Aura App Privacy Policy Last updated: October 16, 2026
Your privacy and the security of your health data are our absolute priority. This Privacy Policy explains how the Aura app ("Application") collects, processes, and protects your data. It is written in a clear and simple manner so you know exactly what happens to your information.
For anything concerning your personal data and privacy, write to gnash.contact@gmail.com. We have not appointed a Data Protection Officer — there is no obligation to do so at this scale of processing — so the contact point is the Controller.
Account Data You start the Application as a Guest — without providing any contact details. A Guest account is anonymous: it has no email address and no password. If you decide to secure your entries and use them on another device, you can create a full account from the profile settings — at that point you provide an email address and a password, and your existing entries are preserved under the same account identifier. You may optionally provide a first name so the Application can address you by it. We never store your password in plaintext — only its cryptographic hash, which is unreadable to anyone, including us.
Your account is a single account across the apps published by this developer. If you use another of our apps with the same account, your email address and first name are shared with it, while each app keeps its own entries separately. Deleting the account removes the account itself, so you will no longer be able to sign in to any of those apps — the Application lists the ones concerned before you confirm. See section 7 for what that deletion does and does not remove.
We also store a timestamp of your last launch of the Application. It serves one purpose only: establishing whether an anonymous Guest account has been abandoned (see the section on Guest accounts). We do not use it to analyse your behaviour or how often you use the Application.
Health Data (Article 9 GDPR) We collect the health information you enter into the diary yourself:
the occurrence, duration and intensity of a headache episode on the VAS scale, the character of the pain, anatomical locations and the pain zones you mark on the head and neck figure, accompanying symptoms, triggers, sleep context and stress level, acute medications taken, their doses and your rating of their effectiveness, the impact of the episode on your daily functioning. The Application has no free-text notes field and does not collect descriptions in your own words.
Legal basis: we process this data exclusively on the basis of your explicit, voluntary consent, granted on the first launch of the Application (Article 9(2)(a) GDPR).
Proof of Consent We record the granting and withdrawal of your consent to health-data processing in a consent register — this is required so that we can demonstrate GDPR compliance. The record contains the account identifier, the type and version of the consent, and the dates it was granted and withdrawn. It contains none of your diary entries and no email address. This is pseudonymised, not anonymous data: on its own it does not identify you, but it remains linked to an account identifier — including after that account is deleted. We keep the record for no longer than 6 years from the withdrawal of consent or the deletion of the account — for the period necessary to demonstrate that the processing was lawful and to defend against possible claims.
Legal Bases for Processing What we process Why Legal basis Health data from the diary keeping the diary, statistics, the report for your doctor your explicit consent — Article 9(2)(a) GDPR Account identifier, email address, first name maintaining the account and providing the service performance of a contract — Article 6(1)(b) GDPR Last-launch timestamp establishing whether an anonymous account has been abandoned the storage-limitation obligation — Article 6(1)(c) read with Article 5(1)(e) GDPR, and our legitimate interest in not keeping data nobody owns — Article 6(1)(f) GDPR Proof of consent granted and withdrawn demonstrating lawfulness and defending against claims legal obligation — Article 6(1)(c) read with Article 7(1) GDPR, and Article 6(1)(f) GDPR Account identifier passed to the subscription processor verifying Aura PRO entitlements performance of a contract — Article 6(1)(b) GDPR The content of your message when you report a problem answering it and diagnosing the fault our legitimate interest — Article 6(1)(f) GDPR We do not take decisions about you based solely on automated processing and we do not carry out profiling (Article 22 GDPR).
Security and Encryption We protect the data you entrust to us in several layers:
Column-level encryption: the names of the medications you take are cryptographically encrypted at rest (Transparent Column Encryption). They remain unreadable even in a direct dump of the database. Infrastructure encryption: the entire database and its backups are encrypted at rest by our infrastructure provider. Account isolation (Row Level Security): every entry is bound to your account at the database level. No other user has any technical means of reading or changing your data. Transport encryption: connections between the Application and the server run exclusively over an encrypted channel (HTTPS/TLS). There is no way for data to travel over an unencrypted connection. Administrative access: access to the infrastructure is limited to the Data Controller. We do not look at your entries and have no interest in doing so, but we state plainly that apart from the encrypted medication names your data is not protected by field-level encryption. 5. No Tracking and No Data Selling No analytics tools: the Application contains no external behaviour-tracking tools (Google Analytics, Firebase Crashlytics, Amplitude, Mixpanel and the like). We do not monitor what you click. Bundled fonts: every typeface used in the Application and in PDF reports ships inside the installation package itself. The Application does not fetch them from external servers, so your IP address never reaches a font provider and the PDF report works with no internet connection. Connectivity checks: to determine whether you are online, the Application queries our own server only. We use no third-party service for this. No selling: we never sell your personal or health data — not to any third party, advertising company or pharmaceutical corporation. 6. Who do we share data with? (Data Recipients) For the Application to function and synchronize your entries, we use the services of strictly selected and trusted partners acting as data processors:
Supabase Pte. Ltd. (registered in Singapore): our cloud infrastructure and database provider. Your data is stored on servers in Frankfurt am Main (Germany, EEA) and is not moved outside the EEA in the ordinary operation of the Application. Because the provider itself is established outside the EEA, access from a third country for technical support cannot be ruled out — such a transfer is covered by a data processing agreement containing the Standard Contractual Clauses approved by the European Commission, together with supplementary measures (encryption at rest and in transit). RevenueCat (USA): the processor handling subscription verification (Aura PRO). It receives a pseudonymous account identifier from us — the same identifier under which we store your entries, but with no access whatsoever to their content. RevenueCat does not receive your entries, medication names, pain locations or any health data. It does not receive your email address either. The transfer is covered by a data processing agreement with Standard Contractual Clauses. Apple and Google (app stores): if you buy Aura PRO, the transaction is handled by Apple (App Store) or Google (Google Play) respectively. For payments, invoices, refunds and subscription management these companies act as independent controllers of your data under their own privacy policies, not as our processors. We receive none of your payment data — we never see your card number or billing details. 7. Account Deletion and Backups You have full control over your data. You can delete your account at any time, directly in the Application settings.
What happens after account deletion?
Immediate deletion: your account and all entries are irreversibly removed from our main database the moment you confirm. Our other apps: because the account is shared, deleting it also ends your access to this developer's other apps. Entries those apps stored under the account are not removed by this operation — they stay in their own records, where you can no longer reach them. If you want them gone as well, say so in an email to us and we will delete them: your right to erasure covers everything we hold, not only Aura. Subscription service: we also delete your customer record at our subscription processor (RevenueCat), together with its purchase history. Important — deleting your account does not cancel an active subscription. You cancel the subscription yourself in your Google Play or Apple ID settings. If you do not, charges continue even though your Aura account no longer exists. Backups: for infrastructure security reasons we create regular backups. Deleted data may remain in these encrypted backups for a maximum of 30 days, after which it is automatically overwritten. The only thing left in the system is the pseudonymised proof of consent described above. Guest accounts and inactivity A Guest account is anonymous: it has no email address and no password, so nobody - including us - can ever sign in to it again once you stop using the Application on your device.
Switching to another account: If you are using a Guest account and sign in to a different account, the entries from the guest session are permanently deleted at that moment. The Application warns you about this before you confirm, and merely opening the sign-in screen deletes nothing - if you change your mind, you keep everything. If you want to keep those entries, create an account from the guest session instead - your entries are preserved and the account keeps the same identifier. Inactivity: A Guest account that shows no activity for 12 consecutive months is deleted automatically, together with all its entries. Activity means opening the Application or adding or editing an entry - for this purpose we store a timestamp of your last launch. We apply this rule because data that nobody can reach, correct or request a copy of should not be kept indefinitely. This rule applies only to anonymous Guest accounts. An account with an email address is never deleted for inactivity, because it belongs to someone who can sign in and exercise their rights over it. 8. Your Rights Under the GDPR you have the right to:
withdraw your consent at any time — this means the account is deleted, because Aura cannot work without processing your entries; withdrawal does not affect the lawfulness of processing carried out before it, access your data and receive a free copy of it (Article 15), rectify your data (Article 16), erase your data — the "right to be forgotten" (Article 17), restrict processing (Article 18), data portability — receive your data in a structured, machine-readable format and move it to another service (Article 20), object to processing based on our legitimate interest — this covers the last-launch timestamp and the handling of your support messages, not the diary entries, which we process on the basis of consent (Article 21), lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority where you habitually reside. You will receive a copy of your data — including every diary entry — free of charge after sending a request to our email address. We prepare it in a structured, machine-readable format (CSV or JSON) so that you can move it to another service, and we answer within one month at the latest. The PDF report available in the Application is a clinical summary prepared for a doctor and is not a substitute for that copy.
You exercise these rights through the options in the Application or by writing to gnash.contact@gmail.com.
Children's Privacy The Aura application processes health data and is not intended for persons under 16 years of age. We do not knowingly collect personal data from children. If you are a parent or legal guardian and you learn that your child has provided us with their data, please contact us. Such data will be immediately removed from our systems.
Changes to the Privacy Policy We reserve the right to update this Privacy Policy as the Application evolves or legal regulations change. We will inform you of any significant changes by updating the "Last updated" date at the top of this document or through a message in the Application.