Privacy Policy

No personal identity. We do not collect your name, email address, phone number, contacts, photos or payment details, and Boreal has no user accounts. Everything described below is keyed to your device or to a random identifier, not to you. We cannot identify you from it, and we make no attempt to.

Information collected through the App. If you use the App, we collect the following information:

• Geolocation information. We request permission to access your location while you are using the App, in order to provide a forecast for where you are. The App asks for your approximate location by default and needs accuracy of about a kilometre at most. Background access is off unless you turn on “Follow me as I travel” in the App’s settings: the App then asks for “always” access so that, when you move a significant distance, it can update the place your alerts are sent for. You can turn this off in the App at any time, and change our access or permissions in your device’s settings.
• Push notifications. If you choose to receive aurora alerts, we store your device’s push notification token together with your location and its place name, time zone, language, alert preferences and whether you have an active subscription or pass, so that we can notify you when the aurora is likely visible where you are. We also keep a record of the notifications we have sent to your device. If you wish to opt out, you may turn notifications off in the App or in your device’s settings.
• Mobile device access. The Aurora Finder feature requests permission to use your camera and motion sensors to display an augmented-reality overlay. Camera images are shown on your screen only; they are never recorded, saved or uploaded.
• Purchase information. Subscriptions and passes are processed by Apple. We receive confirmation of what you purchased and when, so that the App can be unlocked. For a pass, our servers store Apple’s transaction number together with whether and when you started the pass, so that it survives reinstalling the App or changing phone; the App also keeps a copy in your iCloud account if iCloud is turned on. We never receive your name, billing address or card details.

Information collected automatically. Some information is collected automatically when you use the App. This information does not reveal your specific identity but may include a randomly generated installation identifier, your device model, operating system version, App version, language, time zone, screen size, the screens you view and the controls you tap, the places you select, crash reports, and any campaign parameters contained in a link you used to open the App. If you enable notifications, your device’s push notification token is attached to this information so that we can match it to our alert delivery records. Our analytics provider also receives your IP address in the course of transmission and may derive an approximate location from it. Our own servers use your IP address to limit the rate of requests, and record it, together with the details sent, each time your device registers for notifications. This information is needed to maintain the security and operation of the Services and for our internal analytics.

Information collected through the Site. The Site is a static informational website. It does not set cookies, use analytics or collect information through forms. Our hosting provider processes your IP address in order to deliver the pages to you; we do not keep access logs for the Site.

We use the information we collect for the following purposes. We indicate the specific legal ground we rely on next to each purpose:

• To provide your aurora forecast for your location (Contractual; Consent via your device’s location permission).
• To send you aurora alerts and daily forecasts for your location, if you have enabled them (Contractual; Consent via your device’s notification permission).
• To unlock and manage your subscription or pass (Contractual).
• To send you occasional service notifications, if you have enabled notifications: for example when it has been quiet where you are for some weeks, or when your subscription or pass has ended and a strong aurora is expected (Legitimate Interests). You can stop these by turning notifications off.
• To protect our Services, including rate limiting and abuse prevention (Legitimate Interests).
• For analytics and improvement, such as identifying usage trends, diagnosing crashes and evaluating which features and campaigns are effective (Legitimate Interests).

We do not use your information to send marketing emails, and we do not use it for advertising, profiling, or to identify you. We could not send you an email even if we wanted to: we do not have your address.

We may process or share your information in the following situations:

• Vendors and service providers. We share information with third-party vendors who perform services on our behalf and require access to it to do that work, such as hosting and analytics. They may only use your information as instructed by us.
• Apple. Push notifications, purchases, maps, geocoding, Siri and Apple Watch connectivity are provided by Apple under Apple’s own privacy policy.
• Legal obligations. We may disclose your information where we are legally required to do so in order to comply with applicable law, a court order or legal process.
• Business transfers. We may share or transfer your information in connection with a merger, sale or acquisition of all or a portion of our business, in which case this policy will continue to apply.

We do not share, sell, rent or trade any of your information with third parties for their promotional purposes.

We have categorised each party so that you can easily understand the purpose of our data collection and processing practices:

• Apple Inc. — App Store purchases, push notification delivery, Apple Maps, geocoding, Siri and Watch Connectivity.
• PostHog Inc. (EU cloud) — App analytics and crash reporting.
• Railway Corp. — Hosting of our forecast and notification servers, which are located in the European Union.
• Amazon Web Services — Hosting and delivery of the Site.

The public space-weather, geomagnetic and cloud data behind the forecast is retrieved by our servers without any personal information: cloud forecasts are requested for coordinates rounded to a grid of roughly 11 km, with nothing that identifies you or your device. Your device does not contact those data providers itself.

The Site does not use cookies, web beacons, pixels or similar tracking technologies. The App does not use Apple’s advertising identifier, does not display the App Tracking Transparency prompt because it does not track you across other apps or websites, and does not share data with advertising networks. For App Store install attribution we rely only on Apple’s SKAdNetwork, which provides aggregate, anonymous data.

Our forecast and notification servers and our analytics data are located in the European Union. Where your information is transferred to a service provider outside the European Economic Area, such as Apple in the United States, the transfer is protected by an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework where the recipient is certified) or by the European Commission’s Standard Contractual Clauses. You may request a copy of the safeguards by contacting us.

• Forecast requests are processed in memory and are not stored.
• Notification data, including the record of notifications sent, is kept for as long as your device is registered for alerts. When you delete the App or turn off notifications for Boreal in your device settings, Apple reports the token as invalid and we delete the record. You may also ask us to delete it at any time.
• Registration records, which include your IP address, are deleted after 30 days.
• Pass records (Apple’s transaction number and when the pass was started) are kept so that the pass can be restored, until you ask us to delete them.
• Analytics data is kept until you object or ask us to delete it.
• Information stored on your device is removed when you delete the App.

We have implemented appropriate technical and organisational security measures designed to protect the security of any personal information we process, including encryption of data in transit, authenticated and rate-limited access to our servers, and limiting what we log. However, please remember that no method of transmission over the internet or electronic storage is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk.

The Services are not directed at children under 13, or under the age at which a child can consent to data processing in their country. If we learn that personal information from such a child has been collected, we will delete it. If you become aware of any data we may have collected from a child, please contact us at moc.liamg@iksokivrih.rimisak.

In some regions (like the European Economic Area and the United Kingdom), you have certain rights under applicable data protection laws. These may include the right (i) to request access to and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, and (iv) to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information, including our analytics. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by changing the location, notification or camera permission in your device’s settings. Please note that this will not affect the lawfulness of the processing before its withdrawal.

If you are a resident of the European Economic Area and believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. Our supervisory authority is the Office of the Data Protection Ombudsman of Finland (tietosuoja.fi).

United States residents. We do not sell or share personal information for cross-context behavioural advertising. Residents of California and other states with similar laws may request access to, deletion of or correction of their personal information by contacting us, and will not be discriminated against for doing so.

Alerts are generated automatically from forecast data, but we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

We may update this privacy policy from time to time. The updated version will be indicated by the effective date at the top of this page. If we make material changes, we will notify you in the App or on the Site. We encourage you to review this policy frequently to be informed of how we are protecting your information.

If you have questions or comments about this policy, you may email us at moc.liamg@iksokivrih.rimisak or write to us at:

Kasimir Hirvikoski
PL 13, 00561 Helsinki, Finland

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To do so, please email moc.liamg@iksokivrih.rimisak. Because Boreal has no accounts, we need the App’s own identifiers to find your records: open Settings in the App, tap “Send diagnostics” and send us the file it creates. We will respond to your request within 30 days.