Privacy Policy for Aura
1. Controller
Mohamed Ali Masmoudi
Kittlerstr. 33
64289 Darmstadt, Germany
Email: hello@aura-reader.app
See also our Imprint.
2. Overview
Aura is an Android app that imports documents and reads them aloud. Document content, filenames, generated audio, and reading positions stay in the device's private app storage. They are not sent to Aura servers and are not used for advertising.
3. On-device document processing
When you paste text or import a document or image, Aura processes the content, filename, reading position, selected language and voice, and generated audio locally on your device. Text recognition, speech synthesis, language identification, and translation (after the language pack is downloaded) run on the device.
When you import a web link, Aura downloads that page directly from its website over HTTPS (for Wikipedia links, from the Wikipedia API). The website receives the connection data needed for this, in particular your IP address and the requested address, as it would from a browser. Aura keeps only the article text on your device and sends the link and the text to no other service. The website's own privacy notice applies to that request.
This data does not leave Aura. It is kept in app-private storage, is excluded from Android cloud backup and device transfer, and is removed through the operating system when you delete the document or the app. We cannot see it.
Legal basis: Where processing is relevant under data protection law, it is necessary to provide the app features you request (Art. 6(1)(b) GDPR) or to keep the app working reliably (Art. 6(1)(f) GDPR).
4. Downloads of speech, voice, and translation models
When you start a download, Aura downloads the required models and voices over HTTPS. The download providers receive the connection data needed for this, in particular your IP address and the requested file. Document content is not sent to these providers.
- Speech models and voices: Hugging Face (Supertone repository; for the optional English voice pack, the onnx-community Kokoro repository);
- optional offline translation: Google ML Kit downloads the required language pack from Google.
Legal basis: Art. 6(1)(b) GDPR where the download is necessary for the feature you request; otherwise Art. 6(1)(f) GDPR (secure and working delivery). More information: Hugging Face and Google.
5. Google ML Kit
Aura uses Google ML Kit for optional document scanning, text recognition, language identification, and offline translation. Content is processed on the device. However, Google may process required SDK diagnostics, usage, and performance data and may check for updates.
Legal basis: Art. 6(1)(f) GDPR (secure and reliable delivery of the optional feature). See the Google Privacy Policy for details.
6. Advertising with Google AdMob (free version only)
In the free version, Aura may show banner and interstitial ads from Google AdMob. The Pro version is ad-free and does not request ads. Aura does not send document text, filenames, generated audio, or information about what you read or listen to to AdMob, and does not use this data for ad targeting.
To serve, limit, and measure ads, and to personalize ads only with your consent, Google and the ad technology partners listed in the consent dialog may process device and online identifiers (including the advertising ID), IP address, ad interactions, consent status, and technical device information. The consent dialog shows the specific purposes, partners, and data categories before you decide.
For people in the EEA, the United Kingdom, and Switzerland, Aura shows the Google User Messaging Platform (UMP) at app start when required. You can decline, consent, or manage your choices. You can change or withdraw your choice later in Aura under Settings → Ad privacy choices. Declining does not affect the core features of the app; it can change whether and which ads are shown.
Legal basis: For consent-based ad processing, your consent under Art. 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG for storing or accessing information on your device. For purposes marked as "legitimate interest" in the consent dialog, the listed ad technology partner may rely on Art. 6(1)(f) GDPR. You can object to this processing at any time under Settings → Ad privacy choices. Without consent, no personalized ads are served on the basis of that consent.
More information: How Google uses information from sites or apps that use its services and the Google Privacy Policy.
7. Purchases, subscriptions, and RevenueCat
When you buy or restore Aura Pro, Google Play processes the payment. Aura uses RevenueCat to check the anonymous purchase status or entitlement for Aura Pro and to analyze its own purchase screen. This can include an anonymous identifier assigned by RevenueCat, purchase and entitlement status, product information, technical device information, and interaction with the purchase screen. Aura does not send document content, filenames, voice, or listening data to RevenueCat.
Legal basis: Art. 6(1)(b) GDPR (performing and managing your purchase or subscription); where required, Art. 6(1)(c) GDPR (legal retention obligations) and Art. 6(1)(f) GDPR (fraud prevention and secure delivery). Recipients are Google Play and RevenueCat, Inc. More information: Google Privacy Policy, RevenueCat Privacy Policy, and RevenueCat DPA.
8. Connected devices
When you use Aura with Wear OS or Android Auto, the connected device receives the title of the active document and the playback state for remote control. Document text and generated audio are not transferred.
9. Recipients and transfers to third countries
Depending on the feature you use, Google, RevenueCat, and Hugging Face can receive data as described in sections 4 to 7. These providers may also process data outside the EU/EEA, in particular in the United States. Where no adequacy decision applies, data is transferred only under the applicable safeguards, such as the European Commission's Standard Contractual Clauses, and supplementary measures where needed. See the privacy notices of each provider linked above for details.
10. Retention
| Data | Retention |
|---|---|
| Documents, reading positions, and generated audio | Locally on your device until you delete them in Aura or uninstall the app. |
| Downloaded models and voices | Locally on your device until you delete them in Aura or uninstall the app. |
| Ad consent choice | As defined by the Google UMP/TCF configuration; you can change it at any time in the ad privacy choices. |
| Purchase and entitlement data | According to the retention periods of Google Play and RevenueCat and, where required, legal obligations. |
| Technical data of third-party providers | According to the privacy notices of Google, RevenueCat, Hugging Face, or GitHub. |
11. Your rights
Subject to the legal requirements, you have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on Art. 6(1)(e) or (f) GDPR. You can withdraw consent at any time with effect for the future. For ad consent, use the ad privacy choices in Aura; for all other requests, contact us at the email address above.
Deletion requests
Documents, reading positions, and generated audio exist only on your device. You can delete individual documents in Aura, or remove all local Aura data by clearing the app storage or uninstalling the app. Because we have no access to this local data, we cannot delete it remotely.
To have the anonymous purchase and entitlement data stored at RevenueCat deleted, send a request to the email address above and include the Support ID shown in Aura under Settings → Privacy & notices → Support ID. We use this ID only to find the matching anonymous RevenueCat record and request its deletion.
Deletion at RevenueCat does not cancel or refund a subscription purchased through Google Play. Manage or cancel subscriptions separately in Google Play. If you keep using or reopen Aura after deletion, RevenueCat may create a new anonymous record to check an existing purchase. For data that Google processes under its own responsibility, the Google privacy and management options linked in sections 6 and 7 apply.
You also have the right to lodge a complaint with a data protection supervisory authority, usually the authority of your habitual residence, place of work, or place of the alleged infringement. For a controller in Germany, the authority of the relevant federal state is usually competent. The Datenschutzkonferenz provides an overview.