Who is responsible
Havilah Works Oy is the controller for personal data we process to provide Aurora Signal. For privacy questions or requests to exercise your rights, email support@havilahworks.com.
Locations and saved places
If you choose “Use my location” and grant permission, the app obtains your device’s foreground location to select a local outlook. You can choose a place manually instead. The app does not use background location tracking to follow you as you move.
Coordinates of the place you check are sent to our services to obtain relevant forecasts and map information. These may be your current coordinates or those of a manually selected place. Our services use external sources, including MET Norway for weather. Map requests also reveal the area you are viewing to the map provider.
Saved places, onboarding choices and preferences are stored on your device. The app also caches weather for up to eight recently checked places; forecasts saved within the previous 24 hours may be shown, with a saved-data label, when a refresh fails. Removing a saved place is separate from removing a server-side alert for that place.
Installation identifiers and subscriptions
The app uses persistent installation identifiers and securely stored credentials to recognize an installation and protect access to its alert settings. Our service stores a digest of the alert credential rather than the original credential. A derived identifier links that installation to RevenueCat for subscription validation.
If you use paid features, Apple or Google handles the purchase. RevenueCat processes an app-user identifier, purchase and transaction information, subscription status and relevant app/device information to validate access, restore purchases and support subscription management. We do not receive your full payment-card details from the store.
Sky alerts and notifications
When you enable an alert, our service stores the watched coordinates, alert settings and schedule, installation identifier, device platform, permission status and push notification token. This lets the service check the selected place while the app is closed. It does not track your changing location.
Notifications are delivered using Expo and the device platform’s push service, such as Apple Push Notification service or Firebase Cloud Messaging. The notification token and message contents are passed to those providers for delivery. Notification text may identify the watched place and may appear on your lock screen, depending on your settings.
Pause or remove watches in Saved → Sky alerts. You can also disable notifications in device settings. Disabling permission or uninstalling the app does not itself erase all records already held by our services.
Technical requests, support and sharing
Our hosting and service providers receive technical information needed to deliver and secure requests, such as IP addresses, request times and device or browser information. We use Cloudflare to host app services and data. Such information may be processed to prevent abuse, diagnose failures and operate the service.
If you contact support, we receive your email address, message and information you choose to send. Avoid including unnecessary sensitive information. When you choose a photo to share, the app processes it on your device and reads available capture-time, temperature and location metadata to prepare the image. It may use weather already available for the selected place when the photo’s location and time match. The app does not upload your selected photo to our servers or Amplitude. The image you share may include the selected place or coordinates, temperature and capture time; the recipient and sharing service receive the content you send.
The current app disables Mapbox’s optional telemetry. Mapbox still receives network requests and the map areas needed to deliver maps. The current app does not include advertising or cross-app advertising tracking.
Product analytics
We use Amplitude’s EU service to understand the main app flows: onboarding, subscription paywalls, sky-alert actions and map-mode choices. Events include a random device identifier and the same pseudonymous app-user identifier used by RevenueCat, allowing us to link app activity to subscription activity. Events also include event times, app and operating-system information, language, and the feature that opened a paywall. Purchase events may include product identifiers and purchase or restore outcomes.
We do not include your photos, place names, coordinates, notification contents or payment receipts in these analytics events. Automatic interaction capture, advertising identifiers, location collection and IP-address enrichment are disabled. Analytics is separate from the weather, map and alert requests described above.
Why we process data
We process information necessary to provide requested forecasts, saved-place functionality, purchases and subscription access to perform our agreement with you. Optional access to device location and notifications is based on your permission; where consent is required, you may withdraw it in device settings without affecting earlier lawful processing.
We rely on legitimate interests to secure our services, prevent misuse, diagnose delivery problems, understand and improve the main app flows through limited product analytics, and answer general support requests, taking your rights into account. Records may also be processed where necessary to comply with legal obligations. You do not have to provide location permission or enable notifications; the corresponding optional features will be unavailable if you decline.
Service providers and international processing
Relevant providers include Cloudflare for infrastructure, Mapbox for app maps, RevenueCat for subscriptions, Amplitude for product analytics in its EU data region, Expo for push delivery, and Apple and Google for stores and platform services. Weather and aurora data are supplied by MET Norway and NOAA. Their roles and the information they receive depend on the feature you use.
Some providers process information outside the European Economic Area, including in the United States. Where data-protection law requires safeguards for a transfer, applicable mechanisms include adequacy decisions or approved contractual safeguards. Contact us for information about the safeguards applicable to your data. Providers may also process certain data independently under their own privacy notices.
How long information is kept
Local saved places and preferences remain until you remove them or clear the app’s local data. Device backups or secure operating-system storage may retain information separately, so uninstalling is not a guarantee that every identifier or backup is erased.
Alert settings and device registration records are stored to operate and manage your watches. Removing a watch stops that watch; related delivery, security and subscription records may remain. Settled alert-delivery diagnostics become eligible for automated cleanup 30 days after both their expiry and last update; pending delivery receipts and limited cleanup batches may delay deletion.
Product analytics records are retained to understand usage and improve the app, subject to our analytics project’s retention settings and applicable erasure requests. Other service and support records are retained according to their operational purpose, the need to resolve requests or disputes, and applicable legal obligations. Subscription providers and app stores apply their own applicable retention requirements. Contact us to request erasure or ask about a particular record; we will explain any lawful reason information must be retained.
Your choices and rights
Depending on the law that applies, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. These rights may be subject to legal conditions. We do not use the app’s forecasts to make decisions producing legal or similarly significant effects about you.
Email support@havilahworks.com to make a request. We may need proportionate information to verify and locate your installation’s records. Do not send passwords, installation credentials or payment-card details. We will respond within the period required by applicable law, normally one month for GDPR requests, and explain any permitted extension.
You may complain to a competent data-protection authority. In Finland, this is the Office of the Data Protection Ombudsman. You may also contact the authority where you live or work where applicable.
Children and policy updates
Aurora Signal is not designed to collect information specifically from children. Where parental permission is required for a child’s use or optional data processing, a parent or guardian should manage that permission. Contact us if you believe a child has provided information that should be removed.
We may update this policy to reflect changes in the app or applicable requirements. The date below identifies this version. We will provide additional notice or request consent for changes where legally required.