Privacy Policy

This policy applies to the AURA apps and to joinauranow.com. It explains what Aura collects, why, who it is shared with, and the control you have over it. It describes what the product actually does — if something here does not match your experience, treat that as a bug and tell us.

The short version. We collect what is needed to run an account, a social feed, live video and a wallet. We do not sell your personal data. You can delete your account yourself, at any time, and it is permanent.

Who is responsible

The controller for the personal data described here, under the General Data Protection Regulation (GDPR), is:

AURA Future Ventures UG (haftungsbeschränkt)
Graseggerstr. 2
50737 Köln
Germany

Further company details are on the Imprint page. The fastest way to reach us about your data is Support, in Settings, or support@joinauranow.com.

What we collect

• Your account. Name, username, email address, password (stored only as a hash), date of birth, language, profile photo and the preferences you set. The date of birth is collected because Aura is for adults, and the rule is checked again every time that date is changed.
• Your profile. Your bio and anything else you choose to add — gender, city, country, interests — shown to the people you choose.
• Income, if you give it. An annual income: one of six preset brackets from $10,000 up to $5,000,000, or an exact amount you type in. The sign-up step can be skipped, and skipping stores nothing. It is a profile field like your city and shows on your profile; you can change or clear it at any time in Edit profile, and Settings → Privacy controls who can see it.
• What you post. Posts, stories, comments, messages, live streams, the rooms and live sessions you join, the media in all of them, and the gifts you send and receive.
• Your wallet. Your balance, purchases, gifts sent and received and the transaction history, the cryptocurrency deposit addresses you are issued, and the withdrawal address you provide.
• Location, only if you allow it. Approximate or precise location, and only to place you on Live World and for distance-based discovery. Your exact coordinates are never shown to other people.
• Camera, microphone and photos. Only while you are using a feature that needs them — calls, live video, voice messages, choosing media to upload — and only after your browser or phone has asked you and you have agreed. We do not access them in the background.
• Your device and usage. Device type and model, operating system and app version, language, IP address, crash and error logs, and a push token; and an approximate region — the country or city, never a precise location — used for localisation and for spotting abuse. We use these to deliver notifications, keep the service secure and diagnose faults.
• Support. What you write to us and the conversation history, so we can answer you.

What we do not do

• We do not sell personal data, and we do not share it for advertising.
• We do not use your content to build advertising profiles.
• We do not access your camera, microphone or location when you are not using a feature that needs them.

Why we use it, and on what legal basis

• To run the service you signed up for — your profile, the feed, messages, rooms, live, the games and the wallet. Legal basis: performance of a contract, Art. 6(1)(b).
• To keep people safe — acting on reports, blocking, moderating content, detecting fraud and abuse, keeping accounts secure and the product reliable. Legal basis: our legitimate interests in a safe platform, Art. 6(1)(f).
• To meet obligations we cannot opt out of — keeping records of financial transactions, enforcing the eighteen-and-over rule and answering lawful requests. Legal basis: legal obligation, Art. 6(1)(c).
• For anything your device asks you about first — location, camera, microphone, photos and push notifications. Legal basis: your consent, Art. 6(1)(a), which you can withdraw at any time in your browser or phone settings.

Who else sees it

It reaches other parties only in these ways, and a provider receives only what it needs to do its job for us:

• Other people on Aura, to the extent you chose — a public post is public, a private account's posts are seen only by approved followers, and a message is between you and the person you sent it to.
• Providers that run the service for us. Our servers are operated by Hetzner Online GmbH in Germany. Cloudflare, Inc. sits in front of the site as a content delivery network and security layer, which means traffic passes through servers outside the EU; Cloudflare is engaged under the European Commission's Standard Contractual Clauses. AURA's own real-time servers in Germany carry the audio and video of calls, live sessions and battles.
• Google and Apple, when you use them: Sign in with Google, Firebase Cloud Messaging for push notifications, Google Play Billing for purchases in the Android app, and the App Store for purchases in the iOS app.
• Authorities, where the law requires it or to protect someone's safety — and in the case of content involving a child, without waiting to be asked.

Purchases

Purchases made in the iOS or Android app go through Apple's or Google's payment system, and their refund policies apply. Purchases made on the website are handled by us. We never store payment card details on our servers. We keep transaction records for as long as tax and accounting law requires, even after an account is closed.

How long we keep it

• Stories expire by themselves after 48 hours.
• Your account and its content stay while the account exists. Deleting your account removes your profile, posts, stories and messages, and your personal details are removed immediately. It cannot be undone.
• Financial records outlive the account, because German law requires us to keep them.
• Logs are kept for a short period for security and diagnostics, then discarded.
• Reports and enforcement records are kept as long as they are needed to keep the same problem from returning.

Your rights and controls

• Delete your account in Settings → Delete account. It is self-service, immediate and permanent; how to delete your account walks through it. Spend or withdraw any balance you still hold first: a deleted account and its balance cannot be recovered.
• Control visibility — Settings → Privacy lets you make your account private and decide who sees each part of your profile.
• Block and report — available on profiles, posts, comments, messages and live sessions.
• Withdraw a permission — turn off location, camera, microphone, photos or notifications in your device settings at any time.

Under the GDPR you can also ask us to:

• Show you the personal data we hold about you (Art. 15).
• Correct anything wrong (Art. 16).
• Delete it (Art. 17) — Settings does this directly.
• Restrict how we use it (Art. 18).
• Hand it over in a portable form (Art. 20).
• Object to a use we base on legitimate interests (Art. 21), and withdraw a consent you gave (Art. 7(3)), which does not affect what we did before you withdrew it.

Write to Support in Settings or to support@joinauranow.com and say which one you want; we answer within 30 days. You also have the right to complain to a data protection supervisory authority in the EU country where you live, work, or where you think something went wrong (Art. 77).

Cookies

Signing in sets two cookies, and both are strictly necessary: one keeps you signed in for fifteen minutes, the other renews it for up to thirty days. Both are HttpOnly, Secure and SameSite=Lax, which means JavaScript on the page cannot read them and another site cannot send them. We set no advertising cookies. There is more in the Cookie Policy.

Aura is for adults

You must be 18 or older to have an account, and we ask for your date of birth at sign-up. We do not knowingly collect data from anyone younger, and an account we find belongs to a minor is closed and its data deleted. If you believe a minor is using Aura, report the account in the app or write to us.

International transfers

Aura is available internationally, and your information may be processed in countries other than your own. Where that happens outside the EU we use appropriate safeguards, such as the Standard Contractual Clauses named above.

Security

Traffic is encrypted in transit. Passwords are stored only as hashes and are never recoverable in plain text. No service can promise perfect security, so please use a strong, unique password.

Changes to this policy

When something here changes, we update the date at the top; when it changes materially, we announce it in the app before it takes effect.