Aurora Alarm Privacy Policy
Last updated: October 11, 2026
Controller: White Hat Mgmt LLC
Summary
Alarms, settings, and the PIN of Aurora Alarm are stored locally and encrypted. The app does not require an account and White Hat Mgmt LLC does not incorporate its own analytics. Some optional or ad‑funded features do transmit the minimal data described below: advertising, weather, and voluntarily sent reports.
1. Data stored on the device
Aurora Alarm stores on the device:
- the time, label, repeat, tone, volume, snooze and challenge of each alarm;
- preferences such as theme, time format and security options;
- if the user enables it, a cryptographic hash of the PIN; the clear PIN is not stored;
- calendar events that are read for “My Day” are shown only locally and are not sent to our servers nor to the weather provider.
Alarms and preferences are encrypted with AES-256-GCM. The key is generated on the device and stored in Android Keystore or iOS Keychain. The data is kept in the app’s private storage and excluded from automatic backups and device‑to‑device transfers.
2. Data transmitted and purposes
Google AdMob advertising
The free version contains Google AdMob. According to Google’s documentation, its SDK may process the IP address, product interactions, diagnostic information and device or advertising identifiers to display ads, measure them and prevent fraud. The processing depends on the platform, device settings and available consent decisions. More information:
https://developers.google.com/admob/android/privacy/play-data-disclosure.
Optional weather from MET Norway
Only when weather is enabled and location is granted, Aurora sends via HTTPS to MET Norway an approximate coordinate rounded to two decimals (a zone, not the exact location). The request also exposes the provider to the IP address due to normal Internet operation. It is used solely to obtain the forecast and does not contain alarms, calendar or PIN. Aurora keeps a temporary in‑memory cache to reduce requests. Provider terms and privacy: https://api.met.no/doc/TermsOfService and
https://www.met.no/en/About-us/privacy.
Aurora passes that same rounded coordinate to the native geocoder of the system (Apple or Google, depending on the phone) to receive only the country and choose the usual temperature scale. It does not store the address, the country, or a location history. If the country is unavailable, it uses Celsius.
Voluntary problem reporting
If the user chooses to send a report from the app, the following are transmitted via HTTPS: the category, the user‑written text, the Aurora version, the operating system and the language. Alarms and the PIN are not attached. Users should avoid including sensitive data in the free‑form text. Our server uses a non‑reversible fingerprint of the IP for up to one hour to limit abuse, and forwards the message to the Resend email service for handling. Resend policy:
https://resend.com/legal/privacy-policy.
Purchases
The purchase to remove ads is processed by Google Play or the App Store. Aurora receives the necessary status to enable the feature, but White Hat Mgmt LLC does not directly receive or store the user’s card number.
3. Data Aurora does not request for its own features
- No Aurora account is created.
- We do not ask for name, phone or email to use the alarms.
- We do not access camera, microphone, photos, contacts or external storage.
- We do not incorporate our own behavior analytics.
- We do not send alarms, PIN, preferences or calendar events to our servers, to AdMob, to MET Norway or to Resend.
4. System permissions
| Permission | Purpose |
|---|---|
| Exact alarms | Make an alarm sound at the set time |
| Notifications and full‑screen | Notify and display the alarm over the lock screen |
| Foreground service, audio and activation lock | Play the tone while the alarm is sounding |
| Device boot | Reschedule alarms after a restart |
| Vibration and motion sensors | Vibrate and execute the shake challenge |
| Notification policy | Allow the alarm to sound with Do Not Disturb if the user authorizes it |
| Biometrics / Face ID | Unlock the app when the user enables it |
| Internet | Advertising, optional weather and voluntary report sending |
| Approximate location | Obtain weather only when the user activates that feature |
| Calendar read | Show locally the next event when “My Day” is active |
On Android, approximate location is requested, not precise location. On iOS the app requests reduced accuracy by default, though the user retains control in the system settings.
5. Retention, security and deletion
The user can delete local data from Settings → Security & privacy → Delete all my data, or by uninstalling