Mission Log

1. Who is responsible

The operator of this site is the controller of the limited personal data described below, for the purposes of the General Data Protection Regulation (GDPR).

Questions about this notice, or about your rights under it, can be sent to contact@missionlog.space.

2. Information you give us

None. There is nothing on this site to fill in: no accounts, no registration, no contact form, no newsletter sign-up and no comment section. Everything published here is written by the site's operator; nothing is collected from readers.

Searching is the one thing you can type, and it never leaves your computer. The whole archive is sent to your browser when the page loads, so filtering it happens locally — what you type into a search box is not transmitted to the server and is not recorded anywhere.

3. Information recorded automatically

Server logs

As with every website, the server that delivers these pages records each request it answers. An entry contains your IP address, the date and time, the address of the page requested, the page you came from if there was one, and the identifying string your browser sends about itself.

These logs exist so that the site can be kept working and secure — diagnosing errors, noticing abuse, understanding load. They are not used to build any profile of you, are not combined with any other source, and are not shared with anyone.

Lawful basis: legitimate interests, Article 6(1)(f) — operating and securing the service.

Failed sign-in attempts

This site has one editor login, used only by its operator. When a wrong password is submitted, the IP address it came from is written to a small file so that repeated guessing can be slowed down. Nothing else about the attempt is recorded — not the password tried, not the browser, nothing.

A record is erased the moment a correct password is entered from that address, when its block expires (at most one hour after the last wrong attempt), and in every case within 24 hours. Simply reading the site never creates one of these entries.

Lawful basis: legitimate interests, Article 6(1)(f) — network and information security, which Recital 49 of the GDPR expressly recognises as a legitimate interest.

4. Cookies and browser storage

No cookies are set when you read this site.

One cookie exists, but only for the person who edits the site. Signing in sets a cookie named session containing nothing but a cryptographically signed "signed in" flag — no name, no address, no identifier. It lasts seven days and is marked Secure, HttpOnly and SameSite=Lax. It is strictly necessary for the login to function, and so is exempt from consent requirements.

The site also keeps two small flags in your browser's session storage: almanacHeroSeen and almanacWarp. They remember that you have already watched the opening animation so that it is not replayed at you on every page. They contain no identifier of any kind, are never transmitted to the server, and your browser discards them when you close the tab.

5. Other services your browser contacts

A few pages load content directly from other organisations. When that happens your browser connects to them, and they can see your IP address, roughly when you visited, and which page requested the content. This site sends them nothing else and learns nothing back about you.

Typefaces and code libraries used to be fetched from Google and from a public CDN on every page load. They are now served from this site itself, so those companies no longer see your visit at all.

6. Services used without involving you

Several pages show live information — upcoming launches, news headlines, orbital positions. That data is fetched by the server, not by your browser, and then cached and served from here. Your IP address is never passed to these services, and they have no way of knowing you visited:

• The Space Devs / Launch Library — launch schedules
• Spaceflight News API — news headlines
• CelesTrak — orbital elements for tracked spacecraft
• NASA JPL Horizons — spacecraft and planetary positions
• Wikimedia Commons — archival photographs, downloaded once and then served from this site

7. Where the site is hosted

Mission Log runs on infrastructure provided by Render Services, Inc., a company based in the United States, acting as a processor under a data processing agreement. The servers for this site are located in Oregon, in the United States.

This means personal data — in practice, the IP addresses recorded in server logs — is processed outside the European Economic Area. That transfer is covered by the European Commission's Standard Contractual Clauses, which form part of Render's data processing agreement.

8. How long anything is kept

• Server logs — retained by the hosting provider for a limited period under its standard retention policy, then deleted. They are not copied or archived anywhere else.
• Failed sign-in records — at most 24 hours, usually far less, as described in section 3.
• Everything else — nothing else about you is stored at any point.

9. Your rights

Under the GDPR you have the right to ask for access to your personal data, to have it corrected or erased, to have its processing restricted, to object to processing carried out on the basis of legitimate interests, and to receive it in a portable form. To exercise any of these, write to the address in section 1.

There is an honest limitation worth stating plainly. This site holds nothing that identifies you — no account, no cookie, no identifier of any kind. An IP address in a log cannot be matched to a person without help from your internet provider, which we neither have nor want. As permitted by Article 11 of the GDPR, we are not required to obtain additional information purely in order to identify you, and in most cases we will genuinely be unable to locate "your" data in order to act on a request. If you can supply enough detail to isolate specific log entries, we will do what we can.

10. Complaints

If you believe your data has been handled improperly, you are entitled to complain to the data protection authority in the EU or EEA country where you live, where you work, or where the problem occurred. A complaint to a regulator does not require you to contact us first, though we would rather have the chance to put something right.

11. Children

This site is a general-interest historical archive. It is not directed at children, and it collects no personal information from anyone of any age.

12. Changes to this notice

If what the site does with data changes, this page changes with it and the date at the top is updated. There is no mailing list to notify, because there is no mailing list.