1. Who we are
AuraCat is operated by AuraMind Studio, the trading name of an independent
app developer based in Vietnam. In this policy, "AuraCat", "we",
"us", and "our" mean AuraMind Studio and the AuraCat mobile app
identified by the package name com.auramind.auracat. AuraCat's current intended
distribution excludes the European Union, Iceland, Liechtenstein, Norway and
the United Kingdom. It is not intended for new use in these markets at this time.
Requests relating to previous use remain available through our contact addresses;
this scope does not remove rights provided by applicable law.
Privacy questions, deletion requests, and data export requests can be sent to
privacy@auracat.app.
Support questions can be sent to
support@auracat.app.
2. Data we collect
- Former website launch list
- For prior signups: the submitted email, signup time, former form source and approximate country supplied by Cloudflare. Former signup rate-limit hashes expired after 10 minutes. These records do not contain your raw IP address or create an app account. New signups are closed.
- Account data
- Account identifiers, email if you sign in with email, an app-generated installation identifier, app-generated user IDs, app version and basic device class. Backend-requiring actions may register an app installation before an email sign-in.
- Cat profile data
- Cat name, optional birthday, the date your cat came home and its recorded precision, breed, coat notes, personality tags, and choices you make in the creation flow.
- Cat photos
- Photos you choose to upload or capture in the app, after the app strips image metadata where supported.
- Generated outputs
- Catsona cover images, theme songs, captions, share videos, library metadata, and remix metadata.
- Purchases
- Product IDs, receipt status, entitlement status, refund status, Cat Treats grants, reservations, spends, releases, and balance history.
- Diagnostics
- Server logs, purchase and generation metrics, fraud-prevention and platform-integrity signals, plus crash and error diagnostics where enabled. We do not use a third-party product-analytics or advertising-tracking SDK.
- Push notification token
- If you allow notifications, a Firebase Cloud Messaging registration token plus the platform and device locale, linked to your user ID and used only to tell you a generation has finished. It is a delivery address, not an advertising identifier.
Before a backend-requiring action, local cat profiles, selected photos and play state
may be stored on your device. Browsing and selected free Play or local CatDJ do not
require an email account. When you use save, generation, purchase or other backend
features, the data needed for that action is sent to AuraCat's services.
Our hosting provider processes website request information, including network address
and security signals, to serve and protect this site. The site does not use advertising
trackers or marketing cookies.
We do not collect precise location, contacts, advertising identifiers, health data,
financial account numbers, or your full photo library. We access only the photo
you choose for AuraCat.
3. How we use data
- To manage or remove entries from the former website launch list and respond to related requests.
- To create your requested Catsona artwork, theme song, caption, share video, and remix.
- To save your cat profiles, library, and Cat Treats balance.
- To process purchases, restores, refunds, and entitlement checks.
- To keep generated assets private unless you choose to share them.
- To prevent abuse, duplicate spending, refund fraud, and unsafe or copyrighted generations.
- To respond to support, privacy, deletion, and data export requests.
- To fix bugs, monitor reliability and understand service usage through operational records such as purchases and generations.
4. AI processing
AuraCat uses AI providers to produce the content you request. Cat photos and
profile details may be sent to OpenAI for image analysis, artwork, lyrics and captions.
Theme-song prompts may be sent to Google Vertex AI / Lyria for music generation.
Pre-produced AuraCat Songs and CatDJ base assets may be created with music tools
such as Suno, but those production batches do not receive your personal cat data.
AuraCat does not use your photos, prompts or generated outputs to train models. We
use provider APIs whose business terms restrict training use without permission.
Providers may retain limited request data for safety, abuse monitoring or legal
requirements; no-training is not a promise of zero retention. We also avoid prompts that imitate famous artists, copyrighted lyrics,
copyrighted melodies, medical claims, or unsafe content.
5. Sharing and visibility
Your cat profiles, source photos, generated outputs, and library items are private
by default. You choose whether to download or share an output. Sharing uses the iOS or Android
system share sheet. Once you share an output outside AuraCat, that external
service handles the copy you sent according to its own policies.
6. Payments and Cat Treats
Purchases are processed by Apple App Store or Google Play, with RevenueCat helping
AuraCat verify receipts and entitlements. We receive purchase status, product IDs,
transaction identifiers, country or region, refund status, and entitlement state.
We do not receive your payment card, bank account, or store account password.
Cat Treats are server-owned. Failed system or provider generations release reserved
Cat Treats back to your balance. A refund or chargeback removes the purchase's unspent
Cat Treats; any from it you already used become a debt, repaid automatically from Cat
Treats you hold or buy later.
Where a store requests it and applicable consent requirements are met, we and
RevenueCat may share available purchase and consumption information to help the store
review a refund. This does not include your cat photos or generated creations.
7. Processors we use
We use trusted processors to run the app, including Supabase for auth and database
services, Cloudflare for hosting and object storage, OpenAI and Google Cloud / Vertex
AI for hosting and generation, RevenueCat for purchases and entitlements, Apple and Google for
store payments, Firebase Cloud Messaging (Google) for delivering the notification
that your generation is ready, and Sentry (EU region) for crash and error
diagnostics where configured. Providers process data under their applicable service
agreements, including security and legal obligations. Store payments are also governed
by Apple's and Google's own privacy terms.
We do not sell personal data. We do not share personal data with ad networks.
8. Retention and deletion
Former website launch-list signup records are stored in Cloudflare and have no
automatic expiry. To remove your launch-list entry, email
privacy@auracat.app
from the address you submitted. You do not need an app account to make
this request.
Cat profiles and generated outputs remain available until you remove the profile,
request removal of particular outputs or delete your account. Removing a cat profile
in the app removes its source photo and frees its profile slot, while previously
generated keepsakes stay in Memories. Unused uploads may be removed during cleanup.
Once the server accepts an in-app account deletion, account access is immediately disabled and
associated data is removed from normal app access. Source photos and generated media
are queued for storage deletion after a 24-hour grace period. Removing content from
app access and deleting storage copies are separate steps. We aim to complete verified
deletion requests within 30 days, except records retained for billing disputes,
fraud prevention, security or legal obligations. Limited purchase and ledger audit
records may be retained for up to 7 years. Other records, including provider-execution
metadata, may be retained for necessary operational or legal purposes; you can request
review or removal by contacting privacy@auracat.app.
Provider-held data and managed backups follow the provider's applicable retention rules.
To delete your account, use Account & Subscription in the AuraCat app, visit
auracat.app/delete-account,
or email
privacy@auracat.app.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, export, delete,
restrict, or object to certain processing of your personal data. AuraCat accepts
these requests globally through
privacy@auracat.app.
We may ask you to verify the request using the email or account identity linked to
your AuraCat account. If you have not linked an email, contact us for a supported
identity-verification path. Do not email your password, reset link or purchase credentials.
We aim to acknowledge privacy requests within 72 hours and complete them within
30 days unless the request is complex or law allows more time. If we need more time,
we will tell you why.
If a privacy law applies to your data, you may also complain to your local
data-protection authority. Our intended distribution excludes the EU/EEA and UK;
if rights under those laws apply to you, contact us to exercise them. The
European Data Protection Board
lists EU/EEA authorities, and the
ICO
provides information for the UK.
10. Children
AuraCat is intended for users aged 18 or over. We do not knowingly collect personal
data from children. If you believe a child has provided personal data, contact
privacy@auracat.app so we can investigate and handle the removal request.
11. Security
We use encryption in transit, private storage, signed URLs for generated assets,
account-scoped authorization, server-side credit validation, receipt verification,
and limited access controls. No internet service can guarantee perfect security,
but we design AuraCat so cat photos, generated outputs, purchases, and ledger records
are protected by default.
12. Push notifications
AuraCat sends push notifications for one thing: telling you that a generation you
started has finished or failed. There are no marketing pushes, no re-engagement
nudges, and no reminders asking you to come back.
Push is opt-in. The app asks for notification permission through your operating
system, and everything else keeps working if you decline. To deliver a notification
we store a Firebase Cloud Messaging registration token, the platform, and the device
locale, linked to your user ID. Firebase manages the token on the device and AuraCat
registers it with the backend for delivery. It is a notification delivery address,
not an advertising identifier.
To deliver a generation update, we send Firebase your notification token, generation
identifier and status, a navigation link, and notification text rendered by the server
in your registered app language. Notification payloads do not include your cat photo
or generated artwork. You can revoke permission in your phone settings at any time;
account deletion removes the registered tokens.
13. Changes to this policy
We may update this policy as AuraCat changes. If we make material changes, we will
update the effective date and provide notice in the app or by email when required.
14. Contact
