Privacy Policy

This Privacy Policy explains how Auraverse LLC, an Oregon limited liability company (“Auraverse,” “we,” “us”), collects, uses, shares, and protects information about you when you use the Auraverse website and services (the “Service”). The Service is operated from the United States and is intended for users in the United States; this Policy is written with U.S. law in mind, including the California and Oregon privacy laws described in Section 11. By using the Service you agree to this Policy.

1. Information we collect

• Account information. When you register, our authentication provider (Clerk) collects information such as your email address and display name, and any details you choose to add.
• Age information. When you create an account we collect your date of birth to confirm you meet our minimum age of 18. We store the date you give us and derive your age from it on our servers; we do not display it, share it, or use it for any purpose other than eligibility, the protections described in Section 3 and Section 12, and the age verification described below. If you tell us you are under 18, account creation is declined and we keep nothing about the attempt. If you choose to verify that you are 18 or older to unlock companion features and adult content latitude, we also store the outcome of that check, when it happened, and our verification provider’s reference number for it — never the documents or images you submit (see Section 7).
• Billing information. If you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details on our behalf. We do not store full payment card numbers; we receive limited information such as subscription status and the last four digits of your card. If you enable metered voice overage, we share your voice-minute usage with Stripe so it can be billed.
• Content you provide. The messages and prompts you send to AI artists, the songs you like, and other content you submit. Chat content is used to power features such as conversational memory and personalization, and is screened by our automated safety systems. When those systems detect a safety concern we record an event about it — the category and our confidence, not the text of your message (see Section 8).
• Voice data. If you use voice features, your audio is processed in real time by our voice provider to power the conversation. After each call, a text transcript of the conversation is stored alongside your chat history. Transcripts are used the same ways as text chats — including artist memory and personalization (see Section 3) — and are screened by our automated safety systems. We also record the duration of each call to meter your voice usage for quota and billing purposes. We store transcripts and call durations, not audio recordings.
• Listening history. When you play a song we record that you played it and when. On the Stargaze feed we also record how long each listening session lasted and how many song clips you played or skipped. We use this to show you what you have been listening to — your personal galaxy sizes each artist’s star by how much you have played them — to rank what is popular on the Service, and to recommend music (see the next bullet). Your listening history is deleted when your account is deleted.
• Taste profile. We build a profile of your music taste so we can recommend artists and songs. It is derived from what you listen to, like, dislike, follow, chat with, and the preferences you pick during onboarding, and it includes a mathematical representation of the styles you gravitate toward and the ones you avoid. It is used only to personalize the Service for you. It is never given to advertisers and is never used to target advertising (see Section 6), and it is deleted when your account is deleted.
• Usage and device data. Logs such as the artists you interact with, pages viewed, actions taken, browser and device type, and timestamps. IP addresses are processed transiently for security and rate-limiting and are not retained or stored with your account.
• Advertising data. Records of the ads shown to you on ad-supported plans — that an ad was requested, started, skipped, completed, or clicked — together with the ad session identifier described in Section 5. See Section 6.
• Referral information. If you create an account after following a share link, we record which share brought you in so we can credit the person who shared it. That record links your account to that share. It is deleted when your account is deleted.
• Embedded player. Songs can be embedded on other websites. When our embedded player loads on a third-party page we receive the same basic request information any web server receives, and we count plays for the shared song. You do not need an account to use an embedded player, and we do not use it to build a profile of you or to identify you across other sites.
• Appeals. If your account is suspended and you submit an appeal, we store what you write, a snapshot of the reason for the suspension, and any note we add while reviewing it. This is used only to review the appeal, and it is deleted when your account is deleted.
• Cookies and similar technologies. Used to keep you signed in, remember preferences, understand usage, and — when advertising is enabled — limit how often you see the same ad. See Section 5 and our Cookie Policy.

2. How we use information

• To provide, operate, maintain, and improve the Service.
• To personalize the artists you encounter and recommend music.
• To process payments and manage your subscription.
• To deliver and measure advertising on ad-supported plans, and to limit how often you see the same ad (Section 6).
• To communicate with you, including support and service notices.
• To detect, prevent, and address abuse, fraud, and security issues.
• To comply with legal obligations and enforce our terms and policies.

3. Artists remember what you tell them

Long-term memory — what we call companion features — is available on any plan, free or paid, to users who have completed third-party identity verification confirming they are 18 or older. Holding an account already requires you to be 18 or older; this is a second, separate step. It is never available to anyone under 18. With companion features, artists remember your conversations across sessions — including personal stories, events, and preferences you choose to share — so they can pick up where you left off. These memories are stored with the artist you shared them with, together with records our systems derive from your conversations (such as summaries), and are used only to personalize your experience on the Service. You stay in control: Forget Me (Settings → Privacy) erases the memories artists hold about you while keeping your account active, and deleting your account erases them as well. See Sections 8 and 10 for retention details and all of your self-serve controls.

Every account holder who has not completed that check gets informational chat: the artist discusses its own backstory and catalog and does not carry a personal memory of you between conversations, and a new conversation begins after a period of inactivity. Unverified accounts also run with conservative content defaults, described in our Content & AI Policy.

If you lose companion features — for example, if your verification is reset by a consistency check or an administrator action — the memories described above are preserved but made inaccessible, not deleted, until you regain them (for example, by verifying again), at which point they become accessible again automatically. If you would rather have those memories deleted than paused, use Forget Me or delete your account (see Sections 8 and 10).

4. AI processing

The Service uses third-party foundation models from major AI providers to generate artist responses, voices, and other content. Your prompts and messages may be transmitted to these providers to generate outputs. We do not train our own models on your content, and we do not authorize our model providers to use your content to train their models. Refer to each provider’s policies for how they handle inference data.

5. Cookies and similar technologies

We use cookies and similar technologies — including browser local storage — to run the Service. Our Cookie Policy lists each one, what it is for, and how long it lasts. In summary:

• Sign-in cookies set by our authentication provider (Clerk) to keep you signed in.
• A short-lived sign-in return cookie (__return_to, 45 minutes) that returns you to the page you were viewing after you sign in.
• A short-lived share-attribution cookie (share_ref, 30 minutes) that lets us credit a sign-up to a shared link you followed.
• An ad session identifier (aura-ad-session, stored in your browser’s local storage) — a random, opaque value with no personal information in it. It exists so we can limit how often the same ad is shown to the same browser, including when you are signed out. It is first-party and is not used to track you across other websites.
• Your advertising opt-out (aura-ad-opt-out, browser local storage) — set only if you use the “Do Not Sell or Share My Personal Information” control in Section 11. It records that one choice so this browser keeps applying it, including when you are signed out.
• Cookies set by Stripe during checkout and subscription management.
• An analytics identifier (ph_[our project key]_posthog, a cookie with matching browser local storage) set for PostHog, our product-analytics provider — a random, first-party value used to understand how the Service is used and whether people come back. It honors your browser’s “Do Not Track” setting and is not used to track you across other websites. Our hosting provider, Vercel, also counts page views and referrers cookielessly — nothing is stored on your device for that.
• A channel-attribution cookie (aura_ref, 30 days) that remembers which link or campaign brought you to the Service, plus small first-party local-storage markers (aura_first_seen, aura_fnl_…) so first-time actions are counted only once. The Cookie Policy lists each of these.

Our contact form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a bot. Turnstile sets no tracking cookies; it receives your IP address and basic browser signals solely to score that check.

When advertising is enabled on ad-supported plans (Section 6), our advertising and consent partners may also set advertising, measurement, and consent cookies in your browser. Those categories, and what activates them, are described in the Cookie Policy. You can control cookies through your browser settings, though the Service may not function without the sign-in cookies.

6. Advertising

The Service is ad-supported on its free plans. Signed-out visitors and free (“fan”) accounts may be shown advertising — video ads in the listening feed and audio ads between songs. Paid Patron plans are ad-free. Two kinds of ads may appear:

• Our own ads (house ads) — promotions for Auraverse, our artists, or a sponsor we deal with directly. These are chosen on our servers from information we already hold (your plan, which slot is being filled, and how many ads you have already seen). No advertising network is involved and no cross-site tracking takes place.
• Third-party ads served through an advertising network (we expect to use Google Ad Manager). Your browser contacts the network directly to fetch the ad, which gives the network your IP address, browser and device information, and the page context. That network’s own privacy policy governs what it does with those signals.

Consent. Where consent is legally required for personalized advertising, we will collect it through a Google-certified consent management platform before any third-party ad request is made, and you will be able to change your choice at any time from the consent control on the site. If consent is required and you have not given it, or you withdraw it, you will be served only our own ads or non-personalized ads. This is enforced on our servers when the ad is chosen, not left to the ad network.

What advertisers never get. We do not give advertisers or ad networks your chat messages, voice transcripts, the memories artists hold about you, your listening history or taste profile, or your email address, and we do not use any of those to target ads. Which ad you see is decided on our servers from your plan, which slot is being filled, and how many ads you have already seen — nothing else.

Measurement. We keep our own record of ad events (an ad was requested, started, skipped, completed, or clicked), linked to your account or to the ad session identifier in Section 5. We use it to report how ads and revenue are performing and to enforce frequency limits — not to build a profile of you. Every ad is labeled as an ad.

7. How we share information

We do not sell your personal information for money. We disclose information only as follows:

• Service providers (processors) who help us run the Service — including authentication, payments, hosting, product analytics (PostHog, and Vercel for cookieless page-view counts), and AI model providers — under contracts that limit their use of your data to providing services to us.
• Persona, our identity-verification provider, if you choose to verify that you are 18 or older to unlock companion features and adult content latitude (Section 3). Persona checks your age through its own hosted flow. We receive and store only the outcome of the check, a timestamp, and Persona’s reference number for it. We never receive or store the identity documents, selfies, or other identifying information you submit to Persona, and none of it is used for advertising. Persona permanently redacts the documents and selfie you submit within 48 hours of the check reaching a decision. Only non-identifying records of the check — timestamps and event history — remain after that. Verification is optional and is never required to create an account, listen, or subscribe.
• Advertising partners — when a third-party ad is served to you, your browser’s request reaches the ad network directly, giving it the signals described in Section 6. Under California law, serving personalized ads this way can count as “sharing” personal information for cross-context behavioral advertising. It happens only where consent or your opt-out choice permits it; Section 11 explains how to opt out.
• Legal and safety — when required by law or to protect the rights, safety, and security of users, the public, or Auraverse.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

8. Data retention

We keep personal data for as long as needed to provide the Service and for legitimate business or legal purposes (such as security, dispute resolution, and compliance). When data is no longer needed, we delete or de-identify it. You can request deletion as described in Sections 10 and 11. Exceptions to note:

• Deletion grace period. Account deletion takes effect in stages: your account is deactivated immediately, and your remaining data is permanently deleted after a 30-day grace period during which you can reactivate (see Section 10).
• Safety records. When our safety systems detect a safety event (such as a crisis intervention), we retain a de-identified record of the event after account deletion to meet safety-reporting obligations under applicable law.
• Derived memory records. Forget Me and account deletion erase the memory records derived from your conversations (see Section 3). A limited set of historical memory records created before this erasure tooling existed are no longer linked to any account; they cannot be attributed to you and are retained only in that de-identified form.
• Companion-feature memory while paused. If you lose companion features (Section 3), the memories described there are retained but inaccessible for as long as your account exists, and become accessible again automatically if you regain companion features. They are permanently erased if you use Forget Me, or when the account-deletion process completes.
• Advertising records. Ad event records (Section 6) are kept for reporting and billing-integrity purposes. After account deletion they are retained only in a form that is not linked to your account.

9. Security

We use reasonable technical and organizational measures to protect personal data, but no system is perfectly secure. We operate in the United States, and your information is stored and processed in the United States.

10. Your rights and choices

You can exercise your main privacy rights yourself, directly in the app, from Settings → Privacy:

• Export my data — request a copy of your data (profile, conversations and voice transcripts, the memories artists hold about you, your listening history and taste profile, likes, dislikes, follows, playlists, your constellation, and more). We prepare the export and notify you with a download link that stays available for 24 hours.
• Forget Me — erase the memories artists hold about you (Section 3) without deleting your account.
• Delete my account — start account deletion. Your account is deactivated and any subscription is cancelled immediately; remaining data is permanently deleted after the 30-day grace period described in Section 8, during which you can reactivate. Reactivation does not restore memories that were already erased. Accounts that own platform resources (such as artists or creator tools) cannot self-delete and should contact support instead.

You can also stop seeing ads entirely by subscribing to a Patron plan, and adjust your advertising consent choices as described in Sections 6 and 11.

Depending on where you live, you may also have rights to access, correct, delete, or obtain a copy of your personal data. You can always contact us using Section 13 as an alternative to the self-serve tools, and we will respond as required by applicable law.

11. State privacy rights (California and Oregon)

If you are a California resident, you have the right to know what personal information we collect and how we use it; to request access to and deletion of your personal information; to correct inaccurate information; to opt out of the “sale” or “sharing” of personal information; and to not be discriminated against for exercising your rights. We do not sell personal information for money. California treats disclosures for cross-context behavioral advertising as “sharing,” and personalized third-party advertising can fall into that category (Sections 6 and 7).

We provide a “Do Not Sell or Share My Personal Information” control. It is linked in the footer of every page and also lives at Settings → Privacy. You do not need an account to use it. We also honor Global Privacy Control (GPC) browser signals as an opt-out request on their own — if your browser or extension sends one, you are opted out without using the control at all. Your choice is enforced on our servers when an ad is selected, not by the browser: once you have opted out, we do not release an advertising network’s tag for you, so no third-party ad request is made on your behalf.

Opting out does not remove ads — it leaves you with our own ads or non-personalized ads, and it never costs you a feature, a price, or a level of service. Only a Patron subscription removes advertising. If you are an Oregon resident, the Oregon Consumer Privacy Act provides similar rights of access, correction, deletion, portability, and opt-out of targeted advertising; the same control and the same GPC handling satisfy that opt-out, so there is nothing separate to do. The self-serve tools in Section 10 are the fastest way to exercise your other rights; you can also contact us using Section 13, in which case we may need to verify your identity before responding.

12. Children and minors

The Service is intended for users age 18 and older and is not directed to minors. We do not knowingly collect personal information from anyone under 18, and account creation is declined for anyone who tells us they are under 18 — we keep nothing about a declined attempt. If we learn that an account belongs to someone under 18, we remove it. If you believe a person under 18 has provided us personal information, contact us using Section 13 and we will take appropriate steps to delete it.

Because the Service does not admit anyone under 18, we do not expect to hold any minor’s data. The protections we built for minors nonetheless remain in the product and apply to any account we come to know belongs to someone under 18: no companion features under any circumstances, the content and safety protections described in our Content & AI Policy, and the same advertising limits as below. We do not market or promote companion or relationship features to users we know to be under 18.

We do not serve personalized or third-party network advertising to users we know to be under 18, and we never use a user’s age, date of birth, or verification status to target advertising. Minors on ad-supported plans may still see our own promotions for Auraverse and its artists, which are chosen on our servers without any advertising network involved (Section 6).

13. Contact us

For privacy questions or to exercise your rights, email support@auraverse.fm or use our contact page. Auraverse LLC is the controller responsible for your personal data.

14. Changes

We may update this Policy from time to time. We will update the “Last updated” date above and, for material changes, provide notice to active accounts.