Not yet in force. This text describes what this build actually does and is prepared for professional review; the controller's identity and contact are not provided yet, so it does not apply as a legal notice.
Privacy notice
Effective date: not yet in force. This notice describes only what Aura actually does. Where something happens only when a feature is switched on, it says so. It was written without a review by a lawyer. It is checked every month against official sources, and whenever a feature changes, by an AI-assisted review that is not a lawyer; a lawyer will review it before Aura switches on payments, analytics, an AI-model assistant or Sign in with Google. Where a detail about a provider has not been verified yet, this notice says "to be verified" instead of guessing. While the controller details below are missing, this notice is not in force. The Italian translation is published at the same address in the app. The English and Italian versions have equal value; if they differ, the one more favourable to you applies. Questions: privacy@auratrip.app.
1. Who is responsible
Aura ("Aura", "auratrip.app") is a free trip-planning service. Data controller: [not provided yet — to be completed by the owner before launch], [not provided yet — to be completed by the owner before launch]. Contact for anything about your data (access, deletion, questions, complaints): privacy@auratrip.app. Aura is run by one person, not a company. There is no Data Protection Officer: the law does not require one for a service of this kind (GDPR Art. 37).
2. Who can use Aura
You must be 18 or over to create an account. Aura does not ask for your date of birth; by creating an account you confirm that you are 18 or over. If we learn that an account belongs to someone under 18, we delete it and its trips. Planning without an account keeps everything in your own browser (section 3), and Aura's servers receive none of it. This rule is stricter than the Italian rules on consent by minors (Codice privacy art. 2-quinquies; Law 132/2025, art. 4, on AI features), so it covers them.
3. What Aura does with your data
| What | When | Why (legal basis) | Where | How long |
|---|---|---|---|---|
| Trips without an account: destination, dates, number of travellers, interests, pace, budget, bookings you type, your plan | When you plan without signing in | To give you the planner you asked for. Aura's servers do not receive it | Your browser only | Until you delete the trip or clear your browser |
| Email address and account id; sign-in times, and the IP address and browser type of each sign-in session, kept by the sign-in system | When you create an account and sign in with the code or link we email you | Contract: to create your account and sign you in (GDPR Art. 6(1)(b)) | Supabase, EU (Ireland, region eu-west-1) | Until your account is deleted, by you in the app or at your request (section 7) |
| Trips saved to your account (same fields as above, including bookings and notes you add) | When you save a trip while signed in | Contract (Art. 6(1)(b)) | Supabase, EU (Ireland, region eu-west-1); readable and changeable only by your account | Until you delete them or your account |
| Places and cities you save | When you tap Save, signed in or not | To keep the list you asked for. Aura's servers do not receive it | Your browser only, also when you are signed in | Until you remove them or clear site data; saves made while signed in are removed from the browser when you sign out |
| The sign-in email (your address and the code or link) | Each time you ask to sign in | Contract (Art. 6(1)(b)) | Sent by Supabase through Resend | Aura does not keep a copy. Resend keeps a delivery log (your address, the time and whether the email was delivered) for 30 days (the data retention Resend states for its plans), and deletes Aura's data at the latest 90 days after Aura's Resend account is closed |
| Technical logs: IP address, time, requested address (which can include a hotel name you searched), browser type, errors | Every request to Aura's servers | Legitimate interest in keeping the service secure, working and within its costs (Art. 6(1)(f)) | Cloudflare; Supabase for requests to the account service (sign-in, saved trips) | At most 30 days at Cloudflare (the Worker's own logs: at most 7 days); at Supabase, 7 days (log retention of Aura's Supabase Pro plan) |
| Abuse counters keyed by IP address | Every request to Aura's data services | Legitimate interest: protection against abuse and runaway costs (Art. 6(1)(f)) | Cloudflare | About 60 seconds |
| Record of an erased account: the account id, status and time (no email) | When an account is deleted | Legitimate interest in making sure a deletion stays effective if a backup is restored, and in demonstrating it (Art. 6(1)(f), Arts. 17 and 5(2)) | Cloudflare (separate from the database) | 180 days (longer than any backup or restore window) |
| Backups of the database | Daily | Legitimate interest: security and recovery (Art. 32) | Supabase (same region as the database) | 7 days; deletions are re-applied after any restore |
| What you write to privacy@auratrip.app or to support | When you write to us | To answer you (Art. 6(1)(b) for support; Art. 6(1)(c) and Art. 12 for rights requests) and to keep proof that a rights request was answered (legitimate interest in demonstrating compliance and defending claims, Art. 6(1)(f)) | Zoho Mail (EU) | Up to 24 months after the request is closed |
| Positions of your stops and of your stay; text you type to find your stay or a place | Only when you ask for travel times or search a place | Contract (Art. 6(1)(b)): the result you asked for | Sent to Google through Aura's server, without your account details | Not kept by Aura's server; the result stays in your plan and in a route cache in your browser |
| Your device's location | Only when you tap "My location" (on the map, or to put one of your own places where you are) and allow it when your phone or browser asks | Contract (Art. 6(1)(b)): the result you asked for | Read on your device. For a route from where you are, sent to Google through Aura's server, without your account details. For one of your own places, saved as that place's position in the trip | Never read in the background. Not kept by Aura's server; an own place's position stays in the trip as long as you keep it |
| Flight number and date | Only when you look up a flight | Contract (Art. 6(1)(b)) | Sent to AeroDataBox through Aura's server, without your account details | Not kept by Aura's server beyond a short cache of the public flight status |
| Text of a confirmation email you paste | Only if you use "Paste a confirmation" | Read in your browser and never sent to Aura. Only the fields you confirm are saved, as part of your trip | Your browser, or your account if you save | As for your trip |
| Changes not yet saved to your account | While a change is on its way to the server | Contract (Art. 6(1)(b)): so an edit is not lost | Your browser only, marked with your account id | Until the server confirms it, or you sign out |
| Waitlist: your email address, your language, the version of the consent text and the time you agreed, the time you confirmed, and a confirmation code (kept only as a one-way hash) | Only if you join the waitlist and confirm the link we email you | Consent (Art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in every email. We use your email to tell you about Aura's launch and when the app is out on the stores and, if you ask, to invite you to the Android test | Supabase, EU (Ireland, region eu-west-1); the emails are sent by the waitlist email provider (section 5) | Until you unsubscribe: the one-click link in every email deletes your entry. An address that is never confirmed: how long it is kept is to be verified |
Aura's emails (sign-in and waitlist) contain no tracking pixel and no tracked links: Aura does not know whether you open them.
Aura does not track your location (it reads it only when you ask, as above), show advertising, sell data, share data for marketing, build profiles, make automated decisions about you, take payments or book travel. It does not ask about health; "prefer less walking" is a pace preference, so please do not enter medical details in any field. What Aura keeps in your browser is listed on the Cookies and storage page. In the Aura iPhone app, "browser" means the web view inside the app; reminders you turn on are scheduled by iOS on your phone and are never sent to Aura.
4. What your browser loads from other services
Some content is loaded by your browser directly from another service. That service then receives your IP address and browser details, as with any website:
- Map tiles from OpenStreetMap's servers (OpenStreetMap Foundation, UK), on screens with a map.
- Photos from Wikimedia Commons (Wikimedia Foundation, USA), on place pages that show an open
photo; each photo shows its author and licence.
- Google's place card (Google Ireland / Google LLC): switched off in the public app. If it
is switched on, this notice and the Cookies and storage page will be updated first. When on, on a place's page, when you reach the "Google" section, your browser loads Google's Maps JavaScript and Google's own card with ratings, reviews and photos. Google then receives your IP address, browser details and the place shown, under Google's privacy policy (policies.google.com/privacy).
- Cloudflare Turnstile (Cloudflare, Inc.), on the sign-in form only, when that check is
switched on: your browser loads Cloudflare's script from challenges.cloudflare.com, which receives your IP address and browser details to tell a person from an automated request. Purpose: protect the sign-in emails from abuse (legitimate interest, Art. 6(1)(f)). Cloudflare handles these signals for Aura, and also uses them itself to improve its bot detection (Turnstile Privacy Addendum, cloudflare.com/turnstile-privacy-policy). It is not switched on before the Cookies and storage page lists what Cloudflare's script stores in your browser.
- Links you open (official sites, tickets, Google Maps or Apple Maps directions) take you to that
site, under its own terms and privacy notice.
Fonts and Aura's own pictures are served by Aura itself.
5. Providers and other recipients
"Processor" means the provider handles the data only on Aura's instructions, under a data processing agreement (GDPR Art. 28). "Independent controller" means the provider decides itself how it uses the data it receives, under its own terms and privacy policy. "Data source" means a provider Aura asks for facts.
| Provider | Role | What it is for | Data | Location and transfers outside the EEA |
|---|---|---|---|---|
| Supabase Inc. | Processor (Art. 28) | Accounts, database, backups, sign-in | Email, account id, trips saved to your account | Aura's project is hosted in the EU (Ireland, region eu-west-1). The provider and some sub-processors are in the USA. Safeguard: Standard Contractual Clauses (SCCs) in the Supabase DPA; EU-US Data Privacy Framework (DPF) listing: to be verified |
| Cloudflare Inc. | Processor (Art. 28) | Hosting, logs, abuse protection, erasure record | IP address, request details | Global network. Safeguard: SCCs in the Cloudflare DPA; Cloudflare states in its privacy policy that it complies with the EU-US Data Privacy Framework (DPF), its UK extension and the Swiss-US DPF |
| Cloudflare Inc., Turnstile | Processor (Art. 28) for the sign-in check; independent controller for the signals it uses to improve its bot detection (Cloudflare Turnstile Privacy Addendum) | Sign-in check against automated requests, only when switched on (section 4) | IP address, browser details | As for Cloudflare above |
| Resend (Plus Five Five, Inc.) | Processor (Art. 28) | Delivers the sign-in email | Your email address and the sign-in message | USA. Safeguard: SCCs and the EU-US Data Privacy Framework (DPF), both named in the Resend DPA; Resend states that it is certified under the DPF and its UK extension |
| Email provider for the waitlist | Processor (Art. 28) | Sends the confirmation email and the emails you agreed to receive | Your email address, your language, the message | To be verified: the provider, its location and the safeguard for any transfer outside the EEA are named here before the waitlist opens |
| Google (Google Play Console) | To be verified | The list of testers for the Android test, only if you ask to be invited | The email address you give for the invitation | To be verified |
| Zoho Corporation B.V. | Processor (Art. 28) | The mailbox for privacy@auratrip.app and support | Your email and what you write | EU data centre (Zoho Corporation B.V., Netherlands). Zoho states that the data stays in the EU data centre but can be accessed from outside the EEA: from India (Zoho Corporation Private Limited) for technical support, and by other Zoho group entities for support and disaster recovery. Safeguard: SCCs |
| Google (Google Ireland Ltd / Google LLC), Places API and Routes API | Independent controller under the Google Maps Controller-Controller Data Protection Terms | Travel times and place search, requested by Aura's server | Stop and stay positions, search text; no account details | Transfers to the USA under the EU-US Data Privacy Framework and SCCs |
| Google, Maps JavaScript place card | Independent controller for what it collects in your browser | Google's place card (section 4); switched off in the public app | IP address, browser details, the place shown | Google's privacy policy; USA (DPF) |
| AeroDataBox, reached through the API.market marketplace | Data source | Flight status, requested by Aura's server | Flight number and date only; no account details and not your IP address | AeroDataBox states that it is registered in British Columbia, Canada; it does not publish its company name. API.market is run by MagicAPI Inc. (USA). Aura sends no personal data to it (flight number and date only), so no transfer of personal data takes place |
| Open-Meteo (open-meteo.com) | Data source (receives no personal data) | Historical climate averages | Only the destination's rounded coordinates | Switzerland (OpenMeteo GmbH); EU adequacy decision for Switzerland |
| Apple WeatherKit (Apple; legal entity and server location to be verified) | Data source (receives no personal data: the call is made by our server) | Weather forecast | Only the rounded coordinates of the destination centre | To be verified. Aura sends no personal data to it (rounded coordinates only), so no transfer of personal data takes place |
| openrouteservice (HeiGIT gGmbH, Heidelberg; server location to be verified) | Data source (receives no personal data: the call is made by our server) | Walking times and routes between stops | Only the coordinates of the stops, which are public places from the guide or chosen by you | To be verified (provider based in Germany) |
| OpenStreetMap Foundation | Independent controller; your browser connects directly | Map tiles (section 4) | IP address, browser details | UK (EU adequacy decision) |
| Wikimedia Foundation | Independent controller; your browser connects directly | Photos (section 4) | IP address, browser details | USA |
These features exist in the code but are switched off in the public app. If one is switched on, this notice will be updated first:
- Assistant language model (Anthropic PBC, USA): one message you type, at most 600 characters,
after Aura removes email addresses, phone numbers, many numbers and reference codes and names introduced with phrases like "my name is". This filtering is pattern matching, not anonymisation. Aura's server does not store the text; the conversation stays in your browser tab (sessionStorage) until you close it or sign out.
- Product analytics (PostHog, EU cloud): off. When on, it would send only a fixed list of
events, either without any storage on your device or only after your consent.
- Sign in with Google, a public routing service (
router.project-osrm.org), Mapbox
directions and paid plans (Stripe): off.
6. Sharing a trip by link (view only)
When you share a trip, the shared content is written into the link itself, after the # sign. Browsers do not send that part to a server, so Aura does not receive, store or log the shared trip. A link cannot be withdrawn once sent and does not follow later changes. It never contains bookings, references, costs or budget, who travels with you, your notes, or any account or trip id. You choose whether it shows exact dates, the day plan and the trip name. Apps you use to send the link may store it under their own policies. The shared page asks search engines not to index it.
7. Your rights
You can ask to access your data, receive it in a portable format, correct it, delete it, restrict its use, and object to processing based on legitimate interest (GDPR Arts. 15–21). Write to privacy@auratrip.app; we answer within one month (Art. 12(3)), and we may ask you to write from the account's email address to confirm it is you.
- Export: in the app, You → Privacy & account → Download a copy of your data downloads your
trips, saved items, changes not yet saved and your email as a file. Sign-in session details (IP address, times) are not in the file: ask at privacy@auratrip.app and we send them.
- Delete your account: You → Privacy & account → Delete account erases the account and
all its trips at once. You can also ask by email (the You page prepares the message with your account id). Deleted data leaves the backups within 7 days, and a deletion is re-applied if a backup is ever restored. You can delete single trips from Trips at any time.
- Links you have already shared are not affected, because Aura never holds them.
- Complaint: you can complain to the Italian supervisory authority, the Garante per la
protezione dei dati personali (www.garanteprivacy.it), or to the authority where you live.
Giving your email is needed only to create an account; without it you can still plan in your browser.
8. Security
Data is sent over encrypted connections. Account data is readable only by its owner (row-level security). Server keys never reach your browser. If a personal data breach is likely to put your rights at risk, we will notify the Garante without undue delay and, where feasible, within 72 hours, and we will tell you directly when the risk is high (GDPR Arts. 33-34).
9. Changes
This notice changes when Aura changes what it does. The effective date at the top shows the current version. If a change matters to you, we will say so in the app before it applies.