AuroraThis policy covers the iOS app Aurora: Forecast & Alerts and this website, aurora.report. Both are made by Sterk Vekst AS, org. nr. 931 436 678, 9601 Hammerfest, Norway, which is the data controller. For any privacy question or request, email magnus@sterkvekst.no.
Our other apps are covered by the Sterk Vekst privacy policy. For Aurora, this page applies.
In short
- No accounts. Aurora works with a random installation ID that isn't linked to your name, email address or Apple ID.
- Approximate location only. Your position is rounded on your iPhone to an area of about 5 km before it leaves the device, and only while the app is open.
- The website sets no cookies and has no forms, accounts, ads or tracking pixels, so it shows no cookie banner.
- We don't sell data, share it for advertising, or track you across other companies' apps or websites.
The website
aurora.report shows aurora forecasts, history and a moon calendar for travel destinations. It has no accounts, forms, comments or newsletter, and it doesn't ask for your location. It sets no cookies and uses no local storage, advertising or tracking pixels.
When you visit, our hosting provider Cloudflare processes the technical data any web server receives (your IP address, browser type and the page you asked for) to deliver the page and protect the site from abuse. We count visits with Cloudflare Web Analytics, which works without cookies or fingerprinting and shows us only totals, such as page views, referring sites and countries. We can't identify you from it.
Links to the App Store carry a campaign label (for example web-tromso-hero), so App Store Connect can tell us how many downloads came from each page. The label describes the page, not you, and Apple reports it to us only as totals.
The app: data stored on your iPhone
Aurora stores a random installation ID, your chosen destination, recently used places, alert preferences, onboarding status and settings on your device. We can't access it. It's deleted when you delete the app. Data in an iCloud or device backup is handled by Apple under Apple's terms.
The app: forecasts and alerts
To give you a local forecast, Aurora uses your device location with your permission, only while the app is open and only as approximate location. Before it leaves your iPhone, your position is rounded to a grid cell of 0.05° (about 5 km). Instead of sharing your location, you can search for a destination, which uses Apple MapKit.
To send alerts, we store on our backend, operated with Supabase in the EU (Stockholm, Sweden):
- a random installation ID, shown in the app's Settings as your Support ID, not linked to your name, email address or Apple ID;
- the Apple push token for your device;
- the rounded location cell and the name of the place you chose, which we use in the alert text;
- your alert preferences (alert mode, live alerts on or off, quiet hours);
- your app language and time zone;
- whether alerts are included in your subscription, and until when;
- when the app was last used and which alerts were last sent.
Forecasts are calculated on our backend from public data: weather and cloud forecasts from MET Norway (the Norwegian Meteorological Institute), space-weather data from the NOAA Space Weather Prediction Center, and the Kp index from GFZ Helmholtz Centre for Geosciences (GFZ Potsdam). We send these sources no personal data. Requests to MET Norway contain only a rounded location cell, and the space-weather sources receive no location at all.
Aurora doesn't use your location in the background, doesn't keep a history of your locations, and doesn't use location for advertising. Deleting the app stops forecasts and alerts.
The app: subscriptions
Purchases are made through Apple's App Store. Apple processes your payment and Apple ID details as an independent controller, and we never receive your card details. We use RevenueCat to check subscription status, restore purchases and unlock paid features. RevenueCat processes the same random installation ID as the app user ID, product and transaction identifiers, purchase and renewal status, app version, and basic device and country information.
The app: product analytics
Aurora sends anonymous usage events to PostHog, hosted in the EU, so we can understand how the app is used and improve it. These include:
- onboarding steps, and your answer to whether you're on a trip, planning one or live up north (sent only as trip, planning or local);
- whether location and notification permissions were granted;
- paywall views and purchases;
- which screens are opened;
- app version, device model, operating system, app language and approximate country.
Analytics never include place names, coordinates, location cells or your Support ID. They aren't linked to your identity. We use no session recording or advertising identifier, and we don't use analytics for advertising or to track you across other companies' apps or websites. If you installed Aurora from an Apple Search Ads advertisement, RevenueCat receives Apple's attribution token so we can see which campaign led to the install and whether it led to a subscription. No advertising identifier is involved.
Notifications, diagnostics and support
Aurora alerts are sent from our backend through Apple's push notification service. You can turn notifications off at any time in iOS Settings. If you share analytics with app developers in iOS, Apple may give us crash reports and diagnostics, which don't identify you. If you email us, we process your email address and your message in order to answer you.
Why we process data (legal basis)
- Forecasts, alerts and paid features you ask for: performance of our contract with you (GDPR art. 6(1)(b)).
- Security, abuse prevention, fixing errors, anonymous analytics, website hosting and visit statistics: our legitimate interests (art. 6(1)(f)). We keep this data minimal and anonymous where possible.
- Notifications: your consent, given through the iOS permission prompt (art. 6(1)(a)), which you can withdraw at any time in iOS Settings.
- Records we must keep: legal obligation (art. 6(1)(c)).
Service providers and transfers
- Apple: App Store distribution, payments, push delivery of alerts, MapKit place search and diagnostics.
- RevenueCat, Inc. (United States): subscription management.
- Supabase: backend for forecasts and alerts, hosted in the EU (Stockholm, Sweden).
- PostHog (EU hosting): anonymous product analytics.
- Cloudflare, Inc. (United States): hosting, delivery, security and cookieless visit statistics for aurora.report.
Some providers are based in, or may access data from, countries outside the EU/EEA, including the United States. Where this happens, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.
How long we keep data
- App data on your device: until you delete it or remove the app.
- Aurora device records on our backend: for as long as they're needed to provide forecasts and alerts to that installation, and deleted when you ask us to delete them.
- Analytics events: only as long as they're useful for improving the app, within our analytics provider's retention limits.
- Website: Cloudflare keeps server logs for a short period for security, and keeps visit statistics only as totals. We keep no website logs of our own.
- Subscription records: kept by Apple and RevenueCat as their accounting, tax and fraud-prevention duties require.
- Support emails: as long as needed to resolve the request, and no more than 3 years.
Your rights
Under the GDPR and the Norwegian Personal Data Act you can access, correct and delete your personal data, restrict or object to processing, ask for data portability, and withdraw consent at any time. Email magnus@sterkvekst.no. Aurora has no accounts, so include the Support ID shown in the app's Settings so we can find your device record. We answer within one month.
You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or the data protection authority where you live.
Children
Aurora isn't directed to children under 13. Users under 18 should use it with the permission of a parent or guardian. We don't knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we'll delete it.
Security
We use encrypted connections (HTTPS), access controls and data minimisation. No system is completely secure, so protect your device with a passcode.
Changes
We'll update this policy before adding features that change how we process personal data, such as accounts, new analytics, advertising or new location features. The date at the top shows when it last changed.
Contact
Sterk Vekst AS, org. nr. 931 436 678, 9601 Hammerfest, Norway. Privacy: magnus@sterkvekst.no. Support: support@sterkvekst.no. Terms of use: sterkvekst.no/terms.
