Privacy Policy

Your data is encrypted in transit (TLS) and at rest, and isolated by row-level security so only your account can read it.

We do not train models on your data by default. The toggle is opt-out, not opt-in.

You can export everything (Markdown + JSON) and delete your account at any time. Hard delete completes within 30 days.

We follow GDPR and CCPA requirements. Your data is stored in one managed Postgres instance in Asia Pacific (ap-southeast-1) and served through Vercel's edge network; we do not offer per-account region selection.

Aurora is operated by Wuling Langyuan Information Technology Center (武陵区浪元信息技术中心), a registered individually-owned business in China, and serves users outside mainland China.

Account data — email, name, subscription status (PayPal processes payments; we never see your card or bank details).

Usage data — module-level activity counts (e.g., number of messages this month) to enforce plan limits and improve product.

Content data — notes, conversations, files you create. Encrypted in your vault. We have no way to read it.

Telemetry — privacy-respecting, aggregated, anonymous (page views, performance). No third-party trackers.

Sell your data to anyone. Ever. There is no business model in which we would.

Train external models on your content. By default we don't even use your data to train our own internal routing.

Let employees casually browse your content. Access is restricted by row-level security and least-privilege service keys, and used only for support you request or where legally required.

Track you across the web. We do not embed third-party ad pixels, analytics that follow you off-site, or tracking cookies.

PayPal (payments), Resend (transactional email), Vercel (hosting, edge network, and cookieless first-party analytics — see /cookies), Supabase (Postgres database, authentication and storage).

AI inference is routed through OpenRouter to the model you select (OpenAI, Anthropic, Google, Perplexity, DeepSeek and others), and to MiniMax for text, image and speech, Replicate for image generation and note embeddings, and Agnes for video. Your prompts leave our systems to reach these providers and are governed by each provider's own retention policy — we do not add a contractual zero-retention guarantee on top.

Full sub-processor list and DPA available at /security.

Access — request a copy of your data anytime (Settings → Export).

Erasure — delete your account anytime (Settings → Danger Zone). Hard delete within 30 days.

Portability — Markdown + JSON export, no lock-in.

Object — opt out of any non-essential processing in Settings.

EU and California residents have additional rights under GDPR and CCPA. Email wavezhou6@gmail.com to invoke them.

Aurora is not for children under 13 (or 16 in the EU). We do not knowingly collect their data. If you believe a minor has signed up, email wavezhou6@gmail.com and we will delete the account within 7 days.

We will email you at least 30 days before any material change to this policy. The current version is dated below.

Operator: Wuling Langyuan Information Technology Center (武陵区浪元信息技术中心), a registered individually-owned business, China.

Email: wavezhou6@gmail.com

EU representative on request.