1. Who we are
AuraSeed is run by AuraSeed, an independent developer in Vietnam (“we”, “us”).
Contact email: myfiai.app@gmail.com.
This policy covers the AuraSeed app on iOS and Android, and the website auraseed.myfiaivn.com.
2. Data we collect
| Category | What | Why |
|---|---|---|
| Account | The name and email Apple or Google share when you sign in (and a profile photo if Google provides one); a random ID if you use a guest account. For each sign-in, the server stores that session's IP address and browser/device information. | Create and keep your account, sync your data across devices, secure sign-in. |
| Focus sessions | Start and end time, duration, species, tag, and leave-app and screen-lock events during the session. | Compute session results and Aura, show your forest and stats, prevent cheating. |
| Group rooms | Display name, the rooms you join, group session results. | Run group rooms and show results to members. |
| Items | Aura and Diamond balances, transaction ledger, owned species, tags, settings. | Keep your progress and items. |
| Purchases | Transaction and product IDs from RevenueCat. We never receive card or payment details. | Deliver the Diamonds you buy, handle refunds, keep purchase records. |
| Ads | Your device's advertising ID if you allow it; ad events from Google AdMob. | Show the rewarded ads you choose to watch and grant the reward. |
| Analytics | Product usage events (for example app opened, session started, purchase made) keyed to your account ID, via PostHog (EU servers). The PostHog SDK also records device and app information (device model, OS, app version) with usage events. | Understand how the app is used so we can improve it. |
| Crashes | Crash reports, with device model and OS version, via Sentry. | Find and fix bugs. |
3. App blocking
- iOS: the apps you choose through Apple's Screen Time are opaque tokens that stay on your device. We cannot see which apps they are.
- Android: with your permission, Usage Access lets the app check, on the device and only during a session with blocking on, which app is in the foreground so it can cover apps that are not on your allowed list. To cover blocked apps, the app uses the “display over other apps” permission, and it runs a foreground service with a persistent notification during a blocking session. Neither collects any data. The list of allowed apps stays on your device.
Neither is sent to our servers.
4. Notifications, sounds and device permissions
Notifications and Live Activity (on iOS) are scheduled on your device. Sounds play locally. The app does not use your location, contacts, photos or microphone.
5. How we use data
- Run the app and your account.
- Compute focus session results and Aura.
- Prevent cheating.
- Deliver the items you buy.
- Show optional ads when you choose to watch one.
- Improve the app.
- Fix bugs and crashes.
- Answer support requests.
6. Legal basis
If the GDPR applies to you, we process data on these legal bases:
- Contract: account, focus sessions, purchases.
- Consent: personalised ads and iOS tracking permission (ATT).
- Legitimate interest: security, crash reports, product analytics.
- Legal obligation: purchase records.
7. Sharing with third parties
We share data only with the providers that help us run the app:
| Provider | Purpose | Privacy policy |
|---|---|---|
| Apple | Sign in with Apple, App Store | apple.com/legal/privacy |
| Sign in with Google, Google Play, AdMob | policies.google.com/privacy | |
| RevenueCat | In-app purchase processing | revenuecat.com/privacy |
| PostHog | Usage analytics (EU servers) | posthog.com/privacy |
| Sentry | Crash reporting | sentry.io/privacy |
| Railway | Server and database hosting | railway.com/legal/privacy |
8. Ads and your choices
- Ads appear only when you choose to watch one in the Shop.
- In the EU and UK, Google's consent form appears before any ad loads.
- On iOS, the app asks for your tracking permission (ATT).
To change your choices:
- iOS: Settings → Privacy & Security → Tracking.
- Android: Settings → Google → Ads, where you can reset or delete your advertising ID.
- To withdraw consent you gave in the EU or UK, email us at myfiai.app@gmail.com.
9. Retention
- We keep your data while your account exists. Guest accounts left behind after uninstalling cannot be linked back to a person and are not currently deleted automatically.
- When you delete your account, everything else is removed from our database immediately. Purchase and refund records (store and RevenueCat events, including the transaction data and the former account ID) are kept for accounting, tax and anti-fraud purposes. Backups at our hosting provider expire on their rotation.
- Analytics and crash data expire under each provider's retention settings.
- Store receipts are kept by Apple, Google and RevenueCat under their policies.
See how to delete your account on Delete account.
10. International transfers
Our servers and providers may be located outside your country (for example the US or the EU). Your data is protected by the providers' safeguards, including Standard Contractual Clauses where applicable.
11. Your rights
Under Vietnam's Decree 13/2023/NĐ-CP on personal data protection, and the GDPR where it applies, you have the right to:
- access your data;
- correct your data;
- delete your data;
- restrict processing;
- object to processing;
- receive your data in a portable form;
- withdraw your consent.
To exercise these rights, email myfiai.app@gmail.com. We reply within 30 days. You may also complain to the data-protection authority where you live.
12. Children
AuraSeed is not directed to children under 13. We do not knowingly collect data from children under 13, and we delete it if we learn of it.
13. Security
We use HTTPS, access control and least-privilege admin access. Still, no method is 100% secure.
14. Changes to this policy
We announce material changes in the app or on this page and update the date at the top.
15. Contact
If you have questions about this policy, email myfiai.app@gmail.com.