Privacy Policy

This Privacy Policy explains how Auraverse LLC, an Oregon limited liability company (“Auraverse,” “we,” “us”), collects, uses, shares, and protects information about you when you use the Auraverse website and services (the “Service”). The Service is operated from the United States and is intended for users in the United States; this Policy is written with U.S. law in mind, including the California and Oregon privacy laws described in Section 11. By using the Service you agree to this Policy.

1. Information we collect

• Account information. When you register, our authentication provider (Clerk) collects information such as your email address and display name, and any details you choose to add.
• Billing information. If you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details on our behalf. We do not store full payment card numbers; we receive limited information such as subscription status and the last four digits of your card. If you enable metered voice overage, we share your voice-minute usage with Stripe so it can be billed.
• Content you provide. The messages and prompts you send to AI artists, the songs you like, and other content you submit. Chat content is used to power features such as conversational memory and personalization.
• Voice data. If you use voice features, your audio is processed in real time by our voice provider to power the conversation. After each call, a text transcript of the conversation is stored alongside your chat history. Transcripts are used the same ways as text chats — including artist memory and personalization (see Section 3) — and are screened by our automated safety systems. We also record the duration of each call to meter your voice usage for quota and billing purposes. We store transcripts and call durations, not audio recordings.
• Usage and device data. Logs such as the artists you interact with, pages viewed, actions taken, browser and device type, and timestamps. IP addresses are processed transiently for security and rate-limiting and are not retained or stored with your account.
• Advertising data. Records of the ads shown to you on ad-supported plans — that an ad was requested, started, skipped, completed, or clicked — together with the ad session identifier described in Section 5. See Section 6.
• Cookies and similar technologies. Used to keep you signed in, remember preferences, understand usage, and — when advertising is enabled — limit how often you see the same ad. See Section 5 and our Cookie Policy.

2. How we use information

• To provide, operate, maintain, and improve the Service.
• To personalize the artists you encounter and recommend music.
• To process payments and manage your subscription.
• To deliver and measure advertising on ad-supported plans, and to limit how often you see the same ad (Section 6).
• To communicate with you, including support and service notices.
• To detect, prevent, and address abuse, fraud, and security issues.
• To comply with legal obligations and enforce our terms and policies.

3. Artists remember what you tell them

Long-term memory is a core feature of Auraverse. Artists remember your conversations across sessions — including personal stories, events, and preferences you choose to share — so they can pick up where you left off. These memories are stored with the artist you shared them with, together with records our systems derive from your conversations (such as summaries), and are used only to personalize your experience on the Service. You stay in control: Forget Me (Settings → Privacy) erases the memories artists hold about you while keeping your account active, and deleting your account erases them as well. See Sections 8 and 10 for retention details and all of your self-serve controls.

4. AI processing

The Service uses third-party foundation models from major AI providers to generate artist responses, voices, and other content. Your prompts and messages may be transmitted to these providers to generate outputs. We do not train our own models on your content, and we do not authorize our model providers to use your content to train their models. Refer to each provider’s policies for how they handle inference data.

5. Cookies and similar technologies

We use cookies and similar technologies — including browser local storage — to run the Service. Our Cookie Policy lists each one, what it is for, and how long it lasts. In summary:

• Sign-in cookies set by our authentication provider (Clerk) to keep you signed in.
• A short-lived sign-in return cookie (__return_to, 10 minutes) that returns you to the page you were viewing after you sign in.
• A short-lived share-attribution cookie (share_ref, 30 minutes) that lets us credit a sign-up to a shared link you followed.
• An ad session identifier (aura-ad-session, stored in your browser’s local storage) — a random, opaque value with no personal information in it. It exists so we can limit how often the same ad is shown to the same browser, including when you are signed out. It is first-party and is not used to track you across other websites.
• Cookies set by Stripe during checkout and subscription management.

Our contact form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a bot. Turnstile sets no tracking cookies; it receives your IP address and basic browser signals solely to score that check.

When advertising is enabled on ad-supported plans (Section 6), our advertising and consent partners may also set advertising, measurement, and consent cookies in your browser. Those categories, and what activates them, are described in the Cookie Policy. You can control cookies through your browser settings, though the Service may not function without the sign-in cookies.

6. Advertising

The Service is ad-supported on its free plans. Signed-out visitors and free (“fan”) accounts may be shown advertising — video ads in the listening feed and audio ads between songs. Paid Patron plans are ad-free. Two kinds of ads may appear:

• Our own ads (house ads) — promotions for Auraverse, our artists, or a sponsor we deal with directly. These are chosen on our servers from information we already hold (your plan, which slot is being filled, and how many ads you have already seen). No advertising network is involved and no cross-site tracking takes place.
• Third-party ads served through an advertising network (we expect to use Google Ad Manager). Your browser contacts the network directly to fetch the ad, which gives the network your IP address, browser and device information, and the page context. That network’s own privacy policy governs what it does with those signals.

Consent. Where consent is legally required for personalized advertising, we will collect it through a Google-certified consent management platform before any third-party ad request is made, and you will be able to change your choice at any time from the consent control on the site. If consent is required and you have not given it, or you withdraw it, you will be served only our own ads or non-personalized ads. This is enforced on our servers when the ad is chosen, not left to the ad network.

What advertisers never get. We do not give advertisers or ad networks your chat messages, voice transcripts, the memories artists hold about you, or your email address, and we do not use any of those to target ads.

Measurement. We keep our own record of ad events (an ad was requested, started, skipped, completed, or clicked), linked to your account or to the ad session identifier in Section 5. We use it to report how ads and revenue are performing and to enforce frequency limits — not to build a profile of you. Every ad is labeled as an ad.

7. How we share information

We do not sell your personal information for money. We disclose information only as follows:

• Service providers (processors) who help us run the Service — including authentication, payments, hosting, and AI model providers — under contracts that limit their use of your data to providing services to us.
• Advertising partners — when a third-party ad is served to you, your browser’s request reaches the ad network directly, giving it the signals described in Section 6. Under California law, serving personalized ads this way can count as “sharing” personal information for cross-context behavioral advertising. It happens only where consent or your opt-out choice permits it; Section 11 explains how to opt out.
• Legal and safety — when required by law or to protect the rights, safety, and security of users, the public, or Auraverse.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

8. Data retention

We keep personal data for as long as needed to provide the Service and for legitimate business or legal purposes (such as security, dispute resolution, and compliance). When data is no longer needed, we delete or de-identify it. You can request deletion as described in Sections 10 and 11. Exceptions to note:

• Deletion grace period. Account deletion takes effect in stages: your account is deactivated immediately, and your remaining data is permanently deleted after a 30-day grace period during which you can reactivate (see Section 10).
• Safety records. When our safety systems detect a safety event (such as a crisis intervention), we retain a de-identified record of the event after account deletion to meet safety-reporting obligations under applicable law.
• Derived memory records. Forget Me and account deletion erase the memory records derived from your conversations (see Section 3). A limited set of historical memory records created before this erasure tooling existed are no longer linked to any account; they cannot be attributed to you and are retained only in that de-identified form.
• Advertising records. Ad event records (Section 6) are kept for reporting and billing-integrity purposes. After account deletion they are retained only in a form that is not linked to your account.

9. Security

We use reasonable technical and organizational measures to protect personal data, but no system is perfectly secure. We operate in the United States, and your information is stored and processed in the United States.

10. Your rights and choices

You can exercise your main privacy rights yourself, directly in the app, from Settings → Privacy:

• Export my data — request a copy of your data (profile, conversations and voice transcripts, the memories artists hold about you, likes, follows, and more). We prepare the export and notify you with a download link that stays available for 24 hours.
• Forget Me — erase the memories artists hold about you (Section 3) without deleting your account.
• Delete my account — start account deletion. Your account is deactivated and any subscription is cancelled immediately; remaining data is permanently deleted after the 30-day grace period described in Section 8, during which you can reactivate. Reactivation does not restore memories that were already erased. Accounts that own platform resources (such as artists or creator tools) cannot self-delete and should contact support instead.

You can also stop seeing ads entirely by subscribing to a Patron plan, and adjust your advertising consent choices as described in Sections 6 and 11.

Depending on where you live, you may also have rights to access, correct, delete, or obtain a copy of your personal data. You can always contact us using Section 13 as an alternative to the self-serve tools, and we will respond as required by applicable law.

11. State privacy rights (California and Oregon)

If you are a California resident, you have the right to know what personal information we collect and how we use it; to request access to and deletion of your personal information; to correct inaccurate information; to opt out of the “sale” or “sharing” of personal information; and to not be discriminated against for exercising your rights. We do not sell personal information for money. California treats disclosures for cross-context behavioral advertising as “sharing,” and personalized third-party advertising can fall into that category (Sections 6 and 7).

Before personalized advertising runs for California residents, we will provide a “Do Not Sell or Share My Personal Information” control in the app and will honor Global Privacy Control (GPC) browser signals as an opt-out request. Opting out does not remove ads — it leaves you with our own ads or non-personalized ads. If you are an Oregon resident, the Oregon Consumer Privacy Act provides similar rights of access, correction, deletion, portability, and opt-out of targeted advertising. The self-serve tools in Section 10 are the fastest way to exercise these rights; you can also contact us using Section 13, in which case we may need to verify your identity before responding.

12. Children

The Service is intended only for adults age 18 and older. We do not knowingly collect personal information from anyone under 18, and we do not knowingly serve advertising to anyone under 18. If you believe a person under 18 has provided us personal information, contact us and we will take appropriate steps to delete it.

13. Contact us

For privacy questions or to exercise your rights, email support@auraverse.fm or use our contact page. Auraverse LLC is the controller responsible for your personal data.

14. Changes

We may update this Policy from time to time. We will update the “Last updated” date above and, for material changes, provide notice to active accounts.