Privacy Policy

The short version

Aurora Iceland is an aurora forecast app made by Meðalheimur ehf, a small Icelandic company. The app has no user accounts, shows no ads, and we do not sell or share your data for advertising. We collect the minimum needed to show you a forecast, deliver aurora alerts you asked for, honor your purchase, and check whether our forecasts were actually right. Your location is rounded to about 1 km on your device before it is stored or sent anywhere.

What we collect, and why

Device identifier. The app uses the identifier your operating system assigns to our app on your device — on iOS this is the "identifier for vendor". It is not your advertising ID, it is shared with no other developer, and it does not identify you personally. We use it to store your alert preferences and to restore your Aurora Pass if you reinstall the app. Note that fully deleting our app can reset this identifier, which is why a restore is best-effort.

Location, at about 1 km precision. The app needs a location to compute your forecast. By default this is a place you pick from a list (for example Reykjavík or Vík). If you tap "Use my location", the app reads your device GPS position once, with your permission — and immediately rounds it to two decimal places, roughly a 1 km square, before anything is stored or sent. We never store or transmit your precise position. The rounded coordinates go to our servers with each forecast request and, if you enable alerts, are kept with your device record so we can watch the sky where you are. The app never tracks your location in the background.

Push token and alert preferences. If you enable aurora alerts, we store your push notification token and your chosen thresholds so our servers can send you an alert when conditions are right.

Purchase records. When you buy a Trip Pass or subscription, Apple or Google processes the payment. We never see your card details. We store the transaction identifier, the product, the expiry date, and the signed receipt the store issues (a cryptographically signed record of the transaction, which on Apple platforms is a "JWS"). We keep the receipt because it is the only way to re-verify a purchase later, for example when restoring your pass or resolving a billing dispute.

Aurora sighting survey. On the morning after a promising night the app may ask one question: did you see the aurora? If you answer, we store your answer, the score the app predicted for that night, the date of the night, your approximate (~1 km) location, and your device identifier. This is how we check whether our forecast was right, and it is the only reason we ask. Dismissing the question sends nothing.

Analytics. The app uses Firebase Analytics (Google) to count a small, fixed set of product events, so we can see where the path from opening the app to seeing the lights breaks down. The events are: a forecast verdict loaded, a location selected, the paywall shown, a product selected, a purchase started, succeeded, cancelled or failed, alerts switched on, a notification opened, and a sighting reported. Some carry a small parameter such as which screen led to the paywall, or the score of a night. Firebase Analytics also collects standard device and app information (device model, OS version, app version, country, and an app-instance identifier) as described in Google's documentation. We run no advertising SDKs, we do not use this data for advertising or profiling, and no analytics event carries your coordinates.

Server logs. Our servers keep short-lived operational logs (IP address, request time, errors) for security and troubleshooting. They are rotated and discarded, not archived.

The website (auroraiceland.app) sets no cookies and runs no analytics or trackers.

What we do not collect

No accounts, names, or email addresses (unless you email support yourself). No contacts, photos, or files. No advertising identifiers and no advertising SDKs. No background location tracking. No precise coordinates — your position is rounded to about 1 km on your device before it goes anywhere. We do not sell personal data, and we do not use it for advertising or profiling.

Service providers

We use a small number of processors to run the service:

Apple App Store / Google Play — payment processing and subscription management, under their own privacy policies.

Firebase Cloud Messaging (Google) — delivery of push notifications. Firebase receives your push token.

Firebase Analytics (Google) — the product-event counting described above.

Mapbox — map rendering. When you open the map, your device requests map tiles from Mapbox, which receives your IP address and standard telemetry as described in the Mapbox privacy policy.

Amazon Web Services — hosting of our forecast servers and database.

Weather and space-weather data comes from Open-Meteo and NOAA; only the coordinates being forecast are sent to them, never your identity.

How long we keep data

Device records and alert preferences are kept while your alerts are active. A daily job on our servers deletes any device record untouched for 12 months, and we delete yours sooner on request.

Sighting survey answers are kept as long as they are useful for checking forecast accuracy. They are tied to a device identifier, so ask us and we will delete yours.

Purchase records, including the signed store receipt, are kept as long as needed to restore purchases and as required by Icelandic accounting law.

Server logs are short-lived: they are rotated on a size and age basis and are not retained long-term.

Legal bases (GDPR)

We process data to perform our contract with you (showing forecasts, delivering the pass you bought), with your consent (device location, push notifications — both revocable at any time in your device settings), and under our legitimate interest in keeping the service secure and working.

Delete your data

To ask us to delete data connected to your device, open More in the Aurora Iceland app, tap Contact support, and ask for deletion in the email draft. The draft includes the app device identifier we need to find your records. You can also email medalheimur@medalheimur.is with the subject “Aurora data deletion”. We will confirm the request and delete eligible device, alert, and sighting records promptly. Purchase records may be retained where required for accounting, fraud prevention, or restoring a purchase.

Your rights

You can ask us to access, correct, or delete the data connected to your device identifier at any time — email us and we will handle it promptly. You can also revoke location and notification permissions in your device settings, which stops the related processing immediately. If you are in the EEA, you have the right to lodge a complaint with your data protection authority; in Iceland that is Persónuvernd.

International transfers

Our processors (Google, Mapbox, Amazon Web Services) may process data outside the EEA, in particular in the United States, under the EU standard contractual clauses or an adequacy decision.

Children

Aurora Iceland is not directed at children under 13 and we do not knowingly collect personal data from them.

Changes to this policy

If we change this policy, we will post the new version here with an updated date. Material changes will be highlighted in the app.

Contact

Meðalheimur ehf (kt. 430221-0190), Brattahlíð 32, Iceland.

Email: medalheimur@medalheimur.is