Privacy Policy

Your data is encrypted in transit (TLS) and at rest, and isolated by row-level security so only your account can read it.

We do not train models on your data by default. The toggle is opt-out, not opt-in.

You can export everything (Markdown + JSON) and delete your account at any time. Hard delete completes within 30 days.

We follow GDPR and CCPA requirements. Data residency: US, EU, or Asia Pacific (your choice at signup).

Aurora is operated by Wuling Langyuan Information Technology Center (武陵区浪元信息技术中心), a registered individually-owned business in China, and serves users outside mainland China.

Account data — email, name, subscription status (PayPal processes payments; we never see your card or bank details).

Usage data — module-level activity counts (e.g., number of messages this month) to enforce plan limits and improve product.

Content data — notes, conversations, files you create. Encrypted in your vault. We have no way to read it.

Telemetry — privacy-respecting, aggregated, anonymous (page views, performance). No third-party trackers.

Sell your data to anyone. Ever. There is no business model in which we would.

Train external models on your content. By default we don't even use your data to train our own internal routing.

Let employees casually browse your content. Access is restricted by row-level security and least-privilege service keys, and used only for support you request or where legally required.

Track you across the web. We do not embed third-party ad pixels, analytics that follow you off-site, or tracking cookies.

PayPal (payments), Resend (transactional email), Vercel (hosting), Supabase (database in the region you chose).

AI inference is routed across OpenAI, Anthropic, Google, and Perplexity per the model you select. None of them retain your data — we set explicit no-train + zero-retention flags.

Full sub-processor list and DPA available at /security.

Access — request a copy of your data anytime (Settings → Export).

Erasure — delete your account anytime (Settings → Danger Zone). Hard delete within 30 days.

Portability — Markdown + JSON export, no lock-in.

Object — opt out of any non-essential processing in Settings.

EU and California residents have additional rights under GDPR and CCPA. Email wavezhou6@gmail.com to invoke them.

Aurora is not for children under 13 (or 16 in the EU). We do not knowingly collect their data. If you believe a minor has signed up, email wavezhou6@gmail.com and we will delete the account within 7 days.

We will email you at least 30 days before any material change to this policy. The current version is dated below.

Operator: Wuling Langyuan Information Technology Center (武陵区浪元信息技术中心), a registered individually-owned business, China.

Email: wavezhou6@gmail.com

EU representative on request.