Privacy Policy

Last updated: draft, not yet published.

1. Data we collect

• Account data: your email address and a securely hashed password (we never store your password in plain text).
• Gameplay data: scores, streaks, Aura balance and transaction history, and match records.
• Payment data: handled directly by Stripe. We receive confirmation that a payment succeeded and its amount — we never see or store your card number.
• Technical data: IP address, used only for abuse prevention (rate-limiting account creation and login attempts).

2. Third parties we share data with

We use the following processors to operate the Service. Each only receives the data it needs to do its job:

• Stripe — payment processing for Aura purchases.
• Resend — delivery of transactional emails (password reset only; no marketing emails).
• OpenAI — generates and judges images from submitted prompts. Prompts and generated images are sent to OpenAI for this purpose.
• Our database and hosting providers — store account and gameplay data securely.

We do not sell your data, and we do not use advertising or tracking cookies.

3. Cookies

We use a single strictly-necessary session cookie to keep you signed in. It is not used for tracking or advertising, and no consent banner is shown because no non-essential cookies are set.

4. How we use your data

To operate your account, process payments, prevent abuse (such as scripted signups to bypass free-play limits), send password-reset emails when requested, and improve the judging system.

5. Data retention

If you delete your account, we remove your email and password immediately and you can no longer sign in. Records of past purchases are kept as required by accounting and tax law, in anonymized form disconnected from your email.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data (for example under the Swiss Federal Act on Data Protection or the EU GDPR). You can delete your account yourself from Settings, or contact us for any other request.

7. Security

Passwords are hashed with scrypt and never stored in plain text. Traffic to the Service is encrypted in transit. Access to the database is restricted to the operator.

8. International data transfers

Some of our processors (including OpenAI and Resend) operate outside Switzerland/the EU. [Placeholder — appropriate safeguards for international transfers to be confirmed with legal counsel.]

9. Children's privacy

The Service is not directed at children below our minimum account age (see Terms of Service) and we do not knowingly collect data from them.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected on this page with an updated date.

11. Contact

Privacy questions or requests: hello@prompt-aura.com [placeholder address — set up an inbox at this domain before launch].