Privacy Policy

This policy explains how Aurora Red at aurorared.app handles information when you use the image studio, prompt library, and account features.

For account, privacy, and content questions, email support@aurora.app. The help and contact guide explains available account controls and the information to include.

Information and purposes

Category	What it can include	Purpose
Accounts	Name, email, verification status, avatar, account identifiers, password hash for email accounts, and OAuth credentials supplied by the login provider	Create accounts, verify email, and sign you in
Sessions and security	Session identifiers and expiry, IP address, browser user agent, language, and diagnostic records	Maintain sessions, investigate errors, and prevent misuse
Prompts and images	Submitted prompts, settings, uploaded file bytes and embedded metadata, task status, result URLs, and credit reservations	Perform requested operations and show available task history
Orders and credits	User/order identifiers, email, package, amount, currency, payment status, provider references, and ledger entries	Record purchases, allocate credits, and reconcile payments when enabled
Support requests	Your email address, message, account or order references, and other information you choose to provide	Respond to account, billing, privacy, and content questions
Website analytics	Page URLs, referrals, browser/device information, cookie identifiers, and interaction events	Measure site use through Google Analytics

Google sign-in requests basic openid, email, and profile information, not Gmail messages or contacts. Resend handles recipient addresses, transactional message content, and delivery records for verification and account emails.

Curated community entries can also show public author names or handles, credits, original post links, prompts, and example images obtained from their stated sources. These details explain attribution and rights context; appearing in the library does not establish the author's endorsement of Aurora Red.

Current text-to-image requests use GPT Image 2 through APIMart, with the provider model identifier gpt-image-2-official. Aurora Red sends your text prompt and generation parameters, including aspect ratio, quality, and 1K resolution, to APIMart for asynchronous processing. We query task status, then download the completed image from its temporary provider URL and save it to Cloudflare R2; the task record keeps the stored result URL. The current studio does not offer reference-image input, image-to-image, or mask editing. Library examples do not mean that you have submitted a generation request. Do not submit passwords, identity documents, confidential material, or another person's sensitive information.

Images use public links

Current Cloudflare R2 images are served through public HTTPS URLs on assets.aurorared.app. Anyone with a URL can read its image without signing in. Links can be copied, shared, or cached; signing out does not revoke them. Identical uploaded bytes can reuse the same stored object and URL.

Uploads currently preserve the original bytes, so embedded metadata may remain. Remove sensitive metadata before upload. Public access is not a copyright licence to other viewers.

Cookies and browser storage

Authentication cookies support accounts and security. Language and appearance preferences may be saved on your device. A utm_source referral cookie, when present, lasts up to 30 days and may be saved with a new account. Saved prompts use local browser storage; an unfinished sign-in draft uses session storage. Clearing these items does not delete server-side accounts, tasks, or R2 objects.

GA4 uses measurement ID G-GQJTTYEX8K and loads by default when you visit the website to measure traffic sources, page views, and site use. The site does not show an analytics preference banner or store an accepted/rejected analytics choice. You can use browser controls or extensions to block analytics requests or cookies. Clearing cookies does not erase data already sent to Google or a referral value already stored with an account.

Google may set analytics cookies such as _ga and _ga_<identifier>. Google documents a default lifetime of two years, subject to browser limits and property settings. Cookie lifetime is different from Analytics-server retention, which is managed separately in Google Analytics settings. Browser controls can also remove or block cookies. Google's cookie documentation explains the defaults.

Providers and disclosures

Necessary information may also be disclosed for legal obligations, abuse investigations, payment disputes, or a lawful business transfer. Provider notices are available from Cloudflare, Neon, Google, Resend, and Stripe.

Processing locations, retention, and security

Aurora Red uses service providers with international infrastructure. Information may be processed outside your country for website delivery, image generation, storage, email, payments, or website analytics. Using the site does not imply that all information is stored in a single country or region. We do not make a zero-retention or no-training guarantee for APIMart or its downstream processing.

Account, task, order, credit, and image records form part of your account and service history. Retention depends on the purpose of the record, account use, security needs, legal obligations, and dispute handling. Verification links expire after 24 hours, and login sessions can expire or renew; expiry or signing out does not itself delete account history or stored images. Local saved prompts remain until you remove them or clear browser storage.

HTTPS and access controls help protect account and service data, but no online service can guarantee absolute security. Image URLs remain publicly readable as described above. See the help and contact guide for information about preparing a privacy or content request.

Choices and applicable rights

You can sign out, edit available profile fields, manage locally saved prompts, and use browser controls to block or clear cookies. The product currently has no self-service account deletion or server-side image deletion screen. Deleting a local prompt is not server deletion.

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, and complain to a competent regulator. California rights, where applicable, can include information about collection and disclosure and opting out of qualifying sale or sharing without unlawful discrimination. The available rights and conditions depend on the law relevant to you and the processing.

Send privacy requests to support@aurora.app, identifying the account or content involved as explained in the help and contact guide. Sending a request does not mean records or backups have been instantly deleted. Applicable statutory rights and deadlines remain unaffected.

Changes

The date above will be updated when this notice changes. Material changes to data uses or choices should be explained before they apply, with a new choice where required. This notice does not waive your applicable privacy rights.