Privacy policy

Who we are

Lumavik is published by Vast Flow, LLP, which operates the app and this website and is the data controller for the limited processing described below. You can reach us at [email protected] for any question about this policy, including a request to access or delete data.

The short version

The app has no user accounts and no login. It does not ask for your name, your email address or your date of birth, and there is nowhere for it to put them. Your saved locations, your settings and your history live on your device. If you enable aurora alerts, a small amount of data has to leave the device so a notification can reach you, and that is described precisely below. If you delete the app, everything stored on the device goes with it.

The website stores nothing you type. The free tools run entirely in your browser: the coordinates you enter into the geomagnetic latitude calculator or the tonight verdict are never transmitted to us, because the arithmetic happens on your machine.

What the app stores on your device

Saved locations, alert thresholds, display preferences and a cache of recent NOAA forecast data are stored in the app's own local storage. This information is not synced to a server of ours and is not backed up by us. It may be included in your own device backups if you have those enabled, in which case it is governed by Apple's terms rather than ours.

Location

The app asks for location access so it can score conditions where you are. You can refuse and enter coordinates or pick a place manually; the app works either way. When location is used only for an on-screen forecast, the coordinates stay on the device.

Alerts are the exception, because a push notification has to be decided somewhere the device is not. When you enable an alert for a location, the app sends that location to our alert relay after rounding it to half a degree. Half a degree is coarse on purpose: it is enough to compute geomagnetic latitude and darkness correctly and it is far too coarse to identify a home. We do not receive or store the place name you gave it, so the relay knows a rounded coordinate and a device push token and nothing else about you. Notification text is written generically for the same reason.

Push notifications

If you enable alerts, Apple issues a push token that identifies your app installation to the notification service. We store that token with the rounded coordinates and your alert threshold. Turning alerts off in the app, or deleting the app, causes the record to be removed; tokens that Apple reports as invalid are deleted automatically. We do not use push notifications for marketing.

Space weather data

Forecast data comes from the NOAA Space Weather Prediction Center. In most cases the app requests it directly from NOAA, which means NOAA's servers receive a request from your device's IP address in the ordinary way that any internet request works. We do not send NOAA anything about you, and NOAA does not know which of their users are Lumavik users. Their data is published in the public domain.

Purchases

Subscriptions are sold and processed by Apple. We never see your payment details. To know whether to unlock Pro features, the app uses RevenueCat, which processes an anonymous identifier and the receipt Apple issues. That tells us that a subscription exists and what state it is in. It does not tell us who you are, and we cannot link a subscription to a person.

Advertising

The free tier of the app shows a single banner advertisement on the home screen, served by Google Mobile Ads. It is configured as non-personalised, which means it is not targeted using a profile built from your behaviour, and the app does not present Apple's App Tracking Transparency prompt because it does not track you across apps or websites. Google may still process technical information such as approximate region, device type and IP address in order to deliver and measure an advertisement. A Pro subscription removes the banner entirely.

Analytics

The app contains no analytics SDK. There is no Firebase Analytics, no Crashlytics, no attribution SDK and no event tracking of what you tap. This is a deliberate choice and it costs us the ability to answer questions about how the app is used; we consider that a reasonable trade in a category where a location history would be sensitive.

This website is different, and you should know that. It loads Microsoft Clarity, which records aggregate usage of the site — pages viewed, approximate region, device and browser, and anonymised interaction patterns such as scroll depth. We use it to find pages that are broken or confusing. It is not linked to any app data, and it does not follow you to other sites. Clarity sets cookies in your browser and honours the Global Privacy Control signal where your browser sends one. If you would rather not be included, a content blocker or your browser's tracking protection will stop it, and the site works normally without it.

What we never collect

We do not collect your name, email address, contacts, photos, calendar, health data, advertising identifier for cross-app tracking, or a location history. We do not sell data, and we do not share it with data brokers. There is no mechanism in the app by which we could build a profile of an individual, because there is no account to attach one to.

Legal bases, for readers in the EEA and UK

Processing the rounded coordinate and push token for alerts is done on the basis of your consent, given when you enable alerts, and you can withdraw it at any time by turning alerts off. Processing purchase receipts is necessary to perform the contract you entered into when you subscribed. Non-personalised advertising and website analytics rest on our legitimate interest in funding and improving a free product, balanced against the fact that neither identifies you.

Retention

Alert records persist for as long as the alert is enabled. They are deleted when you disable alerts, when you delete the app, or automatically once Apple reports the push token as no longer valid. Purchase records are retained for as long as Apple's receipt validation requires. Website analytics are retained according to Microsoft Clarity's own retention schedule.

Your rights

Depending on where you live you may have the right to access, correct, delete or port your personal data, and to object to certain processing. Because we hold so little, most of these are satisfied by turning alerts off or deleting the app. If you want us to confirm what a rounded coordinate and token record contains, or to delete one, write to [email protected] from any address and tell us the approximate coordinates and when you enabled the alert, and we will find and remove the record. We will respond within thirty days.

Children

Lumavik is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has enabled alerts and you would like the record removed, contact us and we will delete it.

International transfers

Our alert relay runs on servers in Germany. Apple, Google and Microsoft process data in the regions described in their own policies, which may include the United States. Where personal data is transferred out of the EEA or the UK, it is done under the transfer mechanisms those providers publish.

Changes to this policy

If we change how data is handled we will update this page and change the date at the top. Material changes that affect data already collected will also be announced in the app. We will not retroactively broaden the use of data collected under an earlier version of this policy.

Cookies and similar technologies

The app uses no cookies; it is not a browser. On this website, the only cookies set are those used by Microsoft Clarity for the aggregate analytics described above. There is no advertising cookie on the website, no remarketing pixel, no social login and no embedded third-party widget that could set one. The free tools store nothing in your browser beyond what is needed to render the page you are on, so closing the tab discards everything you typed.

We honour the Global Privacy Control signal where your browser sends one, and a content blocker or your browser's built-in tracking protection will prevent the analytics script from loading at all. Everything on this site works normally without it, including every calculator.

If you are in California

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. The banner advertising in the free tier of the app is configured as non-personalised, which is the setting that avoids that category of sharing. You have the right to know what we hold, to request deletion, and not to be discriminated against for exercising either — and because there is no account, exercising them rarely requires more than deleting the app. Requests go to the address below.

Security

The alert relay accepts only what it needs — a rounded coordinate, a push token and a threshold — over an encrypted connection, and it holds no field that could identify a person on its own. There is no password to steal because there is no account, and there is no email address on file to leak. This is the main practical benefit of building without accounts, and it is a deliberate design decision rather than an oversight: a database that does not exist cannot be breached.

Contact

Questions, deletion requests and complaints all go to [email protected]. If you are in the EEA or the UK and you are not satisfied with our response, you have the right to complain to your national data protection authority.