Your data, in plain sight.

In short. Aura is personally operated by Francesco Vergani, not by a company. We use only the data needed to provide and protect the service. We do not sell personal data, serve behavioural advertising, or use IDFA. Background location alerts are proposed as enabled during onboarding, but require your action and the iOS “Always” permission; Analytics, crash diagnostics and performance measurement remain off until you allow them. You can withdraw consent, export your data and delete your account directly in the app.

1. Who is the controller

The controller is Francesco Vergani, an individual based in Cascina (Pisa), Italy, who personally creates and operates Aura rather than through a company (“Aura”, “I” or “we” are used for readability). You can contact the controller at privacy@theaura.space.

The controller determines the purposes and means of processing and personally handles administration, moderation, security, support and privacy requests. Aura’s status as an individually run and currently free project does not restrict data-subject rights or the controller’s duties. No Data Protection Officer has been appointed because the Article 37 GDPR criteria do not currently apply; this assessment will be revisited if the scale or nature of processing changes.

2. Scope and where data comes from

This notice covers the Aura iOS app, its APIs, theaura.space and the aura.spaces venue portal. We receive data directly from you, your device and your use of the service; from other users when they mention or interact with you or submit a report; from venue operators; and from the providers listed in section 6, for example when you use Sign in with Apple or receive a notification.

The public website requires no account, uses no advertising or analytics cookies, and stores only the language preference in the browser. Aura.spaces uses only technical session cookies needed for access and security. Apple independently processes some App Store and Apple Account data under its own privacy notice.

3. Data we process

Aura does not ask for biometric, health, criminal-offence or other special-category data. Do not place sensitive information about yourself or others in content unless strictly necessary and lawful. We may restrict or remove such content to protect people, comply with law or enforce service rules.

4. Why we process data and our legal bases

Data needed for an account, authentication or a requested feature must be provided to use that feature: without an email or Apple identifier we cannot create an account, without location proximity features do not work, and without a push token notifications cannot be delivered. Diagnostics and background location are optional; refusing them does not prevent use of other available features.

5. What others see and location risks

Your username, avatar, aura, non-anonymous content and associated activity may be visible to other users or space operators according to the feature and your choices. An anonymous post hides its author from other users but remains internally linked to the account for security and moderation. Nearby content shows a distance band rather than its exact private origin; a location you intentionally pin may be public.

Photos, text, times and place details may reveal identity, habits or movements even without coordinates. Do not publish home addresses, live movements or other people’s data without a valid basis. Someone who sees content may copy or share it before deletion; Aura cannot control those external copies.

6. Who may receive data

We share only what is necessary with:

• Other users and aura.spaces operators, according to the feature, visibility and user choices.
• IONOS SE (Germany), our Article 28 GDPR processor for the VPS, hosting, database and principal infrastructure in the European Union. Its data processing agreement covers instructions, confidentiality, security, subprocessors, assistance and deletion.
• Cloudflare, Inc. and affiliates, for DNS, network protection and delivery, CDN, media, private memories and R2 backups. Aura’s R2 buckets are restricted to the EU jurisdiction.
• Google Ireland Limited, Google LLC and affiliates, through Firebase Cloud Messaging and Remote Config for push tokens, delivery, installation identifiers and configuration; and, only after consent, Analytics, Crashlytics and Performance Monitoring.
• OpenAI Ireland Limited and affiliates, as processor, to classify through its API the text and images of public posts and avatars against safety categories. We do not intentionally send email addresses, usernames or coordinates, although user-supplied text and images may themselves contain personal data. API data is not used to train models unless a customer opts in; Aura does not opt in.
• Apple and relevant affiliates, for the App Store, Sign in with Apple and Apple Push Notification service. Apple may act as an independent controller for processing connected with the Apple Account, device and App Store.
• Scaleway SAS (France), for transactional verification, recovery and security email.
• Microsoft Ireland Operations Limited and affiliates, for support and privacy mailboxes.
• Professional advisers, authorities or parties to a service transaction, only when necessary and subject to appropriate safeguards.

Providers acting for the controller are bound by agreements or terms meeting Article 28 GDPR. We do not sell or license personal data to advertisers or data brokers and do not share it for behavioural advertising.

7. Processing and transfers outside the EEA

The principal IONOS server is in Germany and objects in Cloudflare R2 buckets are stored in the EU jurisdiction. Cloudflare nevertheless operates a global network, and Google/Firebase, OpenAI, Apple and Microsoft may process data or permit technical access outside the European Economic Area.

Where a third-country transfer occurs, we use the applicable mechanism: a European Commission adequacy decision, the EU-US Data Privacy Framework for certified entities, European Commission Standard Contractual Clauses and, where needed, supplementary measures and a transfer assessment. You may request information about applicable safeguards at privacy@theaura.space; portions may be redacted to protect security or confidential information.

8. How long we keep data

• Account, profile and content: for the life of the account and according to the relevant feature lifecycle. At expiry a post leaves the nearby feed, but remains read-only in its author’s personal history, in the history of users who commented on it, and in Paperclip for users who saved it before expiry. Removing the paperclip removes it from Paperclip; an expired post cannot be saved again. The author may delete it at any time, including after expiry; each participant may delete their own comments at any time, including from an expired post. Deletion makes the content unavailable in the active service, except for limited evidence already included in a report and retained under the moderation period below.
• Account deletion: the account becomes unavailable immediately and sessions are revoked. Deletion from active systems is scheduled after 30 days; completion may be delayed only as needed to finish credential or object revocation, resolve an incident, comply with law or defend a right.
• Real-time location: one point, replaced by the next and deleted when the feature is disabled or on logout, and in any event after 6 hours without an update.
• Proximity verification: claimed coordinates and anti-fraud records for up to 90 days.
• Sessions and codes: refresh tokens for up to 60 days unless revoked earlier; revoked tokens for up to 30 days; email verification and reset codes for about 15 minutes.
• Ordinary logs: up to 30 days. Specific security and abuse-prevention events: up to 12 months.
• Reports and moderation: up to 24 months after closure, unless needed for repeat abuse, disputes, authority requests or protection of people and rights.
• OpenAI moderation: Aura retains rejected content and moderation results under the period above. OpenAI’s current documentation states that the /v1/moderations endpoint retains neither abuse-monitoring logs nor application state and that API data is not used for training; strictly necessary legal or security exceptions may apply.
• Acceptance evidence: document versions and timestamps are kept for the relationship and up to 10 years after it ends, or longer only for an already pending dispute, with access limited to establishing and defending rights.
• Support and privacy requests: up to 24 months after closure, unless legal duties or disputes require longer.
• Aura.spaces: operational data for the relationship’s duration; access and security records as above; documents needed for obligations or disputes for the applicable statutory period.
• Encrypted backups: four weekly full database cycles and up to 35 days for memory copies. Deleted data may therefore remain isolated in backups until rotation; it is not restored to the active service except for disaster recovery and is then deleted again.
• Optional Firebase services: Analytics retains user- and event-level data for 14 months; non-identifying aggregate statistics may last longer. Crashlytics retains crash traces and associated identifiers for 90 days. Performance Monitoring retains IP-associated events for 30 days and installation-associated or de-identified performance data for 60 days before deletion begins.
• Necessary Firebase services: installation identifiers used by Cloud Messaging and Remote Config remain while required for that installation; after a deletion request, Google states that removal from live and backup systems may take up to 180 days.

At expiry we delete or anonymise data. We may keep a limited subset for longer only where law requires it or where necessary to establish, exercise or defend legal claims, with access restricted to that purpose.

9. Your choices and controls

• Manage location in iOS Settings. “While Using the App” supports proximity features; “Always” is optional and used for background alerts. You may refuse or limit that permission without losing the other available features.
• The real-time-alert preference is proposed as enabled during onboarding. The default value alone does not start processing: Aura requires you to choose “Continue and enable location” after the information screen and grant iOS “Always” permission. You can then disable alerts in Aura Settings; disabling them stops updates and removes the temporary location from the server.
• Analytics, Crashlytics and Performance start off. You may allow them during onboarding and withdraw at any time in Aura Settings. Withdrawal stops new collection and resets local Analytics data; for Crashlytics it takes full effect on the next launch. It does not affect the lawfulness of earlier processing.
• Manage push categories, sounds and permissions in Aura and iOS Settings. Turning notifications off does not delete your account.
• Use the content menu to delete your posts and comments at any time, including after a post expires. Aura.beam collection receipts are the exception and are managed together with the corresponding collection. You may also clear local cache, block users and submit reports.
• Download a machine-readable JSON copy in Settings and delete the account through Profile → Settings → Delete account. See the deletion guide.

10. Your GDPR rights

Where the conditions apply, you may obtain confirmation and access, correction, deletion, restriction, portability and a copy of your data; object to processing based on legitimate interests; and withdraw consent at any time. You may complain to a supervisory authority, particularly in the EU country where you live, work or believe the infringement occurred. In Italy this is the Garante per la protezione dei dati personali.

Email privacy@theaura.space. We normally respond within one month, extendable by two further months for complex requests as allowed by the GDPR, explaining the reasons. We may request only additional information reasonably needed to verify identity and ownership of the request. Requests are free unless manifestly unfounded or excessive, within the limits allowed by law.

11. Content ranking and automated decisions

Aura may rank or select content using factors such as distance, freshness, availability, space membership, aura and interactions. It may also automatically apply expiry, rate limits, technical fraud checks and OpenAI classification of public posts and avatars, which may prevent publication when a possible violation is detected. Automated results are probabilistic and can be reviewed by a person. These processes provide and protect the service and do not make decisions producing legal or similarly significant effects under Article 22 GDPR. Relevant moderation decisions may be challenged through support@theaura.space.

12. Adults-only service

Aura is intended only for people aged 18 or over and offers no parental-consent flow. The self-declared age check cannot stop someone who provides false information. If you believe a minor uses Aura, contact support@theaura.space without sending unrequested identity documents. After proportionate checks we will restrict the account and delete data, except what is strictly needed for law, safety or legal claims.

13. Security and data breaches

We use measures proportionate to risk, including TLS, encrypted backups, password hashing, short-lived and revocable tokens, network separation, restricted administrative access, rate limiting, event logging and deletion and recovery procedures. Internal administrative access is limited to the controller; providers may have strictly necessary technical access. No system can guarantee absolute security.

If a personal-data breach occurs, we will promptly assess its nature, scope, risk and containment and, where required, notify the Garante within 72 hours of becoming aware and affected people without undue delay. Report vulnerabilities or suspicious access to support@theaura.space without including unnecessary third-party data.

14. Legal requests, protection of people and Aura’s future

We may preserve, access or disclose data where reasonably necessary to comply with law or a binding request, cooperate with competent authorities, prevent serious and imminent harm, investigate fraud or abuse, or establish, exercise or defend legal claims. We assess jurisdiction, validity and proportionality and limit disclosure where possible.

Aura may in future be organised through a company, receive investment or transfer to another operator. This does not permit selling personal data as a product. Before any controller change we will limit due diligence, apply confidentiality and security, assess the legal basis and compatibility of purposes, notify users as required and obtain new consent where necessary. Applicable rights, including deletion, remain available before transfer.

15. Changes to this notice

We update this notice when the service, providers, organisation or law changes. We will always publish the version and effective date. For material changes we will provide suitable notice in the app or through available contact details before they take effect and seek new consent where required. No change retroactively makes incompatible processing lawful.

16. Contact

Francesco Vergani, individual — Cascina (Pisa), Italy
Privacy, rights requests and legal communications: privacy@theaura.space
Support, security and reports: support@theaura.space