Privacy Policy

Auragem turns a selfie into a color. That's the whole trick, and it happens entirely on your own phone or computer.

Your photo never leaves your device. When you take or upload a selfie, your browser reads the image in your device's own memory and calculates one thing: the dominant color of the picture, as a few plain numbers (hue, saturation, brightness — the kind of numbers a paint app uses to name a color). Only those color numbers are sent to us. The photograph itself is never uploaded to our servers, never stored by us, and never shared with anyone; it is discarded from your device's memory once the color is read.

We do not build a "faceprint." Face-recognition systems measure the geometry of a face — the distances and shapes between your eyes, nose, mouth, and jaw — and turn them into a unique template that can be matched later. Auragem does none of that. We do not scan your face geometry, do not create a facial template or faceprint, do not use facial recognition, do not match your face against any database, do not identify you from your face, and do not compare your face across sessions or against other people. We do not use your photo to train any model. There is a world of difference between reading what color a picture mostly is and mapping the unique shape of your face — Auragem does the first and never the second.

We do check that a face is in the frame — but only yes-or-no. To help you aim the camera at a person, your browser runs a quick, on-device check that answers one question: is there a face in the picture, yes or no? It runs entirely on your device, keeps and sends nothing — no coordinates, no measurements, no image — and the yes/no answer is used on the spot and then gone.

We don't read hidden photo data. Because we only read the picture's pixels to find its color, data embedded in photo files — such as EXIF metadata or GPS/location tags — is never read, used, or stored.

Because a selfie is involved, we address the biometric-privacy laws directly. Auragem is designed so that itdoes not collect, capture, receive through trade, or otherwise obtain any "biometric identifier" or "biometric information" as those terms are defined under the Illinois Biometric Information Privacy Act (740 ILCS 14/, BIPA), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001, CUBI), Washington's biometric statute (Wash. Rev. Code ch. 19.375), and comparable laws in other states.

• No scan of face geometry; no template. The only value derived from your selfie is its dominant color (a property of the image's light), never a measurement of your facial structure. A color value is not a "scan of face geometry."
• No identification, and no ability to identify. These statutes are tied to identifying an individual. Auragem creates no template capable of matching a face and performs no facial recognition — a color number cannot recognize anyone.
• The source is a photograph — which BIPA and Washington expressly exclude — and nothing is derived from a biometric identifier, because none is ever created.
• On-device only. The image is never transmitted to or stored on our servers, so we never "obtain" facial data from it in the first place.
• The face-presence check returns only present/absent and retains nothing.
• No voiceprint. We do not record or process your voice (see §3).

This is a description of how the product is engineered, not a waiver of any right the law makes non-waivable.

"The Compass" is optional. If you use it, your browser looks at the average change in the green light of a small patch of skin for about 10–15 seconds and estimates your heart rate (a technique called rPPG), 100% on your device. The camera frames and the underlying measurements are never transmitted to us and never stored — they are discarded the moment the measurement ends. The only result is a single beats-per-minute number that lives only in your session's temporary memory and is used for one purpose: to set the visual and sound rhythm of the moment. It is not a health record and not a biometric identifier: it never infers your health, emotions, or mood, never feeds any reading or profile, and is never saved. Auragem is not a healthcare provider and The Compass is not a medical tool.

Voice. Auragem can read its own written output aloud (the voice of the "Council") using a text-to-speech provider (ElevenLabs). That is audio the app speaks to you, not audio it captures from you. We do not record, collect, or process your voice, and we create no voiceprint.

We list the categories of personal information we collect, using the categories defined by the California Consumer Privacy Act, as amended by the CPRA (CCPA/CPRA). We only list a category if we actually collect in it.

• Identifiers. A random device identifier we generate in your browser; a random pseudonymous ID for your readings; and — only if you create the optional account — your email address. If you open an Encounter, the name you enter to label your invitation. If you opt in, a push-notification token. Source: our systems on your device, or you. Why: to remember your readings and purchases on your device without asking who you are; to give you cross-device access if you make an account; to send email/notifications you ask for. The default identifiers are pseudonymous; creating an account links your device IDs to your email and makes you identifiable — we disclose this openly (see §9).
• Commercial information. Records of your purchases (the full reading, the True North 12-month tier, or Encounter), with payment status and receipts. We use Stripe for card payments; Auragem never sees or stores your card number (Stripe handles it under PCI-DSS).
• Internet / network activity. Your IP address in access logs; technical request data (browser/user-agent); rate-limiting signals; your in-app interactions (such as your quiz answers). If you have an account, a strictly-necessary session identifier in a cookie (see §11). Analytics note: our product analytics are first-party and anonymous — only an event name, with no identifier and no personal information. We use no third-party advertising pixels or trackers.
• Approximate location only. We do not collect precise (GPS) location. As with any internet service, your IP can be tied by our providers to a coarse, approximate region for security and anti-abuse. We do not read location from your photos.
• Audio / visual. Your selfie (processed on-device; only its color is uploaded — see §1); The Compass and voice (see §3). Despite involving a camera, your image and camera data stay on your device.
• Inferences. Your aura color and the AI-written reading (and, in Encounter, an AI-written synthesis of your circle's responses), written by our AI provider (Anthropic) from what you provide. These are creative entertainment outputs, not measurements, predictions, diagnoses, or advice — and never derived from analyzing your face.
• Sensitive information — our honest analysis. We do not collect government IDs, precise geolocation, racial/ethnic origin, religious beliefs, health, sex life, or biometric data. The one honest caveat: you may optionally write a short free-text "vent" (≤280 characters), or a short free-text answer in an Encounter. You control what you type. If you choose to disclose something sensitive there, that text — which we screen for crisis signals before generating your reading — is sent to Anthropic to write your reading. We never ask for or require sensitive detail. We also collect a self-declared mood (from a quiz — we do not read emotion from your face) and an optional self-declared zodiac sign (a label from a fixed list of 12 — never a birth date), which we treat as ordinary preferences you volunteer. Because any sensitive content reaches us only when you type it, and we use it solely to provide the feature, we operate within the CCPA/CPRA "right to limit" already (see §8).

Sources: directly from you (quiz answers; self-declared mood and optional sign; any free-text; the name you enter for an Encounter; your email/password if you make an account; your purchases); automatically from your device and browser (the random device ID; on-device color and — for The Compass — heart-rate estimates, of which only the color is uploaded; IP and technical data; anonymous event names); from providers acting for us (payment status from Stripe; security/delivery signals from Cloudflare, Upstash, Vercel; generated text from Anthropic; email-delivery status from Resend); and, only in Encounter, from other people who submit blind perceptions of you.

We use personal information to:

• provide the service (your aura color and reading; Encounter; True North; keeping your content available, across devices if you have an account);
• process payments through Stripe and keep transaction records;
• keep the service secure and prevent abuse (rate-limiting, fraud/abuse detection, Encounter moderation, short-lived access logs);
• send communications you asked for (password-reset and Encounter notification email; push if you opt in) —never for marketing;
• screen free-text "vent" content for crisis signals before generating a reading;
• maintain, debug, and understand aggregate, anonymous usage; and
• comply with law and establish, exercise, or defend legal claims.

We make no automated decisions producing legal or similarly significant effects about you, and we do not profile you for advertising.

We disclose personal information only as below, and our vendors act as service providers/processors under contract, only on our instructions — not for their own uses.

Encounter — between people. Encounter is social, so it necessarily involves others. When you open one you get a public link showing the name you entered; anyone with the link can open it. Each person you invite answers blind and chooses, once and immutably, to respond named or anonymously. Anonymity is inviolable — we never de-anonymize an anonymous responder in normal use. For each responder we store their perception, their name (only if named) or an anonymous marker, a consent timestamp and a 14+ affirmation, and — under confidentiality, separate from the result — their IP and user-agent. Why keep an anonymous responder's IP/user-agent: it is the only link that could ever — and only through valid legal process — allow tracing an abusive response; it is never shown to you or anyone in normal use. To write the synthesis, Anthropic receives your name, the name of any named responder, and the perceptions; an anonymous responder's name is never sent anywhere. A mutual reading ("Aura for Two") is generated only with both people's explicit consent. An optional notification email (via Resend) tells you when someone reads you. Anyone can report an Encounter for free; removal is a soft-delete (it stops appearing and the link stops working; records may persist under confidentiality for our duty of care and to respond to legal process), with full erasure on request or when the need ends (see §10).

Service providers / subprocessors:

• Supabase — Brazil (São Paulo, sa-east-1): our database, where stored data lives (the pseudonymous records, account email + password hash if any, Encounter records, payment records, access logs).
• Anthropic — United States: AI text generation for the paid portrait and the Encounter readings (your answers; your "vent" if you write one; in Encounter, named names and perceptions).
• Google (Gemini) — United States: AI text generation for your free reading (your answers and aura color).
• ElevenLabs — United States: AI voice (text-to-speech) of the app's output — never your voice.
• Sentry — United States: error monitoring — the technical error message, with personal-data capture disabled by configuration; never your selfie.
• Vercel — United States: application hosting (technical request data).
• Cloudflare — United States: CDN and anti-abuse (network data, including IP).
• Upstash — United States: rate-limiting (signals including IP).
• Stripe — United States: card payment (PCI-DSS). Auragem never sees or stores card numbers.
• Resend — United States: transactional email (a password-reset link, or an Encounter notification) — your email address and the email contents.

Note the geography: our database sits in Brazil while several processors are in the United States (see §10). We may also disclose information to comply with law and lawful process, to enforce our terms, and to protect users and the public; and, in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this Policy.

Under the CCPA/CPRA, "sell" means disclosing personal information for money or other value, and "share" means disclosing it for cross-context behavioral advertising. Auragem does not sell your personal information, and does not share it for cross-context behavioral advertising (nor for "targeted advertising" under the other state laws). By design: we do not exchange your information for value; we run no third-party ad pixels and build no ad profiles; our analytics are first-party and anonymous; and vendors receive information only as processors. Because there is nothing to opt out of on this front, there is nothing for us to stop — but we treat any opt-out preference signal your browser sends (such as Global Privacy Control) as a clear statement of your choice, consistent with our no-sale/no-share posture. Consistent with the above, we also never sell or share the personal information of minors under 16 (which the CPRA would require opt-in consent to do).

Depending on where you live, U.S. state privacy laws give you rights over your personal information. To keep things simple, we honor these rights for all U.S. residents. Laws that inform this section include the CCPA/CPRA (California) and the comprehensive laws of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states.

• Know / access what we collect, the sources, purposes, and categories of recipients, and get a copy of what we hold.
• Delete personal information we collected from you, subject to legal exceptions (see §10 for what deletion does and doesn't reach).
• Correct inaccurate personal information (where your state provides it).
• Data portability, where applicable.
• Opt out of sale/share and targeted advertising — Auragem does none of these, so there is nothing to stop; your right and any opt-out signal are honored by our standing posture.
• Opt out of profiling for decisions with legal or similar effects — we do no such profiling and make no such decisions.
• Limit the use of sensitive personal information (CCPA/CPRA) — we already use it only to provide the feature you invoked (see §4).
• Non-discrimination — we will never deny service, change prices, or lower quality because you exercised a right.
• Appeal — where your state requires it, if we decline a request you may appeal by replying to our decision or writing to the contact in §12; we will respond within the time your law requires and, where provided, tell you how to reach your state Attorney General.

Do it yourself, without writing to anyone. If you have an account, both of the rights that matter most here are buttons, not requests: your account page lets you export your data and delete your account after confirming your current password. Buttons, right away — no waiting on us, no verification back and forth.

What the export includes — and what it doesn't. It returns the rows as stored, not a summary. And the file itself opens by stating what it leaves out: session authentication material and the technical identifiers of people who answered your Encounter — exposing those would break someone else's anonymity.

By writing to us — and why our pseudonymous design matters. For everything else, or if you have no account, write to privacidade@auragem.com.br. Because we are built to not know who you are by default:

• With an account: just sign in so we can connect the request to your content. Account deletion is self-service (above; see §10 for what it reaches), and it removes your email, password, device links, sessions, and recovery tokens and returns you to a pseudonymous state. Honest and important: deleting your account does not automatically delete your readings or Encounters — those persist by ID; tell us if you want those removed too, or use the per-item link/ID and (for an Encounter) your recovery code.
• Without an account: your content is keyed to random identifiers, so please have the reading's link/ID ready (and, for an Encounter, your recovery code). Without an identifier that ties data to you, we may be unable to locate specific pseudonymous records — and we will not collect extra identifying information (or make you create an account) just to search.

Verifying you: with an account, by your ability to sign in; without one, by your ability to produce the reading link/ID or Encounter recovery code. You may use an authorized agent (we may ask for written permission and, for some requests, to verify your own identity); we honor browser/platform opt-out signals without separate agent authorization. We respond within the time your law requires — generally acknowledging promptly and substantively responding within 45 days, extendable where the law allows and we notify you.

Auragem works fully without an account. The account is entirely optional and exists only so you can reach your own readings and Encounters from another device. Honest point: creating an account means you give an email and password, and from then on your email identifies you — you move from a pseudonymous artifact to an identifiable person. We never use magic-link login; it is always email and password. The account links your device IDs (up to 32) to your email — this changes only you; the anonymity of anyone who answered your Encounter stays inviolable. Your password is stored only as a scrypt hash (never plaintext). You can request account deletion anytime at privacidade@auragem.com.br (see §10).

We keep information only as long as we need it, and we've written this to match what our systems actually do — no promises we can't keep.

• Readings and pseudonymous content (keyed by ID) — including your aura color and the AI-written reading (the "Inferences" we create): kept so you can reopen them, until you delete them (via the link/ID, or an Encounter's recovery code, or by asking us). Deleting an account does not delete these.
• IP address in access logs: about six (6) months, then discarded.
• Account data (email; scrypt-hashed password; device links; sessions; recovery tokens): while the account exists — you can delete it yourself, from your account page, at any time. Sessions last 180 days and inactive ones are cleared; password-reset tokens are single-use, one-hour, and we keep only a hash that becomes inert once used or expired.
• Encounter records: kept while the Encounter exists (erasable on request). When removed through moderation, it stops appearing and the link stops working, but records may persist under confidentiality for our duty of care and to respond to legal process; full erasure on request or when that need ends.
• Encounter responder/reporter IP and user-agent: under confidentiality, accessible only through valid legal process, for as long as needed for security and record-keeping, then deleted.
• Payment records: as needed to provide purchases and meet financial, tax, and legal record-keeping obligations.

We use technical and organizational measures designed to protect your information:

• On-device photo handling — your selfie is never transmitted or stored; only a color value reaches us. The most sensitive input never leaves your device.
• Encryption in transit — traffic uses TLS (HTTPS).
• Passwords — hashed with scrypt and a unique random salt; the plaintext is discarded and never stored; verification is constant-time.
• Sessions — an opaque token (we store only its hash, plus user-agent) in a cookie (auragem_sessao) that is httpOnly, Secure, and SameSite=Lax, lasting 180 days; changing your password or "sign out of all devices" invalidates sessions.
• Password reset — links are single-use, valid one hour, only change the password (never sign you in), and invalidate sessions; the response is identical whether or not an account exists, so no one can probe who has an account.
• Restricted database access — row-level security and privileged server-side access only, never exposed to the browser.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep any Encounter recovery code safe — anyone who has it can open that Encounter.

Auragem has an unusual geography, and we'd rather explain it than hide it. We are a Brazilian operator serving U.S. users with U.S. vendors:

• Where your data is stored: in Brazil. Our database (Supabase) is hosted in São Paulo, Brazil (sa-east-1).
• Where it is processed: partly in the United States. Several processors are U.S.-based (Anthropic, Google/Gemini, ElevenLabs, Sentry, Vercel, Cloudflare, Upstash, Stripe, Resend), so parts of your information are processed in the U.S. to generate readings, voice and video, host and secure the app, take payments, and send email.
• The operator is in Brazil, and our personnel there may access data to run and support Auragem.

By using Auragem, you understand your personal information will be transferred to, stored in, and/or processed in Brazil and the United States, whose laws may differ from your home state's. Wherever it is handled, this Policy applies and we require our processors by contract to protect it and act only on our instructions.

Auragem is a general-audience entertainment experience. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be at least 14 to use Auragem, and our content is intentionally kept light (our generator is built to avoid sexual, gambling, alcohol, violent, or self-harm content).

How we check age — and, honestly, what that check is and isn't. When you first use Auragem you enter a birth date; your age is computed on your device, the birth date never leaves your device, and the only thing we record is a single yes/no — whether you are 14 or older — with a timestamp. This is an age self-affirmation, not identity or document verification — a determined person could enter a birth date that isn't theirs, and our system would not catch it. We say this plainly because a checkbox is not verification. We chose this deliberately: the reliable ways to verify age (IDs, face scans, biometric estimation) would mean collecting more sensitive data from everyone, including the very minors we're protecting. Recording only a "14-or-older" flag, on your device, is the most privacy-protective design we could offer.

If we learn we collected data from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child under 13 gave us information, write to privacidade@auragem.com.br; we may need to reasonably confirm you are the parent/guardian and identify the information before acting, keeping any verification detail to the minimum needed. Your child's selfie never reaches our servers (only a color value does), so we do not — and cannot — collect a child's image through that feature.

In Encounter, a person may be described by others; both the creator and each responder affirm they are 14+ before any collection, responder anonymity is inviolable (with IP/user-agent kept in confidence for legal process only), and a free reporting and removal channel is available at contato@auragem.com.br. For minors, we take a data-minimization approach and do not build advertising or behavioral profiles from teen data. Our paid True North tier is intended for adults (18+): we rely on the on-device age affirmation plus completion of payment as proportionate signals of adulthood, not on formal verification — for the same privacy-minimizing reason.

We may update this Policy; the date at the top shows the current version. For material changes we will provide reasonable notice (for example, by posting the updated Policy and, where appropriate, an in-app notice or an email to account holders). Your continued use after a change takes effect means you accept the updated Policy.

For any privacy question, or to exercise any right in §8, contact us:

• Privacy / rights / anything about a child under 13: privacidade@auragem.com.br
• General questions, abuse reports, content removal: contato@auragem.com.br
• Operator: ALC Intermediação e Representação Ltda. (CNPJ 66.279.691/0001-12), Brasília, Brazil.

Please tell us the right you want to exercise, whether you have an account (and the email if so), and any reading link/ID or Encounter recovery code for the content involved, so we can find it and respond.