AURA privacy policy

Last updated 5 November 2026.

AURA is a student capstone project at UNSW Sydney, not a commercial service. This server is run by the project team for the team and the people it invites.

What this server keeps

• Your AURA account: email address, name and a hash of your password.
• The sign-ins for the accounts you connect (Google, Microsoft, Slack), encrypted.
• If you connect your own AI account: which company and model, and its API key, encrypted. The app only ever shows the key's last four characters.
• Copies of recent items from those accounts, with their full text: inbox and sent mail of the last 14 days, your calendar from 7 days back to 60 days ahead, and up to 30 days of Slack messages. Attachments aren't stored: AURA lists their names and sizes, reads them when it prepares a meeting brief, and keeps only the brief.
• What you and AURA make: tasks, reminders, plans, suggestions, chats and preferences, and a log of what AURA read and did.
• Server logs: for each request, the network address it came from, the page or API path it asked for without what follows "?", the time, the result, its size and the browser's name; and for a sync that failed, which account and what kind of error. They leave out passwords and the text of your mail, calendar and chat.

What it is used for

Only to show you your day, your inbox, briefs and suggestions, and to carry out the actions you approve. Your data, including anything from Google, isn't sold or used for advertising, the team doesn't use it to train AI models, and it goes to nobody else except as the next section says.

What leaves this server

Requests to Google, Microsoft and Slack to read the accounts you connected, and the actions you approve there. This server has no AI model of its own, so on its own AURA sends nothing to an AI company.

You can connect your own AI account (Claude, ChatGPT or DeepSeek) in More > Settings. It stays off until you do. After that, when AURA can't answer a question itself it asks whether to pass it on, unless you turn that question off or start with "Ask Claude" or the like. Only then, your question, your name, email addresses, time zone and working hours, and what that company's model looks up in your email, calendar, chat and tasks go to that company, under your account and its terms, and it charges you for the use. Each answer says what went. Reminders, briefs, suggestions and plans never use your AI account. Mail contains other people's words, so think of them too. DeepSeek says it keeps what it receives on servers in China.

Where it is and who can see it

On a server in Sydney, Australia, hosted by Amazon Web Services, on an encrypted disk. Only the team member who runs the server can reach the machine. The copies of your mail aren't encrypted separately, so that person could read them. They look at stored data only when that is needed to fix a problem, and for nothing else. If you would rather not keep copies of your real mail here, connect a test mailbox.

Mail and chat contain other people's words. Connect only accounts you are allowed to use this way.

How long it stays

Copies are replaced at every sync, and items that leave the periods above are removed. Chats are kept for 90 days and the log of what AURA did for 180 days. Tasks and preferences stay until you delete them. Server logs are overwritten as they fill up, and deleting your AURA account doesn't remove them sooner.

What you can do

• Stop reading or disconnect an account in More > Accounts. AURA deletes its copies of that account at once. You can also remove AURA's access on your Google, Microsoft or Slack account page at any time.
• See what AURA read and did in More > Activity.
• Export your data or delete your AURA account in More > Settings. Deleting the account removes what AURA keeps about you at once.

If the server stops

If the team stops running this server, the people using it are told first and the data on it is deleted.

Questions

Ask the team member who gave you your invite code.