Privacy policy
Aura is built so that how you feel stays yours. This policy explains what we collect, why, who helps us run the service, how long we keep things and how you stay in control.
1. Who we are
Aura is published by AKVega, the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023. Questions, requests and complaints go to our Grievance Officer, Kalyan Kumar Bedugam, at akprojects1431@gmail.com (see Support).
2. What we collect and why
| Data | Why | Notes |
|---|---|---|
| Email address | To sign you in and keep your Aura on a new phone; to confirm deletion requests | We don't ask for your name, phone number or a password. If you sign in with Google (on Android) we keep only the email and account identifier, never your name or picture. |
| Date of birth | To confirm you are 13 or older and to apply extra, invisible protections for people under 18 | Never shown to anyone, including other people in rooms. |
| Mood check-ins (mood, tags, day and time) | The core of the app: your sky, streaks, patterns and room matching | We treat moods as sensitive health-related data. Never used for advertising. |
| Notes, voice notes, capsule text and photos | So you can write, record and seal things for yourself | Encrypted with a key that belongs to your account. Photos have location and camera details removed. Only you can read or play them. |
| Room activity: gestures, reflections, reports | To run rooms, Breath Ripples and Quiet Together, and to keep them safe | Other people see a fresh name for you in each room, never your account, email or age. Reflections are short and are checked for safety before they appear. |
| App activity: habits, calm sessions, notification settings, keepsakes | To make features work and remember your choices | Content-free records such as "a 3-minute breathing session". |
| Purchases (only if you buy something) | Aura 1.0 is free and has nothing to buy. If paid extras are added, we record what you bought so you keep it | Payments are handled by the App Store or Google Play; we never see your card. |
| Device identifiers | A random install ID to keep banned devices out, and a push token if you allow notifications | No advertising ID. No location permission. |
Improving safety checks. When a room reflection is reviewed, we may keep a de-identified copy of its words, with only its language, the moderation outcome and the week, to improve our safety checks. It has no link to you, your account, the room or the reflection. Crisis-related text and anything with contact details is never kept. You can turn this off at any time in Settings.
Some things never leave your phone: the crisis word checks on what you type, Look back, the Aura Sky patterns and what you do inside calm activities.
3. What we don't do
- We don't sell your data, share it with advertisers, or show ads.
- We don't use your moods, notes or voice to train AI models.
- We don't run analytics that track you across other apps or sites.
- We don't send notes, reflections, capsule content or your date of birth to analytics or logs.
4. Who helps us run Aura
These service providers process data only on our instructions, under contract, and only for the purpose shown:
- Supabase (database, storage and sign-in) and Render (our servers).
- OpenAI: automated safety checks on short room reflections, with no data retention for training. Private notes are never sent.
- Google Firebase Cloud Messaging and Apple Push Notification service: to deliver notifications you turned on. Notifications never say how you feel.
- Google: Sign in with Google on Android, if you choose it. Google Play and the App Store handle payments if you ever buy something.
- Google Firebase Hosting: this website, and the calming sound files the app downloads once when you choose to. Like any web host it sees your IP address and which file was fetched; we don't link that to your account.
- Our email provider: sign-in codes and service emails.
Some providers may process data outside India. When they do, we rely on contractual safeguards and only transfer data where the law allows.
5. How long we keep data
- While your account exists, we keep your data so the app works.
- When you delete your account, you have 7 days to change your mind. After that, your personal data, including check-ins, notes, voice, capsules, photos, habits, room activity, keys and your date of birth, is permanently deleted, always within 30 days of your request.
- Some records are kept longer only where the law requires: purchase and tax records (without the link to your account), and evidence about reported content kept for up to 180 days for safety and legal reasons.
- Rooms become read-only memories after a day and are removed after 7 days.
6. Your rights and choices
You can download a copy of your data from the app (Settings → Account → Download a copy of my data) as a readable page and as JSON and CSV files. You can see and edit your check-ins in the app, turn notifications and features on or off in Settings, and delete your account at any time (Settings → Account → Delete my account, or on the web). You may also ask us for a summary of your data, a correction, deletion, or to name someone to act for you. Write to the Grievance Officer; we acknowledge within 24 hours and resolve within 7 days. You may also complain to the Data Protection Board of India.
7. Young people
Aura is for people aged 13 and older. We block sign-ups under 13, and people under 18 get extra, invisible protections: stricter moderation and no analytics. If you believe someone under 13 is using Aura, tell us at akprojects1431@gmail.com. See our child safety standards.
8. Security
Data is encrypted in transit, private content is encrypted at rest with per-account keys, the app's local database is encrypted, and staff access is limited, logged and protected with two-factor sign-in.
9. Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect. The date at the top shows the current version.