Last updated: May 7, 2026
Aura by First24 ("Aura," "we," "us," or "our") is a personal wellness and family-memory application. This Privacy Policy explains what we collect, why, where it's stored, and what we never do. This update reflects the addition of Aura Genesis (verified family memories), Bluetooth-mediated co-presence, hardware device attestation, and Apple Watch HRV duress detection.
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Account info (email, name, locale, timezone) | Sign-up | Supabase (encrypted at rest, RLS-protected) | Until account deletion |
| Wellness score & streak data | App usage | Supabase (encrypted) | Until account deletion |
| Routine completion records (Golden Window) | App usage | Supabase (encrypted) | Until account deletion |
| Adherence-verification photos | Camera (optional) | Classified on-device, then deleted | Never stored — only the SHA-256 hash + classification result + EXIF timestamp/GPS persist |
| Adherence-verification metadata | Derived from photo | Supabase (encrypted) | 90 days (attestation TTL) |
| Device info (platform, OS version, app version, model) | Automatic | Supabase (encrypted) | Until account deletion |
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Kin Circles (family group names) | You create them | Supabase (encrypted, RLS to active members) | Until you delete the circle |
| Kin Memberships (invited family member display names + relationship label) | You invite them | Supabase (encrypted, RLS-protected) | Until membership revoked |
| Invitation tokens | One-shot, server-generated | Supabase (encrypted) | 14 days, deleted on accept/revoke |
| Sealed memory photos / video / audio | You capture or import | Private Supabase Storage bucket (genesis-media); access restricted by row-level security to active members of the seal's circle | Until you (the seal's creator) delete the seal, OR until your account is deleted |
| Seal metadata: hash (SHA-256), capture method, timestamp, optional location label, event label, note | Derived at capture | Supabase (encrypted) | Same as the seal |
| Seal participants: which Kin were verified present | You select OR confirmed via BLE | Supabase (encrypted) | Same as the seal |
| Seal proofs: device attestation references, capture-time, BLE co-presence signatures | Derived at capture | Supabase (encrypted) | Same as the seal |
| Living Heirloom extensions: text notes, voice recordings, photos, drawings, AI-assisted summaries | You and other circle members add them | Text in Supabase; media in genesis-media bucket | Until the contributor soft-deletes their entry, or the seal is deleted |
| Time Capsule lock dates | You set them | Supabase (encrypted) | Same as the seal |
| Voice / AI consent flags | You set in Voice Consent settings | Supabase (encrypted) | Until account deletion |
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Short-lived BLE advertisement during seal capture | Your phone broadcasts a random session token over BLE for up to 30 minutes | Broadcast over the air; not persisted | Token expires within 30 min |
| Witness records — confirmation that another Kin's device detected the broadcast | Their app posts a witness report when nearby | Supabase (encrypted, RLS-protected) | Until the seal is deleted |
| Optional RSSI (signal strength) | Detected by witness device | Supabase (encrypted) | Until the seal is deleted |
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Apple App Attest receipts (iOS) / Google Play Integrity tokens (Android) | Apple / Google services attest your device's integrity at install / re-attest periodically | Verification result + cryptographic public key in Supabase (encrypted) | Until account deletion |
| Stable per-install device id (UUID) | Generated locally on first launch; persists in app's secure storage | Supabase (encrypted) | Until account deletion or app reinstall |
| Attestation sign counter | Incremented by Apple / Google on each cryptographic operation | Supabase (encrypted) | Used for replay-prevention; retained while device is registered |
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Heart-rate variability (HRV) patterns | Apple Watch sensors via HealthKit | On-watch and on-iPhone only — analyzed locally | Watch / phone storage; not transmitted |
| Duress alert events | Triggered on-device when HRV pattern matches stress threshold | Supabase (encrypted) — only the event marker, not the HRV time series | 30 days for the alert record |
| Designated emergency contacts | You configure them | Supabase (encrypted) | Until you remove them or delete your account |
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Subscription tier (free / Genesis Plus / Genesis Legacy) | RevenueCat webhook after Apple/Google Play purchase | Supabase (encrypted) | Until account deletion |
| One-time purchase credits (e.g. Heirloom Book unlocks) | RevenueCat webhook | Supabase (encrypted) | Until account deletion |
| RevenueCat purchase identifiers (product id, latest entitlement, app user id) | RevenueCat webhook | Supabase (encrypted) | For fraud / billing reconciliation; until account deletion |
| Payment instrument data | NEVER collected by us | Apple / Google handle payments | n/a |
| Data Type | How Collected | Stored Where | Retention |
|---|---|---|---|
| Audit log of sensitive operations (capsule lock/unlock, Heirloom Book export, kin invite/revoke, subscription change) | Server-side, automatic | Supabase (encrypted, append-only) | 2 years |
| Webhook event log (RevenueCat purchase events, deduplication) | Server-side, automatic | Supabase (encrypted) | 2 years |
| Crash reports | Automatic via Sentry — scrubbed of PII; only contains user UUID + breadcrumb of routes hit | Sentry servers | 90 days |
| Usage analytics | Automatic via PostHog — aggregate event counts; no message content | PostHog servers | Rolling 12 months |
When you use Verified Adherence, you may optionally photograph your care product. The photo is classified on-device using machine learning and immediately deleted. We retain only an image hash (SHA-256), the classification result, a timestamp, and optional EXIF GPS coordinates. The image itself never reaches our servers.
Aura Genesis is the family-memory module. When you "seal" a memory:
genesis-media).If you enable "Detect nearby Kin" during a memory capture, your phone broadcasts a short-lived random session token over Bluetooth Low Energy (typically < 30 minutes). Other Aura installations in your circle that detect the broadcast can post a witness record to confirm presence. Bluetooth is not used for tracking or location. The session token is random per capture, expires automatically, and contains no personal information. If you don't enable this feature, no BLE broadcast or scan happens.
To prevent fraud (e.g. fake "verified device" claims), Aura uses Apple App Attest on iOS and Google Play Integrity on Android. These services let our servers cryptographically verify that requests come from a real, untampered Aura install on a real device. We store the verification result + a public key + a sign counter. App Attest and Play Integrity do not provide us with personal information about you — they tell us only whether your install passes Apple's / Google's integrity checks.
If you install AuraWatch on Apple Watch, the app reads heart-rate variability (HRV) data from HealthKit on-device to detect distress patterns. HRV time-series data never leaves the watch / phone pair. When a duress threshold is crossed, the app may send an alert to your designated emergency contacts; only the alert event (timestamp + your user id) is logged on our servers, not the HRV data itself.
We use your information to:
If you enroll in Aura through an employer or insurer wellness program:
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Authentication is handled through Supabase Auth with Apple Sign-In, Google Sign-In, or email magic links. Memory seals and Living Heirloom extensions are bound by HMAC-SHA256 hashes that detect tampering. Postgres row-level security ensures users can only read seals, extensions, witnesses, and entitlements they're authorized to. Webhook integrations (RevenueCat) require constant-time-compared shared secrets. Device attestation requires a real Apple App Attest receipt or Google Play Integrity verdict. The backend refuses to start in production with placeholder secrets, ensuring deploys can never silently run with predictable signing keys.
You have the right to:
If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at privacy@first24.io.
If you are in the European Economic Area, our legal basis for processing is: consent (microphone, camera, Bluetooth, HealthKit access; voice / AI consent flags), contract performance (providing the Aura service, processing payments), and legitimate interest (crash reporting, fraud prevention via device attestation, audit logging). You have the right to access, rectify, erase, restrict processing, and port your data. Contact our Data Protection Officer at privacy@first24.io.
Aura is not directed to children under 13. Family members under 13 may be added to a Kin Circle by a parent or guardian, but the parent's account controls all data. Voice recordings of minors (e.g. a child's milestone in a Living Heirloom) are stored only at the parent's instruction and can be deleted by the parent at any time. We do not knowingly collect personal information directly from children under 13.
Even though Aura is a wellness tool and not a HIPAA-covered entity, we comply with the FTC Health Breach Notification Rule. In the event of a breach involving health-related data, we will notify affected users and the FTC as required by law.
Aura relies on these third-party services. Each is bound by its own privacy policy:
| Service | Purpose | Data sent |
|---|---|---|
| Supabase | Database, authentication, storage | All persisted Aura data |
| Apple (App Store, App Attest, Sign-In, HealthKit) | Auth, payments, device attestation, HRV input | Authentication tokens, App Attest receipts, purchase events |
| Google (Play Store, Play Integrity, Sign-In) | Auth, payments, device attestation | Authentication tokens, Play Integrity tokens, purchase events |
| RevenueCat | Subscription management bridge between App Store / Play Store and our backend | Purchase events, subscription state, your user id |
| Sentry | Crash reporting | Error stacks + breadcrumb of routes hit + your user id |
| PostHog | Aggregate product analytics | Anonymized event counts (e.g. "seal created"); no message content |
| Fly.io | Backend hosting | All API traffic (encrypted in transit) |
| CDC public APIs | Seasonal awareness data | Outbound only; we don't send your data to CDC |
We may update this policy from time to time. Material changes will be communicated through the app and by updating the "Last updated" date above. Continued use of Aura after material changes constitutes acceptance.
First24, Inc.
Burleson, Texas
Email: privacy@first24.io
Aura is a wellness, family-memory, and lifestyle tool. It does not diagnose, treat, cure, or prevent any disease.