Aurora is a mission-based alarm clock app published by Baptiste Leiva EI, trading as BAL Digital, a French sole proprietorship (micro-entreprise) registered in France under SIREN number [SIREN], with its registered office at [FULL ADDRESS].
For any question about this policy or your data: [CONTACT EMAIL].
Baptiste Leiva EI is the controller of your personal data within the meaning of the General Data Protection Regulation (GDPR).
The essentials in six points
- Aurora shows no advertising, sells no data and uses no advertising tracking or behavioural analytics tools.
- Your onboarding answers, alarms and preferences stay on your iPhone. They are not sent to our servers.
- An account is only required for the subscription and to back up your wake-up history.
- The camera works live: no video is recorded, either on your phone or anywhere else.
- Sky and movement recognition is performed on your iPhone, without sending any image.
- You can delete your account and all associated data directly from the application.
1. Data processed, purposes and legal bases
1.1 Data that stays on your device
The following information is saved in the application’s local storage, on your iPhone:
- your first name or nickname;
- your onboarding answers: age range, gender, what delays your getting up, how you feel at bedtime and on waking, your number of alarms, your usual wake-up time, your goal and your target time;
- your alarms: time, repeat days, mission, difficulty, ringtone;
- your wake-up history and your daily resolutions;
- your preferences: language, light or dark theme, default ringtone.
Purpose: to run the application, personalise your experience and display your statistics.
Legal basis: performance of the contract, that is, providing the service you requested (Article 6(1)(b) GDPR).
This data is not shared with the publisher. It is erased if you uninstall the application.
1.2 User account
If you create an account, the following data is processed by our service provider Firebase (Google):
- your email address and an encrypted password, or the identifier provided by Sign in with Apple or Sign in with Google;
- a unique technical identifier (UID), the account creation date and the date of your last sign-in.
If you use Sign in with Apple, you can choose to hide your email address: we then receive a relay address generated by Apple and never have access to your real address.
Purpose: to create your account, authenticate you, link your subscription and back up your history.
Legal basis: performance of the contract.
1.3 Backup of your wake-up history
When you are signed in, the history of your validated wake-ups (date, time, mission completed, any resolution) is saved in the Firestore database under your account identifier.
Purpose: to let you find your statistics again and switch devices without losing your progress.
Legal basis: performance of the contract.
1.4 Aurora Pro subscription
Subscriptions are managed through RevenueCat, which receives a subscriber identifier, your subscription status and the transaction information provided by Apple.
We never have access to your card number or your Apple credentials: payment is handled entirely by Apple.
Purpose: to activate subscription features and manage free trials, renewals, purchase restoration and fraud prevention.
Legal basis: performance of the contract.
1.5 Notifications
There are two types of notifications:
- Alarms and mission reminders are scheduled locally on your iPhone. No data leaves the device.
- The free-trial ending reminder, if you turn it on, requires us to store a notification token linked to your account on our servers. This token cannot be used to identify you outside the application. It is deleted when you sign out or delete your account.
Legal basis: performance of the contract for alarms; your consent for the trial-ending reminder, which you can withdraw at any time in your iPhone settings.
1.6 Camera and photos
The camera is only used during the missions that need it, and only when you start them:
- Push-ups, squats and plank: posture analysis is performed live on your iPhone using Apple’s Vision technology. No image is saved or transmitted.
- Sky photo: the photo is taken with the camera, analysed on your iPhone by Vision to check that it really shows the sky, then displayed for you to confirm. It is not sent to any server.
- Photo library access: the application does not access your photo library. Only shots taken during the mission are accepted.
Legal basis: performance of the contract, after you grant camera access in iOS, which you can withdraw at any time in Settings → Aurora.
1.7 Technical data
Our service providers keep technical logs (IP address, date and time of requests, error type) that are necessary for the security and proper operation of the service, in particular to limit abuse.
Legal basis: our legitimate interest in ensuring the security and stability of the service (Article 6(1)(f) GDPR).
1.8 What we do not do
Aurora contains no advertising network, no third-party trackers and no behavioural audience measurement tools. We do not sell, rent or exchange any personal data. No automated decision producing legal effects is made on the basis of your data.
2. Recipients and processors
| Provider | Role | Data concerned |
|---|---|---|
| Apple | App distribution, subscription payments, Sign in with Apple | Transaction, Apple identifier or relay address |
| Google (Firebase) | Authentication, database, server functions, hosting | Account, wake-up history, technical logs |
| RevenueCat | Subscription management | Subscriber identifier, subscription status, transactions |
| Expo | Delivery of trial-ending notifications | Notification token |
| OpenAI | Bed photo analysis, if this feature is enabled | Photo sent for analysis |
These providers act on our instructions, under data processing agreements that comply with Article 28 GDPR. We may also have to disclose data to an administrative or judicial authority when required by law.
3. Transfers outside the European Union
Server functions and the database are configured on infrastructure located in the European Union. Some providers (Apple, Google, RevenueCat, Expo, OpenAI) are established in the United States or may process data there. These transfers are governed by the European Commission’s Standard Contractual Clauses or by the EU–US Data Privacy Framework.
4. Retention periods
- Local data: until the application is uninstalled or the data is deleted from the settings.
- Account and online history: for as long as your account exists. Everything is deleted when you delete your account.
- Notification token: until you sign out, turn off the reminder or delete your account.
- Subscription data: for the duration of the subscription, then for the legal retention period for accounting records, i.e. ten years.
- Technical logs: twelve months at most.
5. Security
Exchanges with our servers are encrypted in transit (HTTPS). Access to the database is restricted by security rules: each account can only access its own data. Access keys for paid services are never present in the application installed on your phone.
Data saved on your iPhone benefits from the operating system’s protection, but is not additionally encrypted by the application. We recommend protecting your phone with a passcode, Face ID or Touch ID.
6. Your rights
Under the GDPR, you have the right to access, rectify and erase your data, to restrict and object to its processing, and to data portability, as well as the right to withdraw your consent at any time for processing based on consent.
- Immediate deletion: Settings → Account → Delete account, in the application. Your account, your online history and your notification token are erased.
- For any other right: write to [CONTACT EMAIL]. We reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.
Deleting your account does not cancel your subscription: it is managed from your Apple account settings.
7. Minors
Aurora is not intended for children under 15. If you are under 15, using the application and creating an account require the consent of the person with parental authority. If we learn that an account has been created by a child under 15 without this consent, we will delete it.
8. Changes to this policy
This policy may change as the application evolves. The date of the last update appears at the top of this page. In the event of a significant change, in particular the addition of a new category of data or a new recipient, you will be informed in the application before the change takes effect.