Privacy

Last updated: 4 September 2026 · Deutsche Fassung

In short

• No AuraCurve account, no advertising, no tracking and no analytics SDKs.
• Recorded rides and received group positions stay on your device.
• For routing, search, traffic, weather, maps and the live group you switch on yourself, the app processes the data required for that request over the network.
• The optional AuraReplay unlock transmits a proof of purchase and, after you confirm it, links it to the email address you provide at AuraReplay.

Controller

Codex Consulting GmbH, Bahnhofstrasse 21, 6300 Zug, Switzerland.
Contact: see the legal notice.

Route planner on this website

Route: Waypoints you set and your routing settings are sent to our routing server for calculation. With “Secure the tour”, a simplified route outline is transmitted in order to find fuel stations along the way.

Address search: The search text you enter is transmitted to our server and resolved there against our own place database.

Map and sharing: Map tiles come from our own service. A shared plan is held in the fragment of the link; that fragment is not sent to the server when the page is requested.

Network features of the app

• Routing and recalculation: Start, intermediate stops, destination, settings and — on a recalculation — your current position are sent to router.aurora-run.com. For a curvy round trip suggestion, the starting point is rounded to about 0.01 degrees beforehand.
• Destination search and place names: On iOS, Apple processes the search text and the spatial search context. In addition, the start and end coordinates of a saved ride are passed to Apple's geocoder there so that the ride can carry place names in its title. On Android, search text and search context go to our geocoding service at router.aurora-run.com.
• Traffic: While navigation is active, the app requests reports for a rectangular area around the route corridor roughly once a minute. Our server rounds that area to a 0.05 degree grid and queries TomTom with it. TomTom sees the IP address of our server, not that of your device. Responses stay in memory for at most 60 seconds. For abuse rate limiting, your IP address stays in memory for at most one hour; the request path and the area are not logged by the application.
• Weather on iOS: When a ride finishes, the app may fetch weather data for a location rounded to 0.1 degrees. The request first goes to our weather relay at Cloudflare, which forwards it to Open-Meteo; if that is unavailable, Apple WeatherKit may be used. No account identifier and no ride history are sent along.
• Maps and offline packages: Map tiles and the regions you select are loaded through our Cloudflare services. As with any internet connection, this technically involves processing the IP address.
• Recordings: Rides, measurements, waypoints and exports stay on the device until you share or delete them yourself.

Live group

The live group is off by default. You switch it on per ride and can leave at any time. What is then transmitted is your precise position, the time of measurement and — where available — speed and heading. Added to that are the short name and the colour you chose yourself. The creator additionally transmits the destination and its display name as well as a route simplified to at most 160 points.

The recipients are the participants of the same group. Access works through the six-digit code, QR code or link that was passed on. There is no account and no persistent device identifier.

The relay at gruppe.auracurve.app keeps the last position, the destination and the simplified route in memory only. The group ends after inactivity, and after twelve hours at the latest. Join attempts are rate limited per IP address in volatile memory for about one minute. Group processing is technically pinned to Cloudflare's EU jurisdiction.

Received positions can be stored locally together with your ride so that the shared ride can be replayed later. They disappear when you delete the ride.

The legal basis is your consent (Art. 6(1)(a) GDPR). Leaving the group withdraws it with effect for the future and ends the transmission.

AuraReplay unlock

Only if you start the unlock does AuraCurve send a receipt signed by Apple, or on Android the Google Play purchase token, together with product and platform details to aurareplay.app. There you confirm your email address in the browser. AuraReplay links it to the purchase; AuraCurve polls the short-lived pairing status and can display the linked address. The QR scanner processes the camera image only in order to read the code. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). Details and deletion periods are set out in the AuraReplay privacy policy.

Storage, logs and service providers

Routing, search, traffic and weather content is not combined into a user profile. The routing server keeps no general access log. Technical error logs may contain the IP address and the path and are deleted after 14 days at the latest. Our application services write no group positions, weather coordinates or traffic areas into content logs.

• Hetzner (Finland/EU): routing, Android search, fuel stations and traffic.
• Cloudflare: website, maps, offline packages, live group, weather relay and AuraReplay infrastructure.
• TomTom: traffic reports for the rounded area.
• Open-Meteo and Apple: weather; Apple additionally iOS destination search and place name resolution.

These providers process technical connection data under their own terms. The required agreements are in place with our processors.

Permissions and backups

Location serves navigation, recording and — once activated — the live group; motion sensors serve ride data, the camera serves the QR code, and notifications serve visible background operation. Device backups by Apple or Google may contain local app data; you control that in your system settings.

Your rights

You have, in particular, the rights of access, rectification, erasure, restriction, data portability, objection and to lodge a complaint with a supervisory authority. You delete local rides in the app. For an AuraReplay record or any other request, contact us via the legal notice.

Language

This is a translation of the German original for convenience. In case of any discrepancy, the German version prevails.