Last updated: September 2026
The Untempered Cosmos is designed to leave your data alone. The short version: the app reads your device's location to work out which celestial bodies are above your horizon, and its motion sensors to work out which way you are facing. Both are used, moment to moment, purely to shape what you hear. Almost all of it happens on your device. The one exception is when your device cannot determine its own location: in that case, and only then, the app asks our own server for an approximate position based on your network connection, and it saves the answer you confirm so it does not have to ask again. The other is the surround unlock, and only if you ask for it: the app sends its proof of purchase to our server, which checks it and replies with six words. Nothing else is sent anywhere, and none of it is logged, profiled, or shared.
Location. When you start a listening session, the app asks the operating system for your current latitude and longitude. On Android the app requests only coarse location, which is all the astronomy needs. It uses those coordinates locally, together with the current date and time, to calculate which stars and planets are visible in your sky right now. When your device can answer, those coordinates never leave it. They are not transmitted, and they are not logged.
When your device cannot place you. Some devices have no GPS at all (Wi-Fi-only tablets, most desktop computers), and any device can fail to get a fix indoors. Rather than refuse to run, the app falls back, in this order:
What is saved on your device. To avoid asking you the same question every session, the app stores two things in its own local storage: the last precise position your device reported, and the approximate location you most recently confirmed. Both stay on your device, in the app's private storage. They are never transmitted. Deleting the app, or clearing its data, removes them.
If you deny location access, the app will ask you to turn it on, because a real position is what the piece is built around. But it will also offer to take the name of a city instead, so that declining does not lock you out of the work.
Motion and orientation sensors. The spatial audio places each celestial body at its real position in the sky around you, so the app reads motion sensors to know which way you are facing. What it reads depends on the platform:
All of this is consumed in real time to steer the audio and is then discarded. Motion and heading data are never recorded, stored, or transmitted, and are not used to infer your activity, movement, or anything else about you.
Audio output. The app generates and plays audio in real time. No microphone access is requested or used.
Headphone connection state. The app observes whether headphones are connected so it can show a small note encouraging headphone listening (the spatial audio design only works on headphones). This is a system-level state, not a user identifier.
Playback notification. While a session is playing, the app shows a standard playback notification with play and pause controls on your lock screen, so audio keeps running when the screen is off. On Android this requires notification permission; if you decline, audio still plays and you simply do not get the lock-screen controls. The notification shows only the title and artwork of the piece.
Settings stored on your device. The app stores a small number of values in its own local storage: a flag recording that you have seen the first-run introduction, the last precise position your device reported, the approximate location you most recently confirmed, and, if you have asked for one, your six surround words. None of them contain personal information beyond your own approximate whereabouts, none of them ever leave your device, and all of them are removed when you uninstall the app or clear its data.
Owning the app unlocks a surround version of the piece, for a room of speakers, on the website. Nothing in this section happens unless you tap surround and then get my code.
What the app sends. The app asks the store it came from for proof that it was bought, and sends that proof to our own server at theuntemperedcosmos.com.
What our server does with it. It checks the store's signature, works out the six words from the purchase, sends them back, and keeps nothing: not the proof, not the words, and not your IP address. On iOS the words are worked out from the purchase itself, which is why asking again gives the same six words. To stop the words being guessed, the server counts requests from each network address for one minute, in memory, and then forgets them.
Using the words on a computer. When you open the link or type the words at theuntemperedcosmos.com/unlock, the page sends the words to our server, which says whether they are genuine and keeps nothing. The page then removes the words from the address bar and stores them in that browser, so it stays unlocked. Each time the listening page loads, it quietly asks our server whether they are still valid. Removing the unlock from the unlock page, or clearing the site's data, deletes them from the browser.
Revoked codes. If a set of words is shared publicly, we can revoke it. We then keep a record that those words are no longer valid: a number worked out from the words, and the date. It identifies the words, not you, and it is the only thing about the surround unlock that we keep.
The web version of The Untempered Cosmos at theuntemperedcosmos.com behaves identically. The site is hosted on Cloudflare. Cloudflare may log standard request metadata (IP address, user agent) for normal network operations; this is the same as visiting any website, and is governed by Cloudflare's privacy policy. Once loaded, the page makes no further network requests except the approximate-location lookup described above and, if you have unlocked surround in that browser, the check that your six words are still valid. Both are served from the same domain and neither is logged.
The mobile app is distributed through the Apple App Store and Google Play. Those stores handle the download, any purchase, and their own diagnostics under their own privacy policies. The app itself sends them nothing beyond what the platform does automatically for any installed app, apart from asking for its proof of purchase when you ask for your surround words, as described above.
The content is inoffensive and suitable for any age, but the app is not directed to or marketed to children, and it is listed for a general adult audience. It does not knowingly collect data from anyone, of any age; the approximate-location lookup and the surround unlock described above are answered and discarded, never stored on our side.
If this policy ever changes, the new version will be posted at this URL with an updated date at the top. The current version of the app retains nothing about you on our servers (the only thing kept is the list of revoked surround words described above), and any change to that would be considered a significant policy update.
Questions about this policy can go to privacy@theuntemperedcosmos.com.