and security logs are kept only as long as needed for security and troubleshooting.
• Records of failed sign-ups, rejected API requests from signed-in users, rejected SSTV uploads, and emails that could not be sent are kept for 15 days, then deleted.

Cookies and similar technologies

OscarWatch uses essential cookies and similar technologies to keep you signed in, remember your preferences, and protect the site. We do not use advertising or tracking cookies.

Your rights

Under UK data protection law, including the UK GDPR and the Data Protection Act 2018, you have rights over your personal data. These include the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct inaccurate data
• ask us to delete your data in certain circumstances
• object to or restrict some processing
• withdraw consent where processing is based on consent
• raise a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, email privacy@oscarwatch.org. We will respond within one month in most cases.

You can complain to the ICO if you are unhappy with how we handle your data: ico.org.uk/make-a-complaint. The ICO is the UK regulator for data protection, including in Scotland.

Children

OscarWatch is intended for licensed amateur radio operators and other adults using satellite radio services. We do not knowingly collect personal data from children under 13.

Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top of the page when we do. For significant changes, we may also notify registered users by email or through the site.

Law and jurisdiction

This policy is governed by the laws of Scotland. Any dispute relating to your personal data or this policy is subject to the courts of Scotland, without prejudice to your right to complain to the ICO or seek remedies under UK data protection law.