This policy explains how personal information is processed when you use the AuraNova iOS app, visit our website or contact support. AuraNova provides conversations with AI advisor characters and tarot interpretations for reflection and entertainment.
1. Who is responsible
The data controller is Bagi István e.v., a Hungarian sole proprietor operating AuraNova.
Registered office: 1063 Budapest, Kmety Gy. utca 18., 3. em. 23., Hungary.
Registration number: 60103666.
Tax number: 67550980-1-42.
For privacy questions or requests, email support@auranova-app.com. You may also write to the registered office above.
2. Information we process
- Account and sign-in information: your email address, internal account identifiers, a protected password hash, email-verification status and temporary verification or password-reset records. Where you use Sign in with Apple, we process the identifier and account information Apple provides.
- Profile information: the name, birth details and focus areas you choose to provide. Optional profile fields can be left blank.
- Readings: messages you send, AI replies, saved conversation history, selected advisor, session times and your device's time-zone setting. A time zone is not precise GPS location.
- Crystals and purchases: your balance, session reservations and charges, promotional credits, product and transaction identifiers, purchase status and information needed to credit a purchase only once. Apple handles payment details; AuraNova does not receive your full payment card number.
- Reviews: your rating, optional review text, the associated reading and moderation status. Approved ratings and review text may be shown to other users.
- App analytics: usage events, event times, pseudonymous identifiers and technical app and device information, as explained below. These records describe interactions with features, rather than the content of your conversations.
- Support and technical information: emails and attachments you send us, your Support ID if provided, and request or error information needed to operate and secure the service. Hosting and service providers may process IP addresses, request times, browser or device information and service logs.
Information comes from you, your interactions with the service, and providers such as Apple and RevenueCat when they confirm sign-in or purchase activity. Please do not send passwords, email verification codes or full payment details to support.
App analytics with PostHog
We use PostHog Cloud EU to understand which features people use, how often they return, and where readings or purchases encounter problems. Analytics is enabled in the current release app, including TestFlight builds.
- Feature activity: app installation, updates, opening and backgrounding; daily-card reveals; advisor-profile views; reading starts, endings, expiry, continuation and start failures; and purchase-screen views, completed purchases, balance-sync timeouts and backend-confirmed crystal credits.
- Event details: relevant card or advisor identifiers, entry points, reading duration and turn counts, reserved minutes and crystal rates, whether a reading continued after a top-up, fixed failure categories, and credited crystal quantities and product details. Purchase-credit events distinguish test purchases from production purchases.
- Technical information: app version and build, operating system, device model and type, screen dimensions, language, time zone and network-connection type. As with other network services, PostHog receives an IP address with a request and may process it as technical request information.
- Identifiers: before sign-in, the SDK uses a generated identifier stored on the device. After sign-in, analytics is linked to your app account identifier, which is also used as your Support ID and RevenueCat identifier. Earlier activity under the generated identifier can then be linked to the account. Signing out resets the SDK identity for subsequent activity; it does not erase events already sent.
These identifiers are pseudonymous, not anonymous: they allow activity to be associated with an account even though we do not send your email or name to PostHog. Temporary random references connect events within a reading or purchase screen. A derived event identifier helps avoid counting the same backend purchase credit twice.
We do not send conversation messages, AI replies, written reviews, profile text, names, email addresses, birth details, passwords or authentication tokens as analytics content. Session replay, automatic screen-view capture and automatic capture of interface text and taps are disabled. We do not use these analytics events for advertising or to track you across other companies' apps and websites.
The current app does not offer an in-app analytics switch. You can contact support@auranova-app.com to object to analytics processing or request access or erasure. See retention and deletion and your rights below. This notice is information about processing, not a consent request.
3. Why we use information
Under the EU General Data Protection Regulation (GDPR), we rely on the following grounds:
- Providing the service — performance of a contract: creating and securing your account, generating and saving requested readings, maintaining your crystal balance, processing purchases and handling service requests.
- Security and service administration — legitimate interests: preventing account abuse and repeated promotional claims, investigating errors, moderating reviews and resolving disputes. These interests are operating a reliable service, protecting users and preventing fraud; you may object to processing based on them.
- Product improvement — legitimate interests, where permitted: understanding feature use, return visits and problems in reading and purchase flows through the limited analytics described above. Our interest is improving the usefulness and reliability of AuraNova; you may object to this processing. This ground does not replace any consent required by applicable law for storing or accessing analytics information on your device.
- Legal obligations: keeping records and responding to requests where applicable tax, accounting, consumer-protection or other law requires it.
- Consent, where required: if a feature requires consent, we must ask for it separately. Reading this policy or using the app does not itself provide consent for unrelated uses.
Account credentials are necessary for registered features. A reading requires the message you ask the advisor to respond to, and a purchase requires transaction information. Without the relevant information, we cannot provide that feature. Optional profile details and written reviews are not required to maintain an account.
4. AI conversations and sensitive information
Advisor responses are generated through the OpenAI API. Your message, relevant recent conversation history and reading context, such as the advisor, tarot cards and session time, are sent to OpenAI to produce a response. Anything personal you include in that text is included in this processing. Readings are not end-to-end encrypted conversations with a human professional.
OpenAI's published API policy states that API content is not used for model training by default unless the API customer opts in. API processing can nevertheless involve retention for abuse monitoring and other permitted purposes. This is not a promise of zero retention. See OpenAI's API data controls.
Please avoid submitting health records, information about sex life, religious or political beliefs, or other particularly sensitive information about yourself or another person. AuraNova is not a medical service. If you have included information you want removed, delete the conversation and contact support about any further deletion request. This notice does not constitute explicit consent to process special-category data.
AI replies are automated content, not decisions determining your legal rights or access to employment, credit, healthcare or similar services. Account-security checks and crystal calculations also use automated rules. Contact support if you believe a restriction or charge is incorrect.
5. Who receives information
- Amazon Web Services (AWS): app hosting, databases, operational logs and transactional email through Amazon SES. The app backend is configured in Frankfurt, Germany (eu-central-1).
- OpenAI: processing the reading content described above to generate AI replies.
- Apple: App Store distribution, payments and, where used, Sign in with Apple. Apple also handles information under its own privacy policy.
- RevenueCat: purchase validation and reconciliation using app user identifiers, purchase history and related technical information. See RevenueCat's privacy policy.
- PostHog: processing the app analytics described above on our behalf. We use its EU Cloud service, hosted in Frankfurt, Germany. See PostHog's privacy policy.
- Google Workspace: receiving, storing and replying to support email.
- Website infrastructure: OpenAI Sites and its hosting infrastructure, including Cloudflare, deliver and protect this website and process technical request information.
Authorized operators may access information when needed for support, moderation, security or administration. We may disclose relevant records where legally required or necessary to establish or defend legal claims. Approved review text is visible to other users; private conversation transcripts are not published as reviews.
Some providers process information outside Hungary and the European Economic Area, including in the United States. Hosting the app database and analytics in Frankfurt does not mean every provider or subprocessor processes data only in the EU. Cross-border processing is subject to applicable transfer requirements, such as an adequacy decision or standard contractual clauses where applicable. Contact us for information about the safeguards applicable to your data and how to obtain a copy.
6. Retention and deletion
Account and profile information and saved conversations remain available while your account exists, unless you delete the relevant content. You can delete a saved conversation, or delete your account at You → Help & support → Delete account.
- Account deletion removes the account, profile and saved conversations from the app's active records, and removes access to the remaining crystal balance.
- Reviews are retained with account-linking identifiers removed. The text itself is not automatically scrubbed of names or other identifying details you wrote. Deleting a conversation does not delete its review. Contact support if review text contains personal information you want removed.
- Session accounting and purchase records are retained separately. Account deletion does not automatically erase those records or delete records held by Apple or RevenueCat. They support purchase reconciliation, dispute handling and prevention of duplicate credits; legally required records may also need to be retained.
- Analytics records are stored separately in PostHog. Deleting a conversation or account in the app does not currently trigger deletion of its analytics records. Retention is assessed against the need to compare feature use over time and investigate reading or purchase problems, subject to applicable erasure rights. Contact support to request deletion of analytics associated with your account; providing your Support ID, if available, helps us locate it. We do not promise a fixed automatic analytics-deletion period in this notice.
- A protected promotional-eligibility marker remains after deletion to prevent repeated sign-up rewards. It is derived from your email or Apple identity using a keyed hash, rather than storing the original identity in the marker. It can still be matched when that identity returns; it is not treated as fully anonymous.
- Verification and password-reset codes expire after 15 minutes. Expired challenge and rate-limit records are scheduled for automatic database cleanup; expiration of a code is not immediate physical erasure of its record.
- Support correspondence and operational records are kept according to the need to resolve the request, investigate incidents, handle disputes and meet applicable legal obligations. The current service does not apply one fixed automatic deletion period to all such records.
For records retained after account deletion, you may request erasure or ask why particular information is still needed. Where an obligation or valid exception prevents deletion, we will explain it. Copies held by providers, logs or backups can have separate retention cycles; deleting content in the app does not guarantee immediate removal of every such copy.
7. Device storage, website storage and security
The app analytics SDK stores identifiers and queued events locally on your device so it can associate activity and send events when a connection is available. This app storage is separate from cookies or trackers on the website.
The website pages do not add advertising pixels or an optional analytics tracker. Hosting infrastructure may use technical cookies or request information to deliver the website and protect it from abuse. Following an external link takes you to a service with its own privacy practices.
We use encrypted connections, protected credentials and access controls to help safeguard information. No service can guarantee absolute security. Keep your password and verification codes private and contact support if you suspect unauthorized access.
8. Your privacy rights
Subject to the conditions and exceptions in applicable law, you may request access to your personal data, correction, erasure, restriction of processing or a portable copy. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.
Email support@auranova-app.com with your request. We may ask for proportionate information to verify that the account belongs to you; do not send your password or verification code. GDPR requests are normally answered within one month. If a permitted extension is needed because of complexity or the number of requests, we will explain the extension within that month.
You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or to the supervisory authority where you live, work or believe a violation occurred. See NAIH's contact and complaint information.
9. Children and policy changes
AuraNova is not designed for children. If you believe a child has provided personal information inappropriately, please contact us so we can review and address it. An App Store content rating is not consent for processing a child's personal information.
We will update this notice when data practices change and identify the revision date above. Material changes will be communicated through the app or website. For help using the app, visit Support; for service and purchase conditions, read our Terms & Conditions.