Privacy Policy

Who we are

AuraStash ("we", "us") is a mobile app that lets a tour group collect photos and videos in one shared gallery. The service is operated by [[OPERATOR_LEGAL_NAME]], [[OPERATOR_ADDRESS_AND_COUNTRY]]. For any privacy question, write to privacy@aurastash.com.

This policy applies to the AuraStash mobile app, its servers and the website aurastash.com.

Information we handle

Account data.

• Guides and travelers who register: name, email address, profile picture, and a password (we store only a one-way hash, never the password itself) or your Google account identifier.
• Guests who join with a tour code: the name you enter. We do not ask for an email; a technical placeholder address is created internally. A recovery key is generated for you; we store only its hash.

Content you upload. Photos and videos, their file name, size, type and upload time, the tour day or activity they belong to, who is tagged in them, reactions, and privacy settings (private, group, highlight).

Automatic image analysis. For photos (not videos) our server calculates a sharpness score, a perceptual hash to detect duplicates, and flags such as "scenic view" or "group photo". This is used only to organize the gallery and apply daily limits.

Previews. We keep small preview images (thumbnails) so galleries load fast.

Technical data. Like any online service, our servers and network provider process your IP address and request logs to deliver the service and protect it from abuse.

Location. The app does not read your device's GPS. "Location" in a tour means names that the guide gives to activities. Note that original files are stored exactly as uploaded: if your camera embedded location data in a photo, it stays in the file and may be visible to people who can open that file.

We do not use advertising, we do not sell personal data, and we do not use third-party analytics or tracking.

Google Drive and Google user data

AuraStash uses a "bring your own storage" model: original photos and videos are stored in the tour guide's Google Drive, in a folder structure that AuraStash creates.

When a guide connects Google Drive, we request only these permissions:

• drive.file — to create and manage only the files and folders created by AuraStash. We cannot see the rest of the guide's Drive.
• userinfo.email — to read the email address of the connected Google account.

We store a Google access token on our server so the app can keep working with that folder. Guides can disconnect at any time at myaccount.google.com/permissions.

Limited Use. AuraStash's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the features visible in the app, we do not transfer it to others except as needed to provide the service, comply with law or protect against abuse, we do not use it for advertising, and our staff do not read it except with your consent, for security, or to comply with law.

Who can see your photos

You control visibility:

• Your photos marked private are visible only to you.
• Photos where you tag one or more people are visible to the author and the tagged people. Group photos and landscape photos are visible to the tour group.
• A private photo is never shown in the group gallery or as Photo of the Day unless you nominate it.
• The tour guide owns the storage, so the guide can access the original files in their Google Drive.

Other participants can see your name, profile picture and reactions inside the tours you join.

How we use and share data

We use data to run the service: sign you in, organize and show galleries, enforce daily limits, keep the service secure, and answer support requests. Our legal bases are the performance of our contract with you, our legitimate interest in running a secure service, and your consent where required (for example, connecting Google Drive).

We share data only with:

• Hosting and network providers (currently Cloudflare) that process traffic on our behalf.
• Google, to store the guide's files in Google Drive.
• DiceBear (api.dicebear.com): default guest avatars are generated by this service, so your device loads that image from it and DiceBear sees your IP address.
• Authorities, when required by law.

Your data may be processed outside your country; where required we rely on appropriate safeguards.

Retention and deletion

• We keep your data while your account exists.
• You can delete your account at any time in the app (Profile → Delete Account & Data) or through our account deletion page.
• Deleting your account removes your profile, tour memberships, reactions, daily counters and the photos and videos you uploaded, including the original files in the tour's Google Drive and the preview images on our server.
• Tour guides must first close or delete their active tours.
• Our database is backed up automatically every day; backups are kept for up to 14 days and then deleted. Deleted data disappears from backups within that period.
• We complete verified deletion requests within 30 days, normally within 7 days.

Your rights

Depending on where you live (for example under the GDPR), you may have the right to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and to complain to your data protection authority. To use these rights, write to privacy@aurastash.com; we reply within 7 days.

Children, cookies and security

Children. AuraStash is not directed to children under 13, and we do not knowingly collect their data. If you are below the age of digital consent in your country, you need a parent's or guardian's permission. If you believe a child has given us data, contact us and we will delete it.

Cookies. The website aurastash.com does not use cookies and does not load third-party scripts, fonts or trackers.

Security. Data is sent over encrypted connections and passwords are stored only as hashes. No system is perfectly secure, so please keep your recovery key private.

Changes to this policy

We may update this policy. The date at the top shows the current version. For significant changes we will notify you in the app or on this website.

Contact

Questions about this policy or your data: privacy@aurastash.com. General support: support@aurastash.com. We aim to respond within 7 days.