Privacy policy for Aurora Tracker

• No account, no sign-in. The app sends me no data on its own.
• What you create in the app stays on your device.
• The app shows ads from Google. Whether Google may use data for personalised ads is your choice at first launch.
• For some features the app fetches data from Open-Meteo, NOAA Space Weather Prediction Center, NOAA nowCOAST, NASA GIBS, NASA Solar Dynamics Observatory.

Responsible for the app Aurora Tracker is:

For any question about data protection, write to [email protected]. There is no data protection officer, because the law does not require one for a business of this size.

The app stores on your device your settings (map type, Kp threshold, language, cloud layer), whether storm alerts are on and for which threshold, whether you have Premium, and caches loaded solar images. It does not store your location.

This data lives only on your device; I have no access to it. It is needed for the features you use (section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR). Deleting the app removes it.

If backups are turned on (iCloud or Google), the operating system includes the app data in them. You control this in your device settings; Apple’s or Google’s terms apply.

The app asks for a permission only when you use the feature. You can revoke any permission in your device settings at any time; the rest of the app keeps working. The legal basis is your permission in the system dialog (Art. 6(1)(a) GDPR, section 25(1) TDDDG).

• Location: The app uses your location to load the cloud forecast for your place and to show you on the map. The app asks only while it is open, never in the background. For the cloud forecast it sends the coordinates rounded to two decimals (about 1 km) to Open-Meteo. The location is not stored.
• Notifications: Notifications appear only if you allow them.

The app is funded by ads from Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. At first launch, a dialog from Google asks whether Google may use data for personalised ads and measurement. On iPhone, the system then also asks whether the app may track you across apps from other companies (App Tracking Transparency).

If you agree, Google receives from your device the advertising ID (IDFA or Android advertising ID), your IP address, details about the device and operating system, the app, and which ads you see and tap. Google derives an approximate location from the IP address. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).

If you decline, the app still shows ads, but without personalisation and without the advertising ID. Even then Google technically receives your IP address and device details to deliver the ad, cap how often it appears and detect fraud. The legal basis is my legitimate interest in funding the free app (Art. 6(1)(f) GDPR).

You can change your choice at any time under the privacy options in the app’s settings. On iPhone, change the tracking permission under Settings › Privacy & Security › Tracking.

If you buy “Remove ads”, the app loads no more ads and Google’s ad SDK stays idle.

Google is itself responsible for processing for its own purposes. Data may reach the USA. The company is certified under the EU-US Data Privacy Framework; the adequacy decision of the European Commission covers this transfer (Art. 45 GDPR). See Google’s privacy policy and How Google uses data from apps.

Purchases and subscriptions are handled by Apple (App Store) through your store account. I receive neither your name nor payment details. The app learns from the store only whether a purchase exists and remembers that on your device. The legal basis is fulfilling the purchase (Art. 6(1)(b) GDPR).

You manage and cancel subscriptions in your store account settings.

If you turn on storm alerts, the app subscribes to exactly one alert level (for example “Kp 5 and up”). My server sends an alert to all devices of that level as soon as NOAA space weather data reaches it. It knows neither your device nor your location and stores no device data.

Notifications are delivered through Firebase Cloud Messaging by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on iPhone also through Apple’s push service. For this, your device creates a random installation ID and a device token that Google or Apple process for delivery. Data may reach the USA. The company is certified under the EU-US Data Privacy Framework; the adequacy decision of the European Commission covers this transfer (Art. 45 GDPR).

The legal basis is your consent, given by turning notifications on and allowing them (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Turning them off in the app or the system settings ends delivery.

For some features the app fetches public data from these services. It does not sign in anywhere and sends no identifier of yours. The legal basis is providing the feature you use (Art. 6(1)(b) GDPR).

• Open-Meteo (OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen, Switzerland): Hourly cloud forecast for your place. Sent are your rounded coordinates and your IP address. The seat is outside the EU in a country for which the European Commission has found an adequate level of data protection (Art. 45 GDPR). Privacy
• NOAA Space Weather Prediction Center (National Oceanic and Atmospheric Administration, a US agency): Aurora forecast, Kp index and solar wind. Sent are no further details and your IP address. The server is in a country without an adequacy decision. It receives only your IP address, which it needs to send the public data asked for. The transfer is necessary for the feature you use in the app (Art. 49(1)(b) GDPR).
• NOAA nowCOAST (National Oceanic and Atmospheric Administration, a US agency): Cloud satellite image for the map. Sent are no further details and your IP address. The server is in a country without an adequacy decision. It receives only your IP address, which it needs to send the public data asked for. The transfer is necessary for the feature you use in the app (Art. 49(1)(b) GDPR).
• NASA GIBS (NASA, a US agency): Cloud image of the polar regions. Sent are no further details and your IP address. The server is in a country without an adequacy decision. It receives only your IP address, which it needs to send the public data asked for. The transfer is necessary for the feature you use in the app (Art. 49(1)(b) GDPR).
• NASA Solar Dynamics Observatory (NASA, a US agency): Current images of the sun. Sent are no further details and your IP address. The server is in a country without an adequacy decision. It receives only your IP address, which it needs to send the public data asked for. The transfer is necessary for the feature you use in the app (Art. 49(1)(b) GDPR).
• Apple Maps (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland): On iPhone, the map is drawn by Apple. The system loads map tiles from Apple; if you show your location, Apple processes it under its own terms. Apple’s privacy policy

Now and then the app asks for a rating through the system dialog. The app decides when based on counters on your device; Apple or Google decide whether the dialog appears. A rating goes straight to the store, not to me.

If you tap feedback or report a bug in the app, your mail app opens with a prepared message. The message goes to [email protected] and already contains the app version, operating system and device model so I can trace errors. You see everything before sending and can edit or delete it; only what you send yourself is sent.

I use your message only to help you and delete it once the matter is settled. The legal basis is your use of the app (Art. 6(1)(b) GDPR) or my legitimate interest in answering (Art. 6(1)(f) GDPR). The mailboxes are hosted by STRATO GmbH, Berlin, as my processor.

When you download or update the app, Apple processes data such as your account details and device ID under its own responsibility. I have no influence on this. From the stores I receive only aggregated statistics (such as downloads per country) and crash reports not linked to you, if you allowed sharing them in your device settings.

Where I process personal data about you, you have these rights:

• Access to your data (Art. 15 GDPR)
• Correction of wrong data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Receiving your data in a common format (Art. 20 GDPR)
• Withdrawal of consent, at any time and for the future (Art. 7(3) GDPR)

Objection (Art. 21 GDPR): Where processing rests on a legitimate interest (Art. 6(1)(f) GDPR), you may object to it at any time on grounds relating to your particular situation. I then stop, unless there are compelling legitimate grounds that override your interests, or the processing serves legal claims.

An informal email to [email protected] is enough. You may also lodge a complaint with a data protection authority (Art. 77 GDPR), for example the one responsible for me:

www.baden-wuerttemberg.datenschutz.de

I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

When the processing changes, I update this policy. The date at the top shows the last revision. The German version prevails.