Privacy and wellness data: how Aura actually works
What is encrypted and what is not, what passes through our servers, which trackers exist and when they fire. No reassuring adjectives: the details, so you can check them.
Why this article is deliberately boring
Almost every wellness app describes itself as "privacy-first". It is a phrase that means nothing checkable, and it is used equally by apps that encrypt everything and apps that encrypt nothing. Below there are no adjectives: there is a list of what happens to your data, category by category, including the less flattering parts.
What is end-to-end encrypted (and what is not)
This is the distinction almost every app blurs, often to its own advantage.
- ✓ Private chats between users are end-to-end encrypted. Content is encrypted on your device with the recipient's public key. We carry ciphertext we cannot read.
- ! Journal, mood and habits are NOT end-to-end encrypted. They are encrypted in transit and at rest by the infrastructure, but they are readable by our systems. They have to be: sentiment analysis of a journal entry runs on a server, not on your phone. You cannot analyse text you cannot read.
If you read somewhere that an app end-to-end encrypts your journal and analyses its contents with cloud AI, one of those two claims does not hold. We would rather say it ourselves than let you find out.
Where the text you send the AI goes
When you use the coach, the AI psychologist or journal analysis, your text is sent to a language model hosted on Google infrastructure for processing, and the answer comes back. That is not a detail to hide: it is the reason those features can exist at all.
The practical rule that follows applies to any app, not only ours: do not write anything to a conversational AI that you would not want processed by an external service. That goes for us, for ChatGPT, and for every assistant embedded in a wellness app.
Trackers and analytics: they exist, and they fire after consent
Aura uses third-party analytics and marketing tools — Google Analytics and the Meta and TikTok pixels. Saying otherwise would be false. What we can say is how they are configured, which is the part that actually matters:
- ✓ They are not mounted on the page until you accept. If you refuse or ignore the banner, the scripts are never loaded: no request goes to those domains at all.
- ✓ Google Consent Mode is set to "denied" by default before any tag can run, not after.
- ✓ The choice is revocable and remembered on your device.
That is a real difference from common practice, where the banner appears while the pixels have already fired. But it is not the same as "no trackers", and we will not call it that.
Advertising: none, on any plan
Aura shows no advertising, on the free plan or on Premium. The product is funded by subscriptions, not by ads.
It should be kept separate from something else, because the two get confused constantly: showing ads is not selling your data. Your mood logs, journal entries and habit data are not sold or handed to advertisers, data brokers, insurers or employers. That is the line that matters, and it is the one that will not change.
🔒 Summary, unvarnished
- ✓ No sale or transfer of your wellness data
- ✓ 1:1 chats end-to-end encrypted
- ✓ Analytics and pixels only after explicit consent
- ✓ Full JSON export (habits, mood, journal, preferences)
- ✓ Account deletion with linked data
- ! Journal and mood readable by our systems for AI analysis
- ✓ No advertising, on any plan
Taking your data with you
There is an export endpoint that returns habits, mood logs, journal entries and preferences as JSON, authenticated so that only the account owner can download them. You can also request deletion of your account along with its linked data.
The advice, which serves you more than us: try the export before you accumulate six months of data, not after. In any app. If it does not work, better to find out on day one.
Aura Pulse: the one aggregated signal
Aura Pulse shows a global heatmap of how many people are completing habits right now. The record written is anonymous and exists only for that aggregate count: it is not linked to your public profile, it does not say which habit you completed, and it is not sold.
GDPR and who to write to
To exercise your rights — access, portability, deletion, objection to processing — the reference is in the privacy policy, and you can contact the Data Protection Officer through the form at useaura.it/contact.
If anything on this page does not match what you see in the privacy policy, the privacy policy governs — and please tell us, because it means one of the two needs correcting.
Read the privacy policy before signing up. Genuinely.
Go to the privacy policy