Privacy Policy

The controller of your data is Moment Compagny [legal form, registered address and registration number to be confirmed], publisher of the Aura app for iOS and Android and of the website getaurafit.app.

For anything about your data, write to contact@getaurafit.app.

Without an account, Aura keeps your data on your phone only, except the content you send for an AI estimate (see below). If you create an account, the data below is also stored on our servers so it syncs across your devices.

• Account: your email address, your first name and the identifier of the sign-in method you chose (Sign in with Apple, Google or an email code). Used to create your account, sign you in and sync your data.
• Profile and goals: goal, sex, age, height, weight, target weight, sessions per week, the sports you do, areas to protect (for example knee or lower back), your coach (Mia or Leo), your protein shake recipe, and your calorie and macro targets. Used to compute your targets and adapt your sessions.
• Training: your program, sessions, sets (exercise, weight, reps, date), cardio logs, machine settings and how you feel today. Used to show what you did last time and suggest the next step.
• Food: meals with their time, calories, protein, carbs, fat and ingredients, and your favourites. Meal photos and meal descriptions you submit are sent for an estimate.
• Body and progress: weigh-ins, journal notes, progress photos, body assessment measurements (waist, neck, hips), assessment photos (front, side, back) and the computed results.
• Notification preferences: the coach topics and reminders you turn on. Reminders are scheduled on your phone.
• Purchases: Apple or Google handle the payment. We receive the status of your Aura Plus subscription (product, start, renewal or expiry), never your card details.
• Support: the messages you send us and our replies.
• Website: our host keeps technical logs (IP address, browser, pages requested) for security. The public website sets no advertising or analytics cookies.

Weight, body measurements, body photos, injuries and what you eat can reveal information about your health, a special category of data under the GDPR. We process it only with your explicit consent, given when you enter it, and only to provide the features you use.

You can withdraw your consent at any time by deleting the data concerned or your account. Aura gives estimates, not medical advice.

Some features need an AI model: the meal scan, describing a meal in words, the body assessment and the AI coach that builds your program. They require an account. When you use one, the content needed for that estimate (the photo, your description, your measurements or your answers) is sent through our server, a Supabase Edge Function that checks your account and a daily limit, to OpenAI, which returns the estimate.

OpenAI acts as our processor. Under its API terms, content sent through the API is not used to train its models, and may be kept for up to 30 days to detect abuse before it is deleted. We keep a count of AI requests per account to enforce the daily limit, not their content.

Progress photos are never sent for analysis.

• Performance of our contract with you: your account, sync, the features you use and your subscription.
• Your explicit consent: health data, and AI processing of photos and measurements.
• Our legitimate interest: security, fraud and abuse prevention, answering support requests.
• Legal obligations: accounting and responses to lawful requests.

We do not sell your data and do not share it with advertisers. It is processed for us by:

• Supabase: database, authentication and photo storage, hosted in the European Union (Ireland, AWS eu-west-1).
• OpenAI: AI estimates, in the United States, under the EU Standard Contractual Clauses [transfer mechanism to be confirmed].
• Vercel: hosting of this website.
• Our email provider: sending sign-in codes and support replies [provider to be confirmed].
• Apple and Google distribute the app and process payments as independent controllers under their own privacy policies.

On your phone first: the app works offline and stores your log locally. With an account, a copy is synced to Supabase in Ireland. Every row is tied to your account, and database rules let each account read only its own rows. Photos sit in a private storage bucket, in a folder only your account can open.

Traffic is encrypted in transit. Staff access is limited to what support and operations require, uses individual accounts, and does not include your photos.

• Account data: as long as your account exists. When you delete your account, your rows and photos are deleted from our database and storage immediately; residual copies in backups are erased as backups rotate, within 30 days [to be confirmed].
• Data on your phone: until you delete it or uninstall the app.
• AI requests: content up to 30 days at OpenAI; our request counts for 12 months.
• Support messages: 3 years after the last exchange.
• Website logs: 30 days.

You can access, correct, export, restrict or delete your data, object to processing based on our legitimate interest, and withdraw consent at any time. Most of this is in the app: edit your profile, export your data as a file from Account, or delete your account.

For anything else, write to contact@getaurafit.app. We answer within one month. You can also complain to your data protection authority, in France the CNIL (www.cnil.fr).

Export: Account → Export my data gives you a file with your log.

Deletion: Account → Delete my account erases your account, every synced row and your photos. Without the app, see getaurafit.app/delete-account. Deleting your account does not cancel a subscription: cancel it in your Apple or Google account settings.

Aura is not meant for anyone under 16 [minimum age to be confirmed]. We do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.

Aura shows no ads and does not track you across other companies' apps or websites. We do not use your data to build advertising profiles.

If we change this policy, we update the date at the top. If the change is significant, we tell you in the app before it applies.