Privacy policy

Effective 19 October 2026. This policy covers the CHAD AURA app, its API, and chadaura.app.

Who is responsible?

Alexander Zotz, trading as CHAD AURA
c/o POSTFLEX PFX-375-297
Emsdettener Straße 10
48268 Greven, Germany
support@chadaura.app

What you send and why

We process your email address, hashed passwords and authentication credentials, account ID, confirmation status and sessions to create and secure your account. Authentication requests also involve connection information such as IP addresses, timestamps and device/browser information used by our infrastructure to deliver and protect the service.

When you choose a screenshot and approve analysis, the selected image is uploaded to private Supabase storage and sent through our server to OpenAI. OpenAI reads the conversation directly from the image and generates suggested replies from the conversation text. There is no separate OCR service. Screenshots may include other people's messages, names or photos: crop or redact information that is not needed, and only upload content you are entitled to use. Do not upload intimate images, passwords, financial information, medical information, or conversations involving minors.

We process extracted messages, speaker assignments, your corrections, reply preferences and generated suggestions to fulfil your request. We do not automatically send a reply to another person. You decide what to copy and send.

Providers

• Supabase: account authentication, database and private screenshot storage, with our project in Frankfurt, Germany.
• Vercel: API hosting, background processing and technical service logs.
• OpenAI: screenshot analysis and reply generation through its API. We use store:false. API inputs and outputs are not used to train OpenAI models by default. This does not mean zero retention: OpenAI normally retains abuse-monitoring data for up to 30 days, with legal and safety exceptions, and some model caching may apply. See OpenAI's data controls.
• RevenueCat and the Apple App Store / Google Play: native subscription purchases, verification, restoration and billing status. RevenueCat receives an opaque account ID, transaction and entitlement data, and SDK technical information, and provides subscription analytics in its dashboard. We do not send screenshot or chat content to RevenueCat. The stores handle payment details; CHAD AURA does not receive your full card information.
• Cloudflare: website delivery, DNS, security, authentication email delivery, support-email routing and operational notifications.

Some providers and subprocessors process data outside the EEA, including in the United States. Where required, transfers rely on applicable adequacy decisions or contractual safeguards such as the European Commission's Standard Contractual Clauses. Contact us for information about safeguards applicable to your request.

How long data is kept

• Uploaded screenshots are removed from our active storage after reading. Abandoned uploads are removed by a cleanup task scheduled every 15 minutes. Short-lived upload credentials can remain valid for up to two hours, so cleanup metadata is retained until those credentials expire.
• Extracted conversation content and corrections are encrypted in the application database. Pending analyses expire after about 15 minutes; generation has a shorter timeout. Results expire after one hour. Expired content is purged by the next cleanup run. Provider logs, backups and AI safety retention follow the provider's applicable retention schedule.
• Technical analysis, credit and inference-cost records without chat content are retained for up to 90 days. Subscription-period records are removed after the period has ended for 90 days. A minimal hashed receipt/owner record and used-credit count can remain through the paid period plus 90 days to prevent duplicate allowances after account deletion. It contains no email, name or raw store receipt.
• Aggregate error counters are retained for seven days and operational notification records for 30 days. Alert emails contain aggregate cost/error counts, not your screenshots, conversation or account ID.
• Your account and authentication data remain until deletion, subject to necessary legal/security retention. Store and RevenueCat transaction records may have separate contractual or legal retention requirements. Contact us to exercise deletion rights for provider-held data.

If you enable local reply history, the app keeps up to 20 reply sets on your device, without screenshots or extracted conversations. You can clear this history in the app. Signing out or deleting the server account does not erase another device's local storage; clear history or remove app data there as well. Native sign-in sessions use the operating system's secure storage. The web preview uses session storage.

Legal bases and choices

Account access, requested analysis and subscription administration are necessary to perform our service contract (GDPR Article 6(1)(b)). Security, fraud prevention and limited operational records rely on our legitimate interests in operating a reliable service (Article 6(1)(f)); legally required records rely on Article 6(1)(c). We request your permission before uploading a screenshot for AI processing. You can decline by not submitting it or withdraw future permission by stopping analysis and deleting the account. Withdrawing permission does not undo processing already completed. CHAD AURA is for adults aged 18 or older.

We do not sell personal information, run advertising SDKs, or track you across other companies' apps and websites for advertising. We do not currently use a third-party product-analytics or session-replay SDK. Service providers still process technical information needed to operate and secure the service. Local app storage needed for account access, preferences and requested history is not advertising storage.

Your rights and deletion

Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Email support@chadaura.app. We verify account ownership before disclosing or deleting account data. You can also use the in-app deletion flow or the outside-app account deletion instructions. You may complain to a data-protection authority, including the authority in your place of residence. We do not use your conversations to make legally significant automated decisions about you.

Contact and updates

For privacy questions, email support@chadaura.app. We will update this page when our practices materially change and provide additional notice where required.