Privacy Policy
Last updated: November 1, 2026
AuraGarden is a wellbeing garden, and some of what you write here is personal. This page explains plainly what we collect, why, who helps us run the service and how you stay in control.
Who is responsible
AuraGarden AI (auragardenai.com) is run by Yari, based in Spain, who is the data controller for the personal data described here.
For anything about your data, write to privacy@auragardenai.com. We reply within one month at the latest.
What we collect
- Account: your email address, the name you'd like us to call you, and your password, which our sign-in provider stores only as a secure hash. We also record when you accepted these policies.
- Your garden: the plants you create, the habits they hold, each moment of care, and your focus sessions with their optional intention.
- Journal: the reflections you write, your inner-weather slider value and the garden weather created from them. Because they can reveal how you feel, we treat them as health-related data, a special category under the GDPR.
- Circles: the circles you create or join, who else is in them, and the plants you choose to share. People in a circle see your name and the plants you share there, never your journal.
- Product interest: when you open a Pro botanical pack or ask to be notified about it, we record that click to decide what to build next.
- Technical data: our hosting and database providers process your IP address and basic request logs to deliver the service and keep it secure.
We don't sell your data, show ads, or use advertising or tracking cookies.
Why we use it and on what legal basis
- Purpose
- Creating your account and running your garden, focus sessions and circles
- Legal basis (GDPR)
- Performing our agreement with you (art. 6.1.b)
- Purpose
- Storing and processing your journal
- Legal basis (GDPR)
- Your explicit consent, asked for in the app before your first reflection (arts. 6.1.a and 9.2.a)
- Purpose
- Sending your reflections to an AI to shape the garden's weather
- Legal basis (GDPR)
- Your separate, optional explicit consent (arts. 6.1.a and 9.2.a)
- Purpose
- Sending sign-up and account emails
- Legal basis (GDPR)
- Performing our agreement with you (art. 6.1.b)
- Purpose
- Security, preventing abuse and fixing errors
- Legal basis (GDPR)
- Our legitimate interest in keeping the service safe (art. 6.1.f)
- Purpose
- Measuring interest in future Pro features
- Legal basis (GDPR)
- Our legitimate interest in improving the product (art. 6.1.f)
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account and running your garden, focus sessions and circles | Performing our agreement with you (art. 6.1.b) |
| Storing and processing your journal | Your explicit consent, asked for in the app before your first reflection (arts. 6.1.a and 9.2.a) |
| Sending your reflections to an AI to shape the garden's weather | Your separate, optional explicit consent (arts. 6.1.a and 9.2.a) |
| Sending sign-up and account emails | Performing our agreement with you (art. 6.1.b) |
| Security, preventing abuse and fixing errors | Our legitimate interest in keeping the service safe (art. 6.1.f) |
| Measuring interest in future Pro features | Our legitimate interest in improving the product (art. 6.1.f) |
You can withdraw any consent at any time from Privacy & data in the app. Withdrawing doesn't affect what was done before.
Your journal and AI
AI weather is optional and off until you turn it on. When it's on, each time you save a reflection we send Anthropic, the company behind Claude, the text of that reflection, your slider value, how many habits you tended and how many focus minutes you logged that day, and your language. We never send your name or email.
Under Anthropic's commercial terms, this data is not used to train AI models and is deleted from their systems within 30 days, unless they must keep it longer to enforce their usage policies or comply with the law.
Weather created this way is labelled as generated by AI. It's a gentle reflection, not an assessment, a diagnosis or advice.
When AI weather is off, the weather comes only from your slider and your reflection never leaves our database.
Who helps us run AuraGarden
We rely on these providers (data processors), each bound by a data processing agreement:
- Provider
- Supabase
- What it does
- Database and sign-in
- Where
- European Union
- Provider
- Vercel
- What it does
- Hosting the website and its server
- Where
- European Union for server processing, with a global network that delivers the pages
- Provider
- Resend
- What it does
- Sending account emails
- Where
- European Union (Ireland)
- Provider
- Anthropic
- What it does
- AI weather from your reflections, only if you turn it on
- Where
- United States
- Provider
- Cloudflare
- What it does
- Domain name (DNS)
- Where
- Global. It doesn't receive your app data
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database and sign-in | European Union |
| Vercel | Hosting the website and its server | European Union for server processing, with a global network that delivers the pages |
| Resend | Sending account emails | European Union (Ireland) |
| Anthropic | AI weather from your reflections, only if you turn it on | United States |
| Cloudflare | Domain name (DNS) | Global. It doesn't receive your app data |
Some providers are based in, or may access data from, the United States. Those transfers are protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–US Data Privacy Framework.
How long we keep it
- Your account and garden: for as long as your account exists.
- Your journal: until you delete your account or withdraw your journal permission, which erases it straight away.
- When you delete your account, all your data is erased from our database at once. Copies in our providers' backups and security logs disappear on their normal cycles, usually within 30 days.
- Reflections sent to the AI: up to 30 days at Anthropic, as explained above.
Your rights
You can ask to access, correct or delete your data, receive a copy of it, restrict or object to how we use it, and withdraw your consent at any time. Several of these are a tap away in Privacy & data:
- Download all your data as a file (portability).
- Turn AI weather on or off, or withdraw your journal permission.
- Delete your account and everything in it.
For anything else, write to privacy@auragardenai.com. If you believe we haven't respected your rights, you can complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority in your country.
Age
AuraGarden is for people aged 16 or over. If you're younger, please don't create an account. If we learn that someone under 16 has signed up, we'll delete the account.
Security
Your data travels encrypted (HTTPS) and our database provider stores it encrypted. Database rules make sure each account can only read its own data, plus whatever others choose to share in a circle. If a breach ever put your data at risk, we would notify the authority within 72 hours and tell you whenever the law requires it.
Not a medical service
AuraGarden supports gentle habits and reflection. It isn't a medical or psychological service and doesn't replace professional help. If you're going through a crisis, contact your local emergency services or a helpline such as those listed at findahelpline.com.
Changes to this policy
If we change this policy in a meaningful way, we'll let you know in the app or by email before the change applies. The date at the top shows the current version.