Legal
Privacy Policy
Last updated: 2026-08-25 — GDPR Compliant
1. Who We Are
auraOrNot ("we", "us") is the controller of your personal data for the purposes of the General Data Protection Regulation (GDPR) and applicable national law.
2. Data We Collect
| Category | Data | Purpose | Legal Basis |
|---|---|---|---|
| Account | Email (encrypted), username, birth year, country at registration | Authentication, age verification | Contract (Art. 6(1)(b)) |
| Content | Images you upload, YouTube video links | Platform operation | Contract (Art. 6(1)(b)) |
| Activity | Votes, battle participation, ELO scores | Platform features | Contract (Art. 6(1)(b)) |
| Technical | IP address (at registration for geo-detection), session cookies | Security, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
3. Encryption
Your email address is encrypted at rest using AES-256-GCM. We store only a SHA-256 hash of your email for uniqueness checks. Passwords are hashed using bcrypt (cost factor 12). We never store plaintext sensitive data.
4. AI Training (Optional)
If you explicitly opt in during registration or via Settings → Privacy, your uploaded content may be used to train AI systems for aura recognition. This is processed on the basis of your explicit consent (UK GDPR Article 6(1)(a) and, where biometric data is involved, Article 9(2)(a)). You may withdraw consent at any time. Withdrawal stops future use; technically impractical removal from already-trained model parameters is disclosed clearly in our Terms, consistent with ICO guidance on AI and erasure.
5. Your Rights (GDPR Articles 15–22)
- Access — Download all your data via Settings → Export Data.
- Rectification — Edit your profile at any time.
- Erasure — Delete your account in Settings. All personal data is removed within 30 days; anonymised aggregate statistics may be retained.
- Portability — Your data export (JSON) is machine-readable.
- Objection / Restriction — Contact us to restrict processing.
- Withdraw consent — Deregister at any time; this does not affect lawfulness of prior processing.
6. Content Reports (Right to Erasure for Third-Party Content)
If you believe content on our Platform features you without your consent, submit an anonymous content report. We review all such reports and aim to act within 72 hours.
7. International Transfers
Data may be processed by Cloudinary (US) or AWS (EU region). Cloudinary is compliant with the EU-US Data Privacy Framework. AWS EU (eu-west-1) is within the EEA.
8. Cookies
We use strictly necessary httpOnly session cookies for authentication. No advertising or third-party tracking cookies are set.
9. Data Retention
Account data is retained for as long as your account exists, plus 30 days after deletion. Anonymised aggregate statistics may be retained indefinitely. Ban records (email hash only) are retained permanently to prevent re-registration.
10. Supervisory Authority
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your national data protection authority (e.g. AEPD in Spain, CNIL in France).