Your Privacy Is Architectural

Last updated: July 23, 2026 · Effective: July 23, 2026

At AuroraNurtura, privacy isn't a policy — it's the architecture. This document explains what data we collect, how it's protected, and the choices you have. If you have questions, contact us at admin1@auroranurtura.com.

1. The Layer 1/2 Boundary

Our system is built on a strict two-layer privacy architecture:

Layer 1 (Avatar Cloud — Personal): Your conversations, session history, emotional check-ins, and companion personalization data live here. This layer is encrypted and isolated. It is never exposed to Layer 2.
Layer 2 (Population Engines — Anonymized): Only fully anonymized, aggregate data is processed here for population-level safety monitoring and curriculum improvement. No personal data ever crosses this boundary.

This boundary is architectural — enforced in code, not just in policy. There is no administrative path that allows personal data to reach Layer 2 systems.

2. Data We Collect

Account data: Email address (for waitlist and account creation). We do not require your real name.
Session data: Conversations with Cael, emotional check-in responses, somatic selector inputs, and session metadata (timestamps, duration).
Usage data: Feature usage patterns, session frequency, and interaction logs — used to improve your companion experience.
Technical data: Device type, browser, and basic connection information for security and performance monitoring.

3. How We Use Your Data

To power your Cael companion's personalization and memory.
To detect crisis signals and route you to appropriate support (988 Suicide & Crisis Lifeline).
To improve our platform's therapeutic frameworks and clinical safety systems — using anonymized, aggregated data only.
To send you service-related communications (waitlist updates, product announcements).

We never sell your data. We never use your private conversations to train AI models without your explicit, opt-in consent.

4. Crisis Safety Protocol

If crisis language is detected during a session (references to self-harm, suicidal ideation, or immediate danger), Cael will redirect you to the 988 Suicide & Crisis Lifeline. Crisis event data is processed through our cael-sanitize edge function, which strips all personally identifiable information (PII) before any data reaches our internal systems. Raw crisis transcripts are never stored in identifiable form.

5. Data Storage & Encryption

Database: Supabase (PostgreSQL) with Row-Level Security (RLS) enabled on all tables.
Encryption at rest: Sensitive fields (PHI columns) are flagged for pgsodium encryption before any real user data is stored.
Encryption in transit: All connections use TLS (HTTPS only — no HTTP fallback).
CORS policy: Only https://auroranurtura.com is permitted as an origin. No wildcard access.

6. Data Sharing

We do not share your personal data with third parties for advertising, marketing, or data brokerage purposes. We use the following service providers to operate our platform:

Supabase — Database hosting and edge functions
Vercel — Web hosting and deployment
OpenAI / Google Gemini / Anthropic Claude — AI model inference (your session content is sent for response generation; these providers do not retain or train on your data under our enterprise configurations)
Brevo — Transactional email delivery
Google Workspace — Internal team email and communications

Each provider is bound by their own data protection agreements. We share only the minimum data necessary for each service to function.

7. Your Rights

Access: You can request a copy of all personal data we hold about you.
Deletion: You can request permanent deletion of your account and all associated data at any time.
Portability: You can request an export of your data in a machine-readable format.
Opt-out: You can opt out of AI model training, marketing emails, and anonymized data aggregation independently.

To exercise any of these rights, email admin1@auroranurtura.com.

8. Data Retention

Active accounts: Data is retained while your account is active.
Inactive accounts: After 24 months of inactivity, session data is permanently deleted. Account metadata (email) is retained for waitlist purposes unless you request deletion.
Crisis events: Sanitized (PII-stripped) crisis event records are retained for safety audit purposes. Raw transcripts are not retained.

9. Children's Privacy

AuroraNurtura is designed for adults (18+). We do not knowingly collect data from minors. If you believe a minor has accessed the platform, please contact us immediately.

10. Changes to This Policy

We will notify all active users via email of any material changes to this Privacy Policy at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions about privacy? Email us: admin1@auroranurtura.com

Postal: Psykronicity LLC, c/o Thomas Anthony Lamothe, Founder & CEO