Privacy Policy

Your privacy matters. Aurora Lab Inc. is the data controller responsible for the personal information described here. This policy explains what we collect, why, and the choices you have. We collect only what we need to run Aurora. We never sell your personal information.

1. Information we collect

• Account information — your name, email, and password (stored hashed) when you sign up.
• Content — the messages, files, and documents you create or upload to use the Services.
• Billing information — your plan and usage. Card details are handled directly by Stripe; we never see or store full card numbers.
• Connected Google data — only if you choose to connect a Google account, the Google data described in the "Google User Data" section below.
• Usage & device data — basic logs (such as request times and error diagnostics) needed to operate, secure, and debug the Services.
• Sign-in and device details. The device and browser or app you sign in with, and your approximate country. See Sign-ins and devices in section 8.

2. How we use your information

To provide and maintain the Services, process your messages and files for features you request, handle billing, keep Aurora secure, prevent abuse, comply with the law, and communicate with you about your account. We do not use Your Content to train our own foundation models.

3. AI processing

When you use AI chat, the content of your request is sent to our AI provider, Anthropic, to generate a response. When you generate images, that runs on Aurora's own hardware and your prompt is not sent to a third-party image service. Web image search fetches openly-licensed results from public sources (such as Openverse and Wikimedia Commons) using your search terms.

4. Google User Data

Aurora lets you optionally connect your Google account to bring your Google services into Aurora. We request access to your Google data only when you explicitly connect your Google account, and only to the scopes you approve on Google's consent screen. We never access your Google data unless you have connected it. Specifically, when connected we access:

• Gmail — to surface and search your email inside your Aurora dashboard and to help you read, summarize, draft, and act on messages when you ask the Aurora AI assistant to.
• Google Calendar — to display your events and schedule in Aurora and to let the AI assistant help you review, plan, and manage events at your request.
• Google Drive — to list, open, search, and work with the files you choose so you can reference and act on them in Aurora and through AI assistance you request.
• Google Contacts — to show your contacts in Aurora (for example, to address messages and events) and to assist with actions you ask the AI assistant to perform.

We use this Google data solely to provide these user-facing features — surfacing your information in the dashboard and powering the AI assistance you request. We do not sell your Google data, do not use it for advertising, and do not use it to train generalized or foundation AI/ML models. Human access is limited to what you authorize or to the narrow cases permitted by Google's policy (such as security, abuse, or legal compliance, or with your explicit consent).

Aurora Lab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention & deletion. Connecting your Google account is always revocable. You can disconnect it at any time from your Aurora account settings, or revoke Aurora's access directly from your Google Account permissions. When you disconnect, we delete the stored Google access and refresh tokens and any cached Google data we held to power the features above. We retain Google data only as long as your connection is active and you are using these features.

5. Cookies

We use a small number of strictly necessary cookies, mainly to keep you signed in, plus optional functional and analytics categories that stay off until you allow them. We do not use third-party advertising or cross-site tracking cookies. Choose Necessary only, Accept all, or pick categories in the cookie banner, and change your choice at any time in Your privacy choices in the footer. For every cookie we set, see the Cookie Policy.

6. Service providers (subprocessors)

We share data only with the providers that help us run Aurora:

• Stripe — payment processing.
• Anthropic — AI model that powers chat responses.
• Cloudflare — network delivery and security.
• Resend — transactional email (such as welcome and account messages).

Each processes data only as needed to provide its service to us. The full register is on the Subprocessors page.

7. Data retention

We keep your information for as long as your account is active or as needed to provide the Services, then delete or anonymize it within a reasonable period, unless a longer period is required by law (for example, billing records).

8. Security

We protect your data with commercially reasonable measures, including encryption in transit, hashed passwords, and access controls. No system is perfectly secure, but we work to keep your information safe and will notify you of significant incidents as required by law.

Sign-ins and devices. When you sign in, we record the device and browser or app you used (for example “Chrome 128 on macOS” or “Nisu on iPhone 13 Pro Max”) and your approximate location at the country level. Our network provider, Cloudflare, determines the country from your IP address. We show this in your account’s Security settings so you can recognize your sign-ins and sign out devices you don’t, and we use it to warn you about sign-ins from new devices. We don’t store your IP address with your sessions; to detect new networks we keep a one-way code derived from it for 90 days. A cookie named aurora_device, holding a random identifier, keeps sign-ins from the same browser together for up to 400 days. Session records are deleted 30 days after a session ends or stops being used.

9. Your rights

You can access, correct, export, or delete your personal information — most of it directly from your account, or by emailing [email protected]. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including the right to object to or restrict certain processing.

10. International transfers

Aurora and our providers may process your data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers.

11. Children

Aurora isn't directed to children under 16, and we don't knowingly collect their personal information. If you believe a child has provided us data, contact us and we'll delete it.

12. Changes to this policy

We may update this policy from time to time. We'll revise the date above and, for material changes, take reasonable steps to let you know.

13. Contact

Questions or requests about your privacy? Email [email protected].