Who is responsible
The AURA website and app are operated by the partners of the A.U.R.A. project, co-funded by the European Union, who act as controller of your personal data under the General Data Protection Regulation (GDPR). Reach the data protection contact through the contact form.
Visiting the website without an account
You can read every public page — the home, the places index and each place’s page — without an account and without telling us who you are. Our servers keep standard technical logs (IP address, browser, pages requested, time) for security and to keep the service running, and an error-reporting service (Sentry) receives technical details when something breaks. We do not run advertising trackers or third-party analytics on the website.
Some parts of a page are loaded from other providers, which see your IP address and browser details when your browser fetches them: fonts from Google Fonts, a small UI library from the jsDelivr CDN, and map tiles from OpenStreetMap on pages with a map.
Your account
When you create an account we store your name, email address, a hashed version of your password, your preferred language, sign-in records (times and IP addresses) that Devise keeps to protect the account, and when you accepted the terms of service and this policy. If you sign in through a third-party identity provider, we store the identifier that provider gives us and the profile details it shares. We use this data to run your account, send account emails (confirmation, password reset) and keep it secure.
Your comfort profile
Your comfort profile — which conditions bother you and how much — describes sensory sensitivity and we treat it as sensitive. We use it only to band readings and evaluate your alert rules for you. It is never shown to other users or published — only a carer linked to your account and the AURA team see it (see below) — and it is not used to profile you for any other purpose. Setting it is optional; without one, readings are banded against the place’s general profile.
Alert rules and notifications
To deliver alerts we store your rules, the conditions in them and a log of the alerts we sent, together with the push-notification tokens of the phones and browsers you enabled notifications on. Tokens are removed when you sign out, turn notifications off, or delete your account.
Visits and location
Visit detection is optional and off if you decline location permission. When it is on, your phone — not our server — notices when you arrive at and leave a monitored place, and the app sends us the place and the times. We don’t keep a trail of where you’ve been.
The app also sends your latest position when it needs places near you. We keep only that latest position, rounded to about 100 metres, with its time; each new one replaces the one before. In the app you can turn visit detection off. In the app or on the website you can turn automatic visit logging off, which stops new visits being logged and keeps your history, and you can delete your whole visit history at any time.
Feedback about places
Feedback you leave — a mood, tags, an optional note, and the readings at that moment — is stored with your account and shown on the place’s page anonymously by default; you can turn anonymity off in your settings. Notes are reviewed by an administrator before they appear publicly.
If you have a carer
If a carer (supervisor) is linked to your account, they can see, on their page for you: your name and email address, when you joined and when you last signed in; your comfort profile and the display style set for you; the places you saved, liked or disliked; the alerts you follow and the notifications AURA sent you; your feedback about places; the phones and browsers you turned notifications on for; your whole visit history; and, when the AI assistant is available, a list of your conversations with it, but not what was said. They do not see your password, your sign-in IP addresses or your position. A carer can also change your comfort profile, your display style and your alerts for you.
What the AURA team sees
The administrators who manage citizens' accounts can see, for every account, everything a carer sees (listed above), plus the IP address you last signed in from and whether your account is locked after too many wrong passwords. They can change your name, email address, password and carer, and delete your account. They do not see your password or your position. We use this access only to run AURA and to help you.
Contact form
When you write to us through the contact form we keep your name, email address and message for as long as it takes to answer you and handle any follow-up.
Sensor readings are not personal data
Readings come from Smart Citizen kits installed in public places and describe the environment — noise level, particulate matter, temperature, humidity, light, pressure. They say nothing about any individual and we publish them openly.
Who we share data with
We do not sell personal data and do not share it with advertisers. It is processed by the hosting provider that runs our servers, the email provider that delivers account emails, the push-notification services of Apple, Google and web browsers, and the error-reporting service, each acting on our instructions. We disclose data to authorities only where the law requires it.
How long we keep it
Account data, comfort profile, rules, visits and feedback are kept while your account exists and deleted when you delete it, apart from a short window in backups. Server logs and error reports are kept for a limited period for security and debugging. Published feedback notes are removed from the public pages when you delete the feedback or your account.
Your rights
To exercise a right that you cannot handle from your settings, use the contact form and we will respond within the time the GDPR allows.
- Access the personal data we hold about you and receive a copy in a portable format.
- Correct data that is wrong — most of it directly in your settings.
- Delete your account and its data, from your settings on the website or in the app.
- Object to, or ask us to restrict, a particular use of your data.
- Withdraw consent for location, notifications or feedback at any time in the app or your phone settings.
- Complain to your national data protection authority — in Greece, the Hellenic Data Protection Authority (dpa.gr).
Changes to this policy
When we change what we collect or how we use it, we will update this page and its date at the top, and tell account holders by email or in the app when the change matters to them.