Privacy Policy

Who we are

Auroracast (auroracast.co.uk) is a free aurora forecasting and community service for the UK and Ireland. The site is operated by a private individual, not a company.

What data we collect

User accounts

If you create an account, we store: your email address, a hashed (bcrypt) version of your password, never the password itself, your chosen display name, username, and optionally a bio, website URL, and avatar image. Your email address is never shown publicly. Your username and display name are public.

We also ask for your date of birth when you sign up. This is used only to confirm you meet our minimum age of 16; it is stored against your account, is never shown publicly, and is not used for any other purpose. See our Child Safety statement for more.

Signing in with Google

If you choose "Continue with Google", Google sends us your name, email address, and profile picture so we can create or sign you into your account. We do not receive your Google password or any other information from your Google account. Your use of Google sign-in is also governed by Google's own privacy policy.

Email alerts

If you subscribe to email aurora alerts, we store your email address, your chosen Hp30 threshold and which kinds of alert you have switched on. We use this solely to send the alerts you chose. Each alert email contains an unsubscribe link that permanently removes your address from our database. We do not use your email for marketing or share it with any third party.

Session cookie

When you log in, we set an aurora_session httpOnly cookie containing a signed session token. This cookie is used only to authenticate your requests to the site. It cannot be read by JavaScript and expires after 30 days or when you log out. See our Cookie Policy for full details.

Community content

Posts you publish to the community wall, reactions you give, and comments you write are stored in our database and, unless set to friends-only, are publicly visible. Your display name and avatar are shown alongside your posts. Do not include sensitive personal information in community posts.

Aurora sighting reports

If you submit a sighting report, we store: your optional display name, the coordinates of the sighting rounded to about a kilometre, so a report from your garden never publishes your house, your description, intensity rating, the time of the sighting, and any photo you upload. We also record the Hp30 level and the cloud cover at that place and time. Sightings are public. Do not include personal information in your description that you would not wish to be public.

We also use sighting reports to check our own substorm predictions against what people actually saw. That check only ever counts how many sightings fell in each whole degree of latitude, for example how many were reported between 55 and 56 degrees north. It does not use your name, your account, your description, your photo, or your exact coordinates.

Private messages

Messages sent between users are stored in our database and are only accessible to the sender and recipient. We do not read private messages except where required by law or to investigate a serious abuse report.

Location data

Several pages can use your location, either from your device through the browser Geolocation API or from a town you search for. Your coordinates are sent to our server to fetch local weather, cloud cover, darkness times and ISS passes, and are cached for up to 30 minutes to reduce external API calls. If you are signed in, the location you set is saved to your account, so it follows you to your other devices. You can clear it in Settings. If you are not signed in, it is kept only in your browser.

Push notification subscriptions

If you enable browser push alerts, your browser generates a push subscription endpoint, and the Android app generates a device token. We store these, with your alert level and which kinds of alert you switched on, to deliver notifications. If you were signed in when you turned alerts on, the subscription is linked to your account so your settings follow you. You can unsubscribe at any time from Settings, which deletes the subscription from our database immediately.

Server logs

Our web server records standard access logs (IP address, browser type, pages visited, timestamps). These are used solely for diagnosing errors and are retained for a maximum of 30 days.

What we do not collect

• We do not use advertising or tracking cookies
• We do not use Google Analytics or any third-party analytics service
• We do not sell or share personal data with third parties
• We do not store passwords in plain text, only bcrypt hashes

Third-party services

Auroracast fetches data from the following external services. Most are server-side only and your browser never contacts them directly:

• GFZ Potsdam: Hp30 geomagnetic index (server-side only)
• NOAA Space Weather Prediction Center: solar wind, X-ray and GOES magnetometer data (server-side only)
• NASA CCMC (DONKI): coronal mass ejection alerts (server-side only)
• INTERMAGNET: ground magnetometer data, used under CC BY-NC 4.0 (server-side only)
• Finnish Meteorological Institute: Nurmijärvi real time magnetometer data, used under CC BY 4.0 (server-side only)
• Open-Meteo: weather and cloud cover data (server-side only)
• Nominatim / OpenStreetMap: place name search when you set your location (your browser contacts this service directly)
• wheretheiss.at: ISS position data (your browser contacts this service directly)
• Swedish Institute of Space Physics: Kiruna magnetometer data (server-side only)
• DTU Space, through Tromsø Geophysical Observatory: Hov magnetometer data, used with permission for non-commercial use (server-side only)
• Windy: the cloud map on the Cloud Cover page (loaded in your browser from windy.com)
• Google Firebase Cloud Messaging: delivers notifications to the Android app (server-side only)

Data retention

• User accounts: retained until you delete your account or request deletion
• Email alert subscriptions: retained until you unsubscribe via the link in any alert email
• Session cookies: expire after 30 days or on logout
• Community posts: retained until you delete them or request removal
• Sighting reports: retained indefinitely as part of the community record; contact us to request removal
• Private messages: retained until deleted by both parties or on account deletion
• Push subscriptions: retained until you unsubscribe or the browser subscription expires
• Weather / location cache: purged automatically after 30 minutes
• Server logs: purged after 30 days

Your rights

Under UK GDPR you have the right to access, correct, or delete personal data we hold about you. To delete your account and associated data, go to Settings → Delete Account. To request removal of a specific sighting or post, or for any other privacy enquiry, contact us at the address below.

Contact

For privacy questions: admin@auroracast.co.uk