Privacy Policy — AuraCast Weather

UPDATED   Last updated: September 03, 2026  ·  Effective: September 03, 2026  ·  App: com.auracast.weather

Contact: support@auracast.app  ·  Website: auracast-weather.web.app  ·  Full description: Features

1. Information We Do Not Collect

• No sign-up or login — we do not collect your name, email, address, or phone number.
• No contacts, calendar, photos, or files.
• No precise background location tracking — only coarse foreground location when you grant permission, and you can use manual city search instead.

2. Location

When you grant location permission, the app uses Google Play Services FusedLocationProviderClient (coarse accuracy) only to fetch weather forecasts (Open-Meteo + NWS) and radar tiles (RainViewer + NWS / OSM via osmdroid) for your area. The coordinates are sent to those weather-data providers to return your forecast — they are not sold and not used by us for profiling. You may deny permission at any time and use manual city search; the app remains fully functional.

Android permissions used: ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION (requested but coarse is sufficient; both are declared for compatibility), INTERNET, ACCESS_NETWORK_STATE, POST_NOTIFICATIONS, RECEIVE_BOOT_COMPLETED.

3. Advertising (Google AdMob) — free tier only

AuraCast Weather monetizes the free tier with Google Mobile Ads SDK (AdMob) 23.6.0:

• Formats: one adaptive anchored banner (bottom of Home) and one interstitial (shown only at natural transition points, e.g. after generating an AI report, capped to max once per session with a 3-minute minimum gap to protect retention). Paying subscribers (AuraCast Plus) never load or display ads — the ad composable is not rendered and no ad network call is made.
• What AdMob may collect: per Google's own SDK, AdMob may collect the Google Advertising ID, IP address, device model/OS version, approximate location (if consented), and ad-interaction data to serve, measure, and (where consented) personalize ads, and to combat fraud. See Google's Advertising Privacy and AdMob Data Disclosure.
• App ID & ad units: the production AdMob App ID and ad unit IDs are injected at build time from secure storage (local local.properties on developer machines — gitignored — and GitHub Secrets in CI). They are never hardcoded in source control and never logged. Debug builds always use Google's public test IDs (ca-app-pub-3940256099942544/…) to avoid invalid-traffic policy strikes — no real impression is billed in debug.
• Consent: where required by law (EEA/UK, California, etc.), consent is collected before any ad request via Google's User Messaging Platform (UMP) SDK. If you decline or select non-personalized ads, the SDK signals that choice to AdMob. You can reset your Advertising ID and opt out of personalization at any time: Android Settings → Privacy → Ads (or Privacy → Ads → Reset/Delete Advertising ID on Android 13+), and via the in-app consent dialog where shown. Google Ads Settings · My Ad Center.
• Children: the app is not directed to children under 13; we do not implement child-directed treatment. If you are a parent and believe your child has provided data, contact us to remove it.

We do not sell your Advertising ID. AdMob's use of data is governed by Google's Privacy Policy and the AdMob Privacy & Messaging guidance.

4. Crash & Performance (Firebase)

To keep the app stable fast, we use Firebase Crashlytics, Performance Monitoring, Analytics (anonymous), and Cloud Messaging (FCM) for severe-weather alerts.

• What is collected: device model, OS version, app version, crash stack traces, performance traces, an anonymous Firebase Installation ID, and diagnostic custom keys: ai_engine_used, location_source, tts_offline, active_locale. No name or email is tied to this data.
• Why: to fix crashes, measure cold-start and network performance, and count anonymous feature usage.
• Opt-out: you can disable usage & diagnostics collection via Android Settings → Privacy → Usage & diagnostics; deleting the app removes the Installation ID. No opt-in is required beyond installing the app.

See Firebase Privacy and Google Privacy Policy. Firebase data is retained only as long as needed for diagnostics (Crashlytics 90 days for mappings/breadcrumbs, Performance per Firebase defaults).

5. On-Device AI & Translation (no cloud AI)

Weather-report generation (Gemma 4 via LiteRT-LM / AICore, Phase 5) and translation (ML Kit, Phase 7) run entirely on-device. Forecast numbers are fed into the local model on your phone; they are not sent to a cloud AI service for inference. Translation packs download once over the network, then work offline. No report text is uploaded by the app.

Note: ML Kit model management and AICore may use standard Google Play Services telemetry (e.g., model-download success) per Google's privacy policy — not your weather content.

6. Purchases (AuraCast Plus — ad-free subscription)

Ad-free access is sold as an auto-renewing subscription via Google Play Billing Library 9.1. Transaction processing, receipts, and subscription lifecycle are handled entirely by Google Play. The app stores only the resulting entitlement state (isAdFree: Boolean) locally via DataStore/Room to gate ad display — no card data is handled or stored by us. Use Play's Restore Purchases to sync entitlement after reinstalls or device changes. See Google Play Privacy.

7. Third-Party Services & Data Processors

8. Data Retention & Security

• Location: processed in memory per request; not stored server-side by us (we operate no backend for weather — fetches go directly to Open-Meteo/NWS/RainViewer).
• Ads: banner/interstitial impressions are logged by Google per their retention policy; we retain no ad logs locally.
• Diagnostics: per Firebase defaults; stack traces are automatically pruned.
• Security: all network calls use HTTPS. AdMob app/ad unit IDs are stored only in local.properties (gitignored) and GitHub Secrets for CI — they are never committed to git and never embedded as strings outside the build-time BuildConfig/manifest placeholders. See repository hygiene (workflow verifies no real IDs are tracked).

9. Your Rights (GDPR / CCPA / Other)

Depending on your region you may have rights to access, delete, or object to processing. Because we operate no account backend, most requests are exercised on-device or via platform controls:

• Ads: via UMP consent dialog (re-prompt on app data clear) + Settings → Privacy → Ads + adssettings.google.com. California users may choose "Do Not Sell/Share" — selecting non-personalized ads signals that choice to Google.
• Analytics/diagnostics: uninstall the app or disable usage & diagnostics in Android system settings.
• Location: revoke location permission at any time (Android Settings → Apps → AuraCast Weather → Permissions) and use manual city search.

To exercise any remaining right, email support@auracast.app with your device model and approximate install date; we will respond within 30 days.

10. Data Safety (Play Console) — How This Policy Maps to the Form

The Play Console Data Safety form (Phase 12) is completed consistently with this policy:

All sensitive flows are encrypted in transit (HTTPS). Data is not sold. Users can revoke location/consent as described above.

11. International Transfers

Weather-data fetches, Firebase, and AdMob may process data on Google's global infrastructure per their policies. By using the app you understand data may be processed outside your country where privacy laws may differ.

12. Changes to This Policy

We may update this policy to reflect new data flows. The "Last updated" date at the top will change, and the previous version will remain linked from the website history. Material changes will be noted in the app's release notes on Play.

13. Contact

Questions or requests: support@auracast.app. We aim to reply within 5 business days. This policy is hosted at a stable URL https://auracast-weather.web.app/privacy.html as required for Play Console; the footer of the marketing site links here permanently.