Privacy Policy
How Aurey handles account information, conversations, reflections, and related data.
Effective date:
Who operates Aurey and how to contact us
Aurey is an AI reflection companion operated by an individual sole proprietor located in Michigan, United States. For privacy questions or requests, contact hello@aurey.app.
Who may use Aurey
Aurey is intended only for people who are at least 18 years old. New account creation asks the person to confirm that they meet this age requirement. This is a self-attestation; Aurey does not verify age with identity documents or biometrics.
Information associated with an account
An account may contain an email address, name, authentication information, account and activity timestamps, settings, communication preferences, and acquisition information. When you use Google sign-in, Aurey receives account information returned through the Google authentication flow, such as your verified email and profile name; a profile picture may also be used.
Conversations, reflections, memories, and imports
Aurey stores account-associated conversations and messages, reflections, saved memories and related embeddings, identities, imported-content records or derived memories, and feedback so the corresponding features can work. Conversation context and saved memories may be used to support later responses.
AI processing
When you use chat, reflection generation, quiz scoring, memory extraction, or another AI feature, the text needed for that operation may be sent to the AI provider configured for that environment. Memory embeddings are generated by the application's configured embedding model. The provider, model configuration, processing locations, and retention terms depend on the configuration in use. This policy does not specify a fixed deletion or retention period for data submitted to a particular provider.
Imported documents
The memory-import feature accepts supported text and document formats subject to an 8 MiB upload limit and extracts up to 9,600 characters for memory processing. Extracted text may be sent to the configured AI provider to identify candidate memories. The application stores resulting account-associated data and import records. Temporary-file handling and deployment-level copies depend on the environment and service configuration. Do not upload information you are not entitled to share.
Voice input and transcript correction
If you use browser speech recognition, audio processing is handled by the browser and its speech-recognition service according to that service's behavior and settings. Aurey does not use its transcript-correction request to send browser audio. If optional transcript correction is enabled, Aurey sends the finalized recognized words to its configured AI provider for editing. The result remains an editable draft and is saved as a chat message only if you choose to send it. Aurey does not separately save the correction request or response. The provider's own terms and retention practices apply to text it receives.
Quiz responses
Quiz answers are held in page state while the quiz is in progress and are sent to the configured scoring model to produce a result. The result is held in browser session storage for the current tab session. New quiz submissions are not currently saved to the application database. Historical records created by an earlier implementation may remain without account identifiers; Aurey has not established a retention schedule for those records.
Feedback, waitlist requests, and email preferences
If you submit in-account feedback, Aurey stores its category and message with your account. Your email is included for follow-up only when you give permission for contact about that feedback. A separate beta waitlist request may store a normalized email, request consent and time, optional product/beta or promotional preferences, self-reported acquisition source, separate campaign attribution values, status, and timestamps. Duplicate waitlist submissions preserve the original record.
Brevo and communications
When Brevo synchronization is enabled, Aurey may send contact information, acquisition source, relevant timestamps, feedback-submission status, and explicitly selected communication preferences to Brevo. Aurey checks provider suppression information before certain existing-contact updates and skips synchronization when the status cannot be verified. Application synchronization does not itself mean a campaign was sent; campaign or automation activity depends on separately configured Brevo settings. Unsubscribe and suppression records may be retained by Brevo independently of Aurey's account data.
Cookies and browser storage
The application uses browser storage for application state. The regular authentication flow stores a token in local storage; Google OAuth uses a session cookie, and temporary OAuth state and quiz results use session storage. The precise cookie behavior can vary with authentication flow and deployment security settings. Aurey does not currently include an application analytics SDK. Hosting and service providers may process technical information needed to operate, secure, and maintain the service.
Service providers and hosting
Aurey uses Google for Google authentication, MongoDB for application records, configurable AI and embedding providers for relevant features, and Brevo for optional contact synchronization when enabled. Hosting services, processing locations, and provider terms depend on the environment and feature configuration.
Retention and deletion
Account information is generally kept while an account exists, subject to the controls described here and applicable requirements. You can delete individual chats, memories, identities, and reflections, and request account deletion in Settings. Account deletion removes user-associated application records and sessions through a multi-collection process that is not transactional, and Aurey attempts Brevo contact deletion on a best-effort basis.
Limits of deletion and current data controls
Account deletion does not currently delete a separate waitlist record with the same email. Historical anonymous quiz records may remain from an earlier implementation. Deletion from operational logs, backups, and independent provider systems is not established by the in-app deletion controls. No user-facing data-export feature or fixed retention schedule is currently implemented.
Security and processing locations
Aurey uses account authentication and account-scoped application features, and deployment configuration can use HTTPS. No statement here guarantees absolute security, encryption at rest, a particular data-center location, or a specific international-transfer mechanism. Those details depend on the production configuration and provider arrangements and are not specified here.
Privacy requests and policy changes
For a privacy question or request, contact hello@aurey.app. Aurey will review requests in light of applicable requirements and the information available. Aurey does not currently offer a user-facing data-export feature or publish a specific response period for requests.