Aurora Forecast: Borealis — Privacy Policy

Effective Date: October 10, 2026

Aurora Forecast: Borealis ("the App") is developed by Mobile Card Games & Travel Apps LLC. This Privacy Policy explains what data the App collects, how it is used, and how your privacy is protected. It covers the App on iPhone and iPad (App Store) and on Android (Google Play); section 10 describes where the Android app differs.

1. Data We Collect

The App collects very little, and only what is needed to show you the aurora forecast and deliver the alerts you turn on:

• Your location (with your permission): Used while the App is open to compute your local aurora visibility forecast. The forecast comparison happens on your device against public NOAA space-weather data. See the Location section below for the one case where an approximate location leaves your device.
• Push notification data (if you enable alerts): A push notification token, a randomly generated installation ID (stored in your device's Keychain and not tied to your name, email, or Apple ID), your app version, whether you have a Pro subscription, and your alert preferences.
• Your sighting log: Aurora sightings you log in the App are stored only on your device and are never uploaded to any server.
• Purchase information: Transaction records for the Pro subscription, managed by Apple and RevenueCat.

The App does not collect your name, email address, contacts, photos, or advertising identifiers, and it contains no analytics or advertising SDKs.

2. Location

Location is used in two distinct ways, and we want to be precise about the difference:

• On-device forecast: When you view the forecast, your location is compared on your device against publicly available NOAA Space Weather Prediction Center data (aurora oval, Kp index, solar wind). Your location is not sent to NOAA or to us for this — the requests to NOAA contain no user data at all.
• Pro location alerts (opt-in): If you are a Pro subscriber and turn on alerts for your location, the App sends your coordinates to our Firebase Cloud Functions backend along with your push token and alert threshold — but only after deliberately rounding them to the nearest 0.5 degrees (a grid cell roughly 35–55 km across). Your precise location never leaves your device. If you turn the alert off, the server stops retaining the coarse grid cell.

You can deny location permission entirely and still use the App by browsing the global aurora map.

3. How We Use Your Data

We use this data solely to operate the App's features:

• To show your local aurora forecast and visibility likelihood.
• To send you the aurora alerts you opted into — free "big storm" alerts and, for Pro subscribers, alerts when the aurora is likely visible near your approximate (coarsened) location.
• To verify your Pro subscription entitlement.

We do not use your data for advertising, profiling, or analytics, and we do not sell it to anyone.

4. Third-Party Data Sharing

The App works with a small number of services:

• Google Firebase (privacy policy): We use Firebase Cloud Messaging to deliver push notifications and Firebase Cloud Functions to register alert preferences. Firebase receives your push token, the random installation ID, and — only if you enable Pro location alerts — your coarsened 0.5-degree grid cell. Firebase App Check (Apple DeviceCheck) is used to confirm requests come from a genuine copy of the App.
• RevenueCat (revenuecat.com): Manages subscription purchases. RevenueCat receives purchase/transaction tokens and a random anonymous app-user ID — never your name or email. Payments themselves are processed by Apple; we never see your payment card details.
• NOAA Space Weather Prediction Center: The App downloads public space-weather data from NOAA. These requests contain no user data.

We do not share your data with any other third parties.

5. Data Storage and Retention

• On your device: Your sighting log, settings, and the random installation ID are stored locally. Small preferences (such as your storm alert opt-in) are synced across your devices via Apple iCloud key-value storage tied to your Apple ID; we cannot access this.
• On our backend: Firebase retains only your push token, installation ID, subscription status, alert preferences, and (for Pro location alerts) the coarse grid cell. Disabling a location alert removes the coarse location from the server.
• Deletion: Turning off notifications stops alert delivery, and uninstalling the App removes all locally stored data.

6. Data Security

All communication with our Firebase backend and NOAA is sent over encrypted HTTPS connections, and Firebase App Check helps ensure only genuine copies of the App can talk to our backend. Location coordinates are coarsened on your device before transmission, so your precise location is never transmitted anywhere.

7. Your Rights

You have the right to:

• Deny or revoke location and notification permissions at any time in iOS Settings.
• Turn off Pro location alerts, which stops the server from retaining your coarse location grid cell.
• Delete your sighting log and all other local data by removing entries in the App or uninstalling it.

Depending on where you live, privacy laws such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) give you rights over your personal data, including the rights to know, access, correct, and delete it. Because we do not hold your data on servers we operate, there is typically nothing for us to access or delete on request — deleting the App deletes your data. Where the App does process data in transit, or a third-party service described above collects data, you may contact us at the email below to exercise your rights, and we will respond as required by applicable law.

8. Children's Privacy

The App is not directed at children under 13, and we do not knowingly collect data from children under 13. In some regions, including the European Union, a higher minimum age applies to consent for data processing; the same statement applies there — we do not knowingly collect data from anyone under the applicable age.

9. Data Breach Notification

In the unlikely event of a data breach affecting user data on any system we operate, we will notify affected users as required by applicable law.

10. Android App (Google Play)

The Android version works like the iPhone app and uses the same backend, with these differences:

• Genuine-app check: Instead of Apple DeviceCheck, the App uses Firebase App Check with Google Play Integrity to confirm that requests to our backend come from a genuine copy of the App.
• Installation ID: The random installation ID is kept in the App's private storage on your device (Android has no iOS Keychain) and is excluded from Android backups.
• Alerts: Push notifications are delivered through Firebase Cloud Messaging. Pro location alerts send the same coarsened 0.5-degree grid cell described in section 2, never your precise location.
• Map: The aurora map is displayed with the Google Maps SDK for Android. To show map tiles for the area you view, Google receives your device's IP address, basic device and SDK information, crash diagnostics if the SDK itself crashes, a pseudonymous SDK identifier, and map interaction events such as panning and zooming, processed under the Google Privacy Policy.
• Place search: When you search for a place or the App shows the name of your location, it uses your device's built-in geocoding service, which processes the search text or coordinates under your device provider's privacy policy.
• Purchases: Google Play processes payments. RevenueCat receives an automatically generated anonymous App User ID, basic device and app technical information, purchase history, Google purchase tokens, and subscription status — never your name, email address, location, or sighting log. See the Google Privacy Policy and the RevenueCat Privacy Policy.
• Storage and backup: Your sighting log, sighting photos, and settings are stored in the App's private storage on your device and are never uploaded to us. If Android backup is turned on for your Google account, these are included in that backup and in device-to-device transfer, which Google stores under your account; we cannot access it. Push, App Check, and purchase identifiers are excluded from backup. There is no iCloud sync on Android: your storm-alert opt-in is stored on the device.
• Other apps from us: The App occasionally downloads a small configuration file from mobilegames.cloud that decides whether to suggest another of our apps. The request contains no personal data.
• Permissions: You can deny or revoke location and notification permissions at any time in Android Settings.

Deleting your data (iPhone, iPad, and Android)

Aurora Forecast: Borealis has no accounts. To delete your data:

• Location alerts: turn the alert off in the App's Alerts screen. This deletes the alert and its coarse grid cell from our server immediately.
• Device record: our server keeps a push token, the random installation ID, your app version, Pro status, and alert preferences. A device record that has not checked in for 30 days is deleted automatically, together with any alerts attached to it. To have it deleted sooner, email us at the address below and include the App name.
• On your device: delete sightings in the App, or uninstall the App to remove all locally stored data.
• Purchases: purchase records are kept by Apple or Google and RevenueCat as required for billing and tax purposes.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Effective Date" at the top of this page.

12. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at:

v5cqpsj4e3u4@opayq.com