Nuclear Multi-Messenger Astronomy
Light-curve fitting

Privacy Notice for the NMMA API

Effective Date: 2026-05-18

This notice describes what the NMMA API ("Service") collects and stores in the course of running a light-curve fit on your behalf. It covers only the NMMA fitting service. Account creation, sign-in, push notifications, alert distribution, mobile-app analytics, and the other features of the Astro-COLIBRI platform are governed by the separate Astro-COLIBRI Privacy Policy, which applies in addition to this notice.

1. Who we are

The Service is operated by the Astro-COLIBRI team. For privacy questions you can reach us at astro.transients@gmail.com.

2. What we collect

When you submit a fit request via the Astro-COLIBRI app or by calling the API directly, the Service records:

  • your Firebase user identifier (UID), as passed in the request — used so the fit record can be associated with your account history;
  • the fit inputs: light-curve URL, transient name, fitting model, prior overrides, source / quality filters;
  • the fit outputs: best-fit parameters, Bayesian evidence, generated plots, and a server-assigned job identifier;
  • the submission and completion timestamps;
  • standard HTTP server logs (request paths, status codes, timing) used for operating and debugging the Service.

The Service does not set cookies, does not run third-party trackers on the fitting endpoints, and does not require you to sign in to its own pages. Authentication is handled upstream by the Astro-COLIBRI app, which then forwards your UID with each fit request.

3. Where it is stored

  • Fit records (inputs, parameters, evidence, job id, timestamps) live in a managed MongoDB Atlas database.
  • Per-user job-id and submission-timestamp lists live in Firebase Firestore so you can browse your own history.
  • Generated plots (light curve PNG, corner plot PNG) are uploaded to an AWS S3 bucket and served via short HTTPS URLs.
  • Light-curve CSV files supplied via URL are fetched at fit time, processed, and not retained as separate files beyond the run.

4. How it is used

Stored data is used to:

  • run the requested fit and return its results;
  • cache fits keyed on the input parameters so identical requests do not redo expensive computations;
  • let you list, re-open, and delete your past fits;
  • operate, debug, and improve the Service.

We do not sell, rent, or share fit data with third parties. Aggregate or anonymised statistics may be used in scientific publications or talks describing the Service.

5. Retention

Fit records and generated plots are retained indefinitely so that you and the broader user community can revisit and cite past results, unless you delete them from your history (which removes the user-side pointer; the underlying record may be retained for cache and reproducibility). HTTP server logs are kept for a short operational window and then rotated out.

6. Your rights

You can delete individual fits from your personal history through the Astro-COLIBRI app. To request deletion of a specific fit record, of all fit records associated with your UID, or to ask for a copy of your stored data, write to astro.transients@gmail.com. We will respond within a reasonable timeframe and in accordance with applicable law (including, where relevant, GDPR).

7. Third-party processors

The Service relies on the following sub-processors strictly for the purposes listed above:

  • Google Firebase / Firestore (user identity and per-user job index);
  • MongoDB Atlas (fit-record database);
  • Amazon Web Services / S3 (plot storage and delivery).

8. Changes

We may update this notice; the current version is always the one published at this URL.