Alexis Thomas

Aura · Legal

Aura Privacy Policy

Privacy Policy

Last updated: 14 October 2026.

This policy covers the Aura app ("Aura") for iPhone, iPad and Android. Aura is made by Alexis Thomas and published by Prismo Labs Ltd, Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole BH16 6FA, United Kingdom ("we"). For anything about your privacy, write to contact@alexisthomas.fr.

The short version: your journal lives on your device. There is no account. We never sell anything about you, and nothing you write is ever used for advertising or to train AI.


What stays on your device

Everything you put in Aura is stored only on your device: your pages (moods, feeling words, the things you tag and what you write), photos and voice notes, stickers, what the cats remember about you, letters, worries, reminders and settings. If you turn it on, voice notes are turned into words on your device itself. Photos and voice notes never leave your device, whatever your settings.

  • Backups you make are encrypted with a password only you know (XChaCha20-Poly1305, with a key derived using scrypt). We can't open them.
  • Your device's own backup (iCloud Backup, or Android's backup to your Google account) includes your Aura journal, as it does for other apps. That is between you and Apple or Google.
  • "Tear out every page" in Settings, or deleting the app, removes your journal from your device.

The cats' notes and the margin (optional)

With "Notes from the cats" turned on (Settings → Privacy; on by default), the page or line you write is sent to our server: its words, mood and tags, and the moods of your last few check-ins (never their words). With Aura Plus, and now and then without it when a cat writes back to a page as a little gift, our server asks Google's Gemini model to write the cats' note, question, letter, story or reply in the margin, and sends it back. If "Remember little things" is on, the things the cats know about you (kept on your device) go along so the reply fits, and in the margin, that day's pages and what the cat remembers of your last talk. Without Aura Plus, only the words are sent, to be checked for safety (below).

We don't store or log the text, and it is never used to train AI, by us or by Google. We use Google's paid Gemini API: under its terms, Google doesn't use what we send to improve its products, and may keep it for a limited time only to detect abuse and meet legal obligations. With "Notes from the cats" off, nothing you write leaves your device.

The same text is checked for signs that you might be at risk, so Aura can show helplines. On your device this uses simple word patterns; with "Notes from the cats" on, Gemini checks it too. Only the result is used, and nothing is kept.

Our server runs on Amazon Web Services in the United States. It keeps nothing about you or your install on disk. The only thing it stores is a running total of what the AI cost that day, for everyone together. To share the AI fairly, it counts requests per install's random identifier and per IP address in memory, for an hour (a few days for the free gift notes), and then forgets them. To check Aura Plus, it asks RevenueCat about your install's random identifier and remembers the answer in memory for a few minutes (up to a day if RevenueCat can't be reached).


Aura Plus (purchases)

Purchases are made through the App Store or Google Play. Apple or Google handle payment; we never see your card or account details. RevenueCat keeps track of whether your install has Aura Plus: it receives the store's receipts, a random install identifier, your device's vendor identifier, and this install's Google Analytics identifier, so it can report renewals and refunds to Google Analytics (below).


Analytics and crash reports (you can turn these off)

With "Help improve Aura" turned on (Settings → Privacy; on by default), we learn how Aura is used, never what is in it:

  • Google Analytics for Firebase receives anonymous usage events: which screens are opened; that a check-in was made (whether it had words, how many photos, whether it had a voice note, never the mood); whether a note was written online or offline; when the Aura Plus page is opened and from where; plans chosen and purchases; and campaign links you arrived from. It uses an app-instance identifier, not your name or advertising identifier, and Google's advertising features are turned off.
  • Sentry receives crash reports: the error, where in the code it happened, the app version and the device model. No screenshots, no content and no user identity.

Turn the switch off and neither is sent.

Aura has no ads and no advertising SDK. It does not use your device's advertising identifier and does not track you across other companies' apps or websites, so it never asks for permission to.


Apple Health and Health Connect (optional)

On iPhone, if you turn on "Save moods to Apple Health", each check-in's mood, feeling words and tags are saved to Apple Health as a "State of Mind". Never what you wrote.

If you turn on "Bring in sleep and steps", Aura reads two things: how long you slept and how many steps you took each day, from Apple Health on iPhone or from Health Connect on Android. On Android, Aura only reads sleep and steps from Health Connect and never writes anything to it. Aura uses them only to show them on your pages and in Insights, next to your moods.

  • They stay on your device. They are never sent to our server or to anyone else, never go into the cats' notes, Aura's backups, exports or analytics, and are never used for advertising or sold.
  • Aura doesn't save them: it reads them again from Apple Health or Health Connect each time it opens, so they're never in your device's backup either.
  • Turning "Bring in sleep and steps" off forgets them. You can also take away Aura's access at any time in Apple Health or Health Connect.

Aura's use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.


Legal bases, partners and transfers
  • Legal bases (UK GDPR and EU GDPR): providing the app and its notes (contract); analytics, crash reports and checking Aura Plus (our legitimate interest in a working, improving app; you can object by turning them off).
  • Processors: Google (the Gemini API for notes and the safety check, and Analytics for Firebase), Amazon Web Services (our server), RevenueCat (purchases) and Functional Software, Inc. (Sentry, crash reports). Several are in the United States; transfers rely on the UK and EU standard contractual clauses or the Data Privacy Framework.

How long we keep things

Your journal is kept on your device for as long as you keep it. Our server keeps no journal text. Analytics events are kept for the period set in Google Analytics (currently 14 months), and crash reports for Sentry's retention period (up to 90 days).


Your rights

You have the right to access, correct, delete, object to and port your data. Most of it is already in your hands: Settings → Your pages → "Export my words as a file", or "Tear out every page". For anything our partners hold about your install, write to us and we will take care of it. You can also complain to the UK Information Commissioner's Office or to your local data protection authority.


Children

Aura is not meant for children under 16, and we do not knowingly process their data. If you believe a child has used Aura, write to us.


If you still use Aura 1.x

Versions of Aura from 2024 (1.0 to 1.0.2) worked differently: they could show ads through Google AdMob (which may use your device's advertising identifier, with your permission), and used Google Analytics for Firebase, Firebase Crashlytics and Sentry for usage and crash data, and RevenueCat for purchases. Their mood entries were stored on your device. Updating to Aura 2.0 removes the ads; your old moods come across to your new journal on your device.


Changes

If this policy changes, we will update the date above and mention it in the app's release notes.