Legal

Privacy Policy

Last updated: March 6, 2026 · Effective: March 6, 2026

Summary: Aura collects only what's needed to track your finances. We never sell your data, never share it with advertisers, and you can delete everything at any time by typing /deleteaccount.

Table of Contents

01 Information We Collect 02 How We Use It 03 Data Storage 04 Data Sharing 05 Data Retention 06 Your Rights 07 Security 08 Children 09 Policy Changes 10 Contact Us

01Information We Collect

We collect the minimum data necessary to provide Aura's finance tracking features.

Data Type	What We Collect	Why
Account	Telegram ID, display name	Identify your account
Transactions	Amount, category, merchant, date, type	Core app functionality
Budgets	Category limits you set	Budget tracking feature
Preferences	Notification settings, timezone	Personalize your experience
Usage logs	Errors, timestamps (no message content)	Debugging and stability

We do not collect your bank details, passwords, payment card numbers, or the full text of your Telegram messages beyond what you explicitly send to Aura.

02How We Use Your Data

To record and display your financial transactions
To generate summaries, reports, and budget alerts
To send you notification summaries you've opted into
To improve bot accuracy and fix bugs
To respond to support requests

We never use your data for advertising, profiling, or any purpose unrelated to providing Aura's service.

03Data Storage

Your data is stored in a PostgreSQL database hosted on Railway (infrastructure provider). Database backups are stored on Cloudflare R2. Both providers maintain industry-standard security practices.

All data is stored with encryption at rest. Backups are retained for 30 days then automatically deleted.

05Data Retention

We retain your data for as long as your account is active. When you delete your account:

All transactions are permanently deleted within 24 hours
All budgets and preferences are permanently deleted
Backup copies are purged within 30 days (the backup retention window)
Anonymized error logs may be retained for up to 90 days

06Your Rights

You have the right to:

Access — request a copy of all data we hold about you
Correction — fix inaccurate data via the dashboard or bot
Deletion — permanently delete all your data by typing /deleteaccount in the bot
Portability — export your transactions to CSV from the dashboard
Objection — opt out of non-essential data processing

To delete your account and all associated data, send /deleteaccount to the Aura bot on Telegram. This is immediate and irreversible.

07Security

We take security seriously. Measures in place include:

HTTPS everywhere — all data in transit is encrypted
JWT authentication with short-lived tokens
Rate limiting on all API endpoints
Input sanitization to prevent injection attacks
Webhook signature verification for Telegram
Daily encrypted database backups

If you discover a security vulnerability, please contact us at the address below rather than disclosing it publicly.

08Children

Aura is available to all users. However, we do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete their data promptly.

09Policy Changes

If we make material changes to this policy, we will notify you via a message from the Aura bot on Telegram at least 7 days before the changes take effect. Continued use of Aura after that date constitutes acceptance of the updated policy.

10Contact Us

Questions, requests, or concerns about this privacy policy:

✉️

Aura Support

Reach us via Telegram bot or email listed in the bot's /help command