Your listening, kept small and private.

Aura turns the music you love into something you can see and share. This page explains, in plain words, what we collect to do that, why, who helps us, and how you stay in control.

Last updated 13 October 2026

Who we are

Aura is run by Aura (operated by Arnold Daniels), the data controller for the information described here. Questions or requests: [email protected].

What we collect

Account: your email address, your password (stored only as a one-way scrambled hash we can't read), and the username you choose.
Profile photo, if you add one. We store a small resized copy.
Your taste: the artists you pick, and — if you add your Spotify data export — a summary of it: top artists and tracks, listening hours by time of day, and totals. Your export file is read on your own device; the full file never reaches us, only that summary.
Matches: who you've matched with through a link one of you chose to send, and the result.
Technical data: your network address (used briefly, in a scrambled form, to stop abuse such as password guessing) and product analytics: which pages are used, and recordings of how people move through Aura (taps, clicks and scrolling) with everything you type and your email address hidden.

Why we use it

To provide Aura: build your aura, run matches you ask for, and make share cards you choose to create. This is needed to perform our agreement with you.
To keep Aura safe: sign-in security, rate limits and fraud prevention, which are our legitimate interests.
To improve Aura, using the analytics described above, which are our legitimate interest in making Aura work better.
To email you about your account: codes to confirm your email address and to reset your password, and a note when a match you're part of is ready. We don't send marketing without asking first.

What other people see

Other people only ever see your username and profile photo — never your email. Your matches are visible only to the two people in them. A share card only leaves Aura if you or your match download and post it, and it shows usernames, profile photos, the score and shared artists, never your full listening history.

Who helps us

We use a small number of service providers who process data on our behalf: Brimble (hosting and database, with traffic passing through Cloudflare), Brevo (sending emails) and PostHog (analytics). Artist names and photos come from Spotify and Wikimedia Commons. We don't send them anything about you, but the photos load straight from their servers, which see your device's network address as any website does. We don't sell your data.

Where your data is stored

Aura and its database run on Brimble's servers in Europe, so your account, photo, taste and matches are stored there. We moved them from Nigeria in October 2026 because Aura loads much faster for people in Nigeria that way. Brevo, in the European Union, receives your email address to deliver account emails, and PostHog, in the United States, receives usage analytics. Because this means your data leaves Nigeria, we only send each provider what it needs and use providers that commit by contract to protecting it.

How long we keep it

We keep your account data until you delete it. Deleting your listening history or your whole account in Account removes it straight away from our database; any copy in our hosting provider's backups goes when those backups expire. Email codes stop working after 10 minutes and are deleted within a day, and abuse-prevention counters are deleted after a day.

Cookies

Aura uses two cookies, both needed for it to work: one keeps you signed in for up to 30 days, and one remembers which email you're confirming while you enter a code (it lasts 15 minutes). Analytics don't store cookies or anything else on your device.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask to see the data we hold about you, correct it, get a copy, object to how we use it, withdraw consent, or have it deleted. Most of this you can do yourself in Account; for anything else write to [email protected] and we'll reply within 30 days. You can also complain to the Nigeria Data Protection Commission.

Age

Aura is for people aged 18 and over. If you believe someone younger has an account, tell us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll tell you in Aura or by email before it takes effect.