Privacy Policy

Last updated: September 27, 2026

1. Who is the data controller

This app ("Aurasity", under the "Misely Lab" brand) is developed and operated by Mehmet İlyas İnce (a private individual, Türkiye). Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), he is the data controller.

Contact: miselylab@gmail.com

This section fulfills the disclosure obligation under KVKK Article 10: the identity of the data controller, the data processed, the purpose of processing, the legal basis, to whom and for what purpose it is transferred, and how to exercise the rights listed in Article 11 are explained below.

2. What data stays only on your device

The following data is stored only on your phone; it is never sent to us or to any other server, because we don't have a server it could be sent to:

• Your profile test answers, axis scores, and profile (persona) result
• Your tasks, subtasks, priorities, and notes
• Your routines, habits, and daily check-ins
• The duration and outcome of your focus sessions
• The visible history of your conversation with Aura, and the notes Aura keeps to remember you (see "What Aura remembers" below for details)

3. Aura — the AI chat companion

Aura is a chat feature you can use to talk about everyday concerns; it offers advice and tries to lift your mood. It does not provide a diagnosis and does not give medical or psychological advice (see the Terms of Use for more detail).

What gets sent

When you write a message to Aura, the following is sent to Google's Gemini model (via Firebase AI Logic, using the gemini-3.5-flash-lite model) so a reply can be generated:

• The text of your message
• A short summary of that day's task, routine, and focus status (e.g. "3 tasks carried over to today", "two items of the morning routine are checked") — so the chat has context
• Short notes Aura remembers from previous conversations (see below)

What is never sent: your name, email address, account ID, device identifier, or any information that directly identifies you. Google does not link these messages to your identity.

Messages carrying a crisis signal never reach the model

If a message is detected as carrying a self-harm signal, the chat stops immediately and the message is never sent to Google. Instead, a fixed, pre-written support card is shown (a suggestion to call your local emergency number and to reach out to a professional). This turn is never recorded anywhere.

What Google does with my messages

This app is configured to use the paid service tier of the Gemini API (the Firebase project is on the Blaze plan). Under Google's Gemini API Additional Terms of Service, for paid services:

• Google does not use the prompts you send or the model's responses to improve its own products or to train its models.
• This content is retained only for a limited period, and solely to detect and prevent abuse; it is not subject to human review.
• The situation is different on the free (trial) tier — there, content may be used by Google to improve its products and may be subject to human review. This app is set up to run on the paid tier in production.

(Source: Gemini API Additional Terms of Service)

What Aura remembers

So you don't have to reintroduce yourself every time, Aura keeps two kinds of persistent traces. Both live only on your phone, in a plain text file (Aura/hafiza.md) — they never reach us, and are only sent to Google as context on the next turn of the conversation:

• Persistent notes: short sentences Aura judges "worth remembering" (up to 20).
• Session summaries: which day you talked, the sentence that opened that conversation, and what the app actually did during it (up to 8).

The raw text of your conversation (individual messages) is not stored persistently on your phone — it only stays in memory while that session is active, and is lost when you close the app. What is kept persistently are the short notes and summaries above.

Profile → Settings → Delete all my data deletes this file too (see "Deleting your data") and withdraws the data consent you gave Aura; the consent screen appears again the next time you open Aura.

One-time consent

The first time you open Aura, a consent screen summarizing the above appears. You cannot use Aura without agreeing to it. You can withdraw your consent at any time via Profile → Settings; when you do, the Aura tab closes.

4. What data reaches us / third parties

Usage statistics and crash reports carry no content. Your task titles, routine names, or anything you write to Aura never enter these records — in the code, these events are defined to carry only fixed names and numeric fields.

International transfer

Google's servers are located outside Türkiye (primarily in the US). The data going to Google in the table above is therefore considered transferred abroad (KVKK Article 9). For Aura, the basis for this transfer is the explicit consent you give the first time you open it. Analytics and Crashlytics are necessary for the app to function and for fixing its errors; since this data is not linked to your identity, its personal-data character is limited, but it still falls within the scope of the same explicit consent.

About Firebase

Firebase is Google's app infrastructure service. This app uses the following Firebase products: Analytics, Crashlytics, App Check. Firebase Auth and Firestore are not used — meaning none of your tasks, routines, habits, or chat data is written to a Firebase database; all of it stays on your phone.

(Source: Firebase Privacy and Security — Crashlytics data begins to be removed from live and backup systems within 90 days of collection.)

5. Health data and special-category data

Aurasity is not a medical app and does not provide a diagnosis. The profile test and Aura are tools for self-awareness and everyday support; they do not substitute for a medical evaluation.

The axes behind the profile test, and the topics you talk about with Aura, may occasionally touch on sensitive subjects such as attention, mood, or habits. We treat this content with the sensitivity of special-category personal data: it is processed only with your explicit consent, is never used for advertising, and is never sold or shared with third parties for marketing purposes.

6. Deleting your data

Profile → Settings → Delete all my data permanently deletes the following, and this action cannot be undone:

• Your profile test result and persona
• Your tasks and subtasks
• Your routines and habits
• Your focus session records
• Your setting preferences
• Aura's memory file (hafiza.md): its persistent notes and session summaries
• The data consent you gave Aura — the consent screen appears again the next time you open Aura

⚠️ This button does not delete the weekly message counter: it's kept separately to prevent abuse and carries no content — only which week it is and your message count for that week, no personal content.

Aura messages already sent to Google are, under the paid-service terms, retained only for a limited period solely for abuse detection, and are automatically removed once that period ends (see Section 3).

7. How to exercise your rights (KVKK Article 11)

Under Article 11 of KVKK, you may apply to the data controller to:

1. Learn whether your personal data is being processed,
2. Request information about it if it has been processed,
3. Learn the purpose of processing and whether it is used in accordance with that purpose,
4. Know the third parties to whom it is transferred, domestically or abroad,
5. Request correction if it has been processed incompletely or incorrectly,
6. Request its deletion or destruction under the conditions set out in Article 7 of KVKK,
7. Request that the above correction/deletion actions be notified to the third parties to whom the data was transferred,
8. Object to a result that arises to your detriment solely from automated analysis of your processed data,
9. Request compensation for damages incurred due to unlawful processing

You may submit your request, along with information that verifies your identity, in writing to miselylab@gmail.com. Your request will be answered within the period required by KVKK (at most 30 days).

8. Children

Aurasity is designed for the age group indicated by its App Store age rating. We do not knowingly collect data from anyone under 13; if we become aware that we have collected data from a user under 13, we will delete it.

9. Changes

This policy may be updated. When a material change occurs (for example, a change to the scope of Aura's data sharing), you will be notified within the app and — if required — your consent will be requested again.

10. Contact

For questions, requests, and to exercise your rights: miselylab@gmail.com

Support: inceilyas.github.io/aurasity/en/support/