Privacy Policy

01Data we collect in the app

• Push notification token. A token issued by Apple (APNs) or Google (Firebase Cloud Messaging) that lets us deliver aurora alerts to your device. We receive it only if you allow notifications. If you do not, the app sends no token and you get no alerts; you can turn them on later in the app’s Settings.
• Location. With your permission, the app reads your device location while you are using the app (foreground only, never in the background) and sends it to our servers so we can alert you when a camera near you detects aurora. The reading is a precise one: we need it accurate enough to place your alert pin on the right side of a valley. We keep your last reported position and derive a regional grid cell from it (a geohash roughly 20 kilometres across at Icelandic latitudes), which is what alerts are initially matched against before an exact distance check. Location permission is optional. If you do not give it, or if your phone shares only an approximate location, you can place the pin on the map yourself. We store that point in the same way.
• Service-area check (on your device only). AuroraFinder’s cameras are all in Iceland, so the app checks whether your current position falls inside Iceland and pauses alerts if not. This check runs entirely on your device, and the position it reads is never sent to us or to anyone else. When the check finds you outside Iceland, the app switches your alerts off in its settings on our server. When you return, it switches them on again, unless you had switched them off yourself. That on/off setting is all we receive.
• Pseudonymous device identifier. A random identifier created when the app first registers. It is not derived from your identity and is not linked to a name or email address. It links your registration, alert pin and delivery records, so we treat it as personal data.
• App settings. Your device platform (iOS/Android), chosen language, notification and mute preferences, and, if you redeem an access key, the key redemption and resulting access tier.
• Delivery records. For each alert we send: your device identifier, the issuer of your access key, the camera, the time, the delivery result, your distance from the camera, and the regional grid cell. They have no field for your push token.

The app does not collect your name, email address, phone number, contacts, photos, or any advertising identifier. It contains no advertising and no analytics or tracking SDKs. If you email us, we receive your email address and what you write.

02How we use the data, and why we may

We process this data on the basis of legitimate interests (GDPR Article 6(1)(f)): yours, in receiving the aurora alerts you ask for, and ours, in providing a reliable and secure service. We use the data:

• to send you push notifications when aurora activity is detected near your pin;
• to show you nearby detection activity inside the app;
• to check that alerts are delivered, find and fix faults, prevent abuse, and improve the service (delivery records and server logs);
• to answer your emails, and to handle privacy requests as the law requires (Article 6(1)(c)).

You can object to this processing at any time (see section 06). The simplest way is Forget me in the app. We do not sell your data, share it for advertising, or use it for any purpose other than providing the AuroraFinder service.

03Where the data is stored and who processes it

Our databases, delivery records, camera images and database backups are stored on Amazon Web Services (AWS) in the European Union (eu-west-1, Ireland). These service providers process data for us or alongside us:

• Amazon Web Services: hosting, storage and push dispatch. Its CloudFront network delivers the website and app content and processes IP addresses to do so.
• Apple (APNs) and Google (Firebase Cloud Messaging): receive your push token and the alert text to deliver notifications to your device.
• Google Maps: shows the maps in the app. Google’s map software collects technical data such as your IP address, device model and system version, crash reports, a Maps-specific identifier and map interactions. Google processes this as an independent controller under its privacy policy.

Apple and Google can process data outside the European Economic Area, including in the United States. They state that they protect such transfers with the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Contact us for details.

04How long we keep it

• Your registration is kept while your device is registered. When you use Forget me, we delete your push token, your location, your settings and your access tier at once. Only a deletion marker (the device identifier and the time of the request) is kept for 30 days, so the deletion stays final if the request is repeated or an old copy of the app returns; AWS usually removes expired records within a few days of that.
• Database backups keep a rolling 35-day history, used only to recover from data loss. A deleted record can therefore stay in a backup for up to 35 days after its deletion.
• Delivery records are kept for 60 days and then deleted.
• Server logs about app requests and alert delivery are kept for 14 days.
• Emails are kept while we need them to answer you, and then deleted, unless we must keep a record for a complaint or a legal claim.

05Deleting your data

You can delete your registration from Settings → Forget me at any time, with no account and no email. The periods in section 04 then apply. Uninstalling the app stops new data collection, but does not delete the registration on our server; use Forget me first. Forget me does not delete your delivery records. To have them deleted, email us. They contain no name or contact details, so we may ask you for information that helps us find them.

06Your rights

If you are in the European Economic Area, the GDPR gives you the right to access, correct, delete, or receive a copy of your personal data, and to restrict its processing. You also have the right to object to processing based on legitimate interests, as all processing in section 02 is. To exercise these rights, contact us at the address below. We normally answer within one month. You also have the right to lodge a complaint with a supervisory authority; in Iceland, the Data Protection Authority (Persónuvernd).

07Cameras and images

Our cameras photograph the sky with long exposures to detect northern lights. The edge of a view can include some ground. The detection analyses light and colour; it does not identify people. The camera owner can draw areas that the detection ignores, and can choose to have those areas blacked out in every image the camera saves from then on. Setup frames, which the owner uses to aim the camera, are not blacked out; each one replaces the one before, and the last is deleted after one day.

We use the images to detect and show aurora activity, to check the detection, and to keep a long-term aurora archive. Selected images and timelapses can be shown in the app or shared by the camera owner. Detection images are kept in the archive with no fixed end date. Preview, timelapse and in-app copies are kept for up to 9 days (the latest preview of a camera is replaced by each new capture), and diagnostic copies for up to 30 days.

If you think a camera image shows you, or you operate a camera site, email us with the camera, the place and the approximate time. We will delete the images concerned, or tell you why we cannot.

08The website

The aurorafinder.is landing page does not set cookies, does not use analytics, and does not require an account. Standard technical logs (IP address, requested page) may be processed by our hosting provider (AWS CloudFront) to serve and secure the site.

09Children

AuroraFinder is not directed at children under 13, and we do not knowingly collect personal data from them.

10Changes to this policy

If we change this policy, we will post the updated version on this page with a new effective date. Material changes (for example, new categories of data) will also be announced in the app.

11Contact

Data controller: Óttar Guðmundsson
Hulduland 10, 108 Reykjavík, Iceland
Questions or requests about your data: contact@aurorafinder.is