Skip to content
Aura
Start free

Draft — needs legal review

This is template text. It has not been reviewed by a lawyer and is not yet in force.

Privacy Policy

Last updated: <YYYY-MM-DD>

1. Who we are

Aura (“Aura”, “we”, “us”) is a personal life diary for your finances, travel and career, operated by <Company legal name>, <Registered address>. We are the controller of the personal data described here. Questions about this policy go to privacy@example.com.

2. What we store

  • Account: your email address and a hashed password, managed by our authentication provider, plus the time you last signed in.
  • Profile: your name, an optional profile photo, country, currency, language, theme and week-start preference. Profile photos are stored at an unguessable public link, so anyone who has that exact link can open the image.
  • What you record: accounts, transactions, budgets, goals, loans, credit cards and investments (Finance); trips, stops and places (Travel); roles, compensation, skills, projects and résumés (Career). This can include sensitive information such as your income and where you have travelled. You decide what to enter.
  • Activity log: a history of changes to your Finance records, so you can see what was edited and when.
  • Your AI provider key, if you add one. It is encrypted before it is stored and is only decrypted on our server to make the requests you ask for.
  • Technical data: IP address, browser and request details, processed by our hosting provider to deliver and protect the service.

We do not use analytics or advertising trackers, and we do not build a profile of you for marketing.

3. How we use it

  • To run Aura for you: store your diary, calculate balances and totals, and show them back to you.
  • To keep your account secure, including one-time sign-in codes if you turn them on.
  • To send service emails: sign-up confirmation, sign-in codes, password resets and reminders before a subscription you track renews.
  • To meet legal obligations and respond to your requests.

We never sell your data, share it for advertising, or show you ads.

Legal bases (GDPR): performance of our contract with you; our legitimate interest in keeping the service secure; and your consent where we ask for it. <Confirm legal bases with counsel>

4. Who processes it for us

  • Supabase: database, authentication and file storage. Your data is stored in <region placeholder>.
  • Cloudflare: hosting and content delivery.
  • Resend: sending service emails.
  • Your AI provider, only if you add your own key(for example Google Gemini or an OpenAI-compatible service such as OpenRouter). When you use an AI feature, the text it needs (such as résumé content) is sent to the provider you chose, under that provider’s terms. Without a key, nothing is sent to any AI service.
  • Map and photo services used by Travel:your browser loads map tiles from OpenFreeMap, sends place searches to OpenStreetMap’s Nominatim and loads cover photos from Wikimedia Commons. They see your IP address and what you search for, not your diary.
  • Market data: to price investments, our server asks Yahoo Finance and mfapi.in for the ticker symbols you hold. No personal data is sent.

International transfers: <Describe transfer safeguards, e.g. Standard Contractual Clauses>

5. How long we keep it

We keep your data for as long as your account is open. Archived items stay until you restore or delete them. When you delete your account we delete your data within <N days>; encrypted backups roll off within <N days>.

6. Your rights: export and deletion

You can access, correct, export or delete your data, and object to or restrict how we use it. Most corrections you can make yourself in the app.

A self-serve export and one-click account deletion are coming soon. Until then, email privacy@example.comfrom your account’s address and we will send you a copy of your data, or delete your account, within <30 days>.

EU/UK (GDPR): you can also complain to your local data protection authority. <EU/UK representative, if required>

California (CCPA/CPRA): you have the right to know, delete and correct your personal information, and not to be discriminated against for using these rights. We do not sell or share personal information as those laws define it.

7. Cookies

Aura uses only cookies it needs to work. There are no analytics or advertising cookies.

  • Session cookies (sb-…): keep you signed in.
  • Sign-in and sign-up cookies: short-lived, hold a one-time code challenge or the email you are confirming.
  • aura-locale: remembers your language for one year.

Your theme choice is kept in your browser’s local storage, not in a cookie.

8. Security

Every request is encrypted in transit. Row-level security in the database means each row can only be read by its owner. AI keys are encrypted at rest, and you can add a one-time email code to your sign-in. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

9. Age requirement

Aura is not for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, contact us and we will delete it.

10. Changes and contact

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. Contact: privacy@example.com, <Company legal name>, <Registered address>.