Privacy Policy

This Privacy Policy describes how Aura Link, Inc. (“we,” “us,” “our”) collects, uses, and shares personal information when you use the Aura Link platform, the Sprig consumer brand and hardware, our mobile applications, our APIs, and any related services (the “Service”).

For European users, our data controller is Aura Link, Inc., reachable at [email protected]. For California users, this Privacy Policy serves as our notice at collection under the CCPA/CPRA.

1. Information we collect

We collect information in three buckets: (a) information you give us, (b) information we get from your use of the Service, (c) information we get from third parties you connect.

1.1 Information you give us

1.2 Information from your use of the Service

1.3 Information from third-party Connected Services

When you connect a Sense or third-party service, we receive only the data you authorize. Connected services currently include Google (Sign-In, Calendar), Microsoft Outlook Calendar, Apple Health (iOS), Android Health Connect, Fitbit, Oura, Whoop, Garmin, Strava, and Spotify. Weather, air-quality, and news Senses use the location or region you provide rather than an account connection. Calendar data we read includes event titles, times, locations, descriptions and the number of attendees.

If you enable Apple Health or Health Connect in the mobile app, the health data types you authorize (such as steps, sleep, heart rate, heart-rate variability, workouts, weight and height) are synced to our servers and stored in your account.

You may disconnect any Connected Service at any time in account settings. Disconnecting deletes our stored access tokens for that service immediately. Health data synced from your phone is kept for 90 days and location history for 30 days (see section 7), or until you delete your account if sooner. You can also revoke Aura’s access in the provider’s own settings.

If you enable a voice for an Aura, the text of its replies is sent to a text-to-speech provider to generate audio. We do not record your voice. In the mobile app, product analytics (PostHog) start after a one-time notice, are linked to your account ID (not your email), and can be turned off in Settings → Usage analytics.

1.4 Sprig hardware data

Sprig hardware is not yet available. When it is, the following will apply. Because hardware data is a heightened category, we treat it explicitly:

• What’s collected: soil moisture, light, ambient temperature, device state. Not sound, video, or GPS — the Stake doesn’t have a microphone, camera, or GPS.
• Where it goes: to your account in our backend; to the AI models we use to generate plant messages; never to advertisers; never to third parties for their own use.
• How long: sensor readings are retained for 2 years for trend graphing, then aggregated into rolling averages.

1.5 Google user data

If you sign in with Google or connect Google Calendar, Aura accesses only the following Google user data:

• Google Sign-In: your name, email address and profile picture, used to create and secure your account.
• Google Calendar (read-only): the title, time, location, description and number of attendees of events on your primary calendar, used so your Auras can mention and plan around your upcoming events.
• Adding events (optional): only if you turn on “Let Aura add events” in Settings, Aura asks Google for permission to add events. Your Aura can then suggest an event in chat, and it is added to your primary calendar only when you tap “Add”. Aura never changes or deletes existing events. You can turn this off in Settings at any time.

Calendar details are stored in your account only as long as needed to provide this feature, and they’re sent to our AI provider (Anthropic) to generate your Aura’s replies. We don’t use Google user data for advertising, we don’t sell it, we don’t use it to train AI models, and our staff don’t read it except with your permission, for security, or to comply with the law. You can disconnect Google Calendar in Aura at any time, or remove Aura’s access at myaccount.google.com/permissions.

Aura’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Information we do not collect

To be explicit:

• We do not collect biometric identifiers (face, fingerprint) for authentication beyond what your device’s OS handles locally
• We do not collect precise GPS location unless you’ve added the Location Sense and granted permission
• We do not record audio or video without your explicit per-feature opt-in
• We do not collect children’s data knowingly (under 13)

3. How we use information

After you sign up, we send onboarding and product emails (for example tips, reminders to create an Aura, and plan-upgrade information) unless you unsubscribe using the link in any of those emails. Unsubscribing doesn’t stop account emails such as password resets and receipts. If you enable email notifications, messages from your Auras (which may reference your Sense data) are delivered to your inbox through our email provider.

We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising as defined by CCPA.

3.1 Lawful bases (EU/UK)

For users in the European Economic Area, UK, or Switzerland, our lawful bases under GDPR are:

4. Sub-processors and third parties

We share information with the following service providers:

We do not transfer personal data to a sub-processor without contractual data-protection guarantees (DPAs, SCCs for international transfers).

5. Cookies and tracking

The Service uses four categories:

• Strictly necessary — login session, security. No consent required.
• Preferences — UI theme, locale, dismissed banners. Set when you make a choice.
• Analytics — Google Analytics and PostHog, only set if you consent through our cookie banner. No advertising or cross-site tracking cookies.
• Personalization — only set if you consent; remembers your first name for one year so our website can greet you.

6. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — request a copy of your personal information
• Correction — fix inaccurate information
• Deletion — request deletion of your account and personal information
• Portability — receive your data in a structured, machine-readable format
• Restriction — ask us to limit how we use your data
• Objection — object to certain processing
• Withdraw consent — for processing based on consent
• Lodge a complaint — with your local supervisory authority (EU/UK)
• Opt-out of sale/share — California (we don’t, but we honor the request as a no-op confirmation). See Do Not Sell or Share.

To exercise rights, email [email protected] or use the in-app account settings. We will respond within 30 days (extendable to 60 for complex requests).

7. Data retention

8. International data transfers

Our primary data hosting is in the United States. For users outside the US:

• EU/UK transfers: Standard Contractual Clauses (SCCs) and/or EU-US Data Privacy Framework
• Additional safeguards: at-rest and in-transit encryption, contractual restrictions on sub-processor access

9. Security

We implement industry-standard security measures:

• TLS for all data in transit
• Encryption at rest
• Hashed passwords (bcrypt-equivalent via Supabase Auth)
• Row-Level Security policies on all customer data tables
• Service-role-only access for sensitive operations
• Rate limiting, captcha (Turnstile) for abuse-prone endpoints

We will notify affected users and applicable authorities within 72 hours of confirming a personal data breach where required by law. Report concerns to [email protected].

10. Children

The Service is not directed to children under 13. Per COPPA in the US, we do not knowingly collect personal information from children under 13. If we learn we have, we will delete it promptly.

11. Automated decision-making and AI

Aura uses AI models to generate companion responses. These are not used for fully automated decisions producing legal or similarly significant effects on you.

We do not use your data to train third-party AI models without your explicit opt-in consent. Where we use third-party AI providers, we contractually require them to refrain from training on your data.

12. Changes to this Privacy Policy

If we make material changes, we will notify you (email or in-app banner) at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

• General privacy questions: [email protected]
• Data Protection Officer (when appointed): [email protected]

Appendix A — California Notice at Collection

For California residents, the categories of personal information we collect:

We do not sell or “share” personal information. To exercise the right to limit use of sensitive personal information, see Do Not Sell or Share.