Privacy Policy

Nothing you wrote is sent before you say yes

Before anything you wrote is sent, Aurava asks, “May I turn your words into a scene?” The screen that asks says:

Your name, your wish and your recent writing are sent to AI to write your scene. You can continue without a scene. Written with Anthropic. Checked for care by OpenAI. Voice by Google.

“See what will be sent” on that screen shows the list with your own words filled in. Its rows are:

• Your name, your first name.
• Your wish, as you wrote it.
• Which kind of wish it is, one or more of eight names, when your wish has one.
• Your recent writing, with how many of your lines are sent.
• Your past scenes: your last scene, how recent ones began and turned, your recent lines about what to notice, and the short note of what your scenes have made true so far. The note is written by the same company that writes the scene, in the second request described below, from your scenes and your writing.
• Your sign, your star sign, when Aurava has one for you.
• The scene’s words, sent only if you listen, to make the voice.

If you choose “Not now”, none of your words are sent, and your line waits on your phone until you decide.

Scenes come with a subscription

Scenes are written only for a subscription or a trial. Until you have one, no scene is written for you, and the line you write is kept on your phone, on a sealed card. Each time a scene or a line about what to notice is asked for, Aurava’s server checks with RevenueCat that your install is subscribed, as section 5 describes. If the request is refused, because no subscription is on record, the day’s limit for your install is reached, scenes are paused, or the subscription record cannot be reached, no scene is written and nothing you wrote leaves Aurava’s server: the safety check described below runs only once that check has passed.

Who does what

Every request for a scene or a line goes to Aurava’s own server, a small function that runs on Google Cloud in the europe-west1 region, in Belgium. It builds the request to each company, passes it on, and sends the answer back to your phone.

• Anthropic writes your scene and the line about what you might notice, with its model Claude Opus 5.5 (claude-opus-5-5).
• OpenAI checks your writing for care each time a scene is asked for, with its moderation service (omni-moderation-latest). It writes nothing.
• Google makes the voice, only if you listen, with a Gemini speech model (gemini-3.8-flash-lite-tts). The app reaches it directly, through Firebase AI Logic. Firebase is operated by Google LLC.

What is sent, request by request

Aurava makes four kinds of request. Each carries nothing of yours beyond what is listed here, apart from the App Check token described below and the technical details any app’s request carries, such as the app’s version and your IP address.

1. Tonight’s scene, to Anthropic. Your first name; your wish, as you wrote it; and up to the fifteen most recent journal entries linked to that wish. Those are your answers from setup, the line you write each night, anything you write in the Journal and link to that wish, and what you write after a practice, which the app links to that practice’s wish unless you remove the link before saving. Only your words travel, with how many days apart you wrote them, not the questions they answered. So that each night is new, it also carries some of your past scenes: how your recent scenes opened and turned, and the whole of your previous scene. Those scenes were written by AI from your words. The request also tells Aurava’s server which kind of wish it is, one or more of eight names, and the server uses that to choose how the request to Anthropic is worded.
2. A safety check, to OpenAI. Each time a scene is asked for, the text of those same entries goes to OpenAI’s moderation service, once the subscription check has passed. OpenAI does not receive your name or your wish. If the check suggests you may be in danger, no scene is written that night: you see a caring message and where to find help, and that message is not saved. The entry that led to it stays among your recent writing, so while it is one of your fifteen most recent, the caring message can come again on later nights. If the check cannot be made, the scene is written without it.
3. The line about what you might notice, and the note, to Anthropic. Sent only after a scene has been written. It carries your first name, your wish, the same entries, tonight’s scene, the note of what your scenes have made true so far as it stood before tonight, and the lines it gave you on recent nights. It writes the line and a fresh note, which Aurava keeps on your phone.
4. The voice, to Google. Sent only when you tap to listen to a scene. It carries the words of that one scene and nothing else you wrote. The recording comes back to your phone and is kept there, as section 3 describes.

Both requests to Aurava’s server, for the scene and for the line, also carry RevenueCat’s identifier for your install, which the server uses to check your subscription, and your star sign when you have one. Today the server does not pass your sign on to anyone.

Each request to Anthropic also carries a code for your install, made from its random ID: a code that does not contain your name or email, which Anthropic may use to help detect abuse. It is the same code on every request from your install.

If an answer comes back unusable, the server may ask Anthropic once more with the same writing. If Anthropic declines a request, Aurava may ask again with less in it, never with more.

What is not sent

Your birthday, how you describe yourself, your city, your reminder time and your practice history are never sent. Your full journal is never uploaded. Only up to the fifteen most recent entries linked to the one wish that night is about are sent. An entry in the Journal that is not linked to a wish is not sent, with one exception: when you give a wish on Today or during setup at a time when you have no wish, every entry not linked to a wish, including ones written earlier, becomes part of that wish, and the most recent of them are then among your recent writing. There is no background sync and no bulk upload.

What Aurava’s server keeps

The server writes none of your text to storage or to its logs. For each request it writes one short line made only of numbers and fixed words, such as the kind of request, whether it succeeded, how long each step took, token and word counts, the model’s name, and whether the safety check asked for care. That line holds nothing you wrote and not the code for your install. Each scene the server writes is given a random code for that night, which the app keeps with the scene. If you rate a scene or report one from the reader, the app sends that code with your rating (a number from one to three) or with the report, and the server writes one more such line for it; nothing you wrote travels with either.

Apart from that line, Google Cloud’s own request log for the server records each call’s IP address and the app’s version details. That log is kept in Lunaplum’s project on Google Cloud for a limited time.

So that one install cannot make endless requests, the server keeps one small record per install in Google’s database, Firestore: a code made from your install’s ID, the day, how many requests were made that day, and when the record expires. It is deleted automatically a few days after your install last asked. Nothing you wrote is in it.

What Anthropic does with it

Under its data processing terms, Anthropic acts as Lunaplum’s processor, and those terms say it processes your writing to provide or maintain its service, including keeping it secure and fixing errors, unless the law requires otherwise. Anthropic also says it runs privacy-preserving, aggregated analysis of how its products are used, and safety analysis that can be linked back to accounts. It does not say whether that includes requests like Aurava’s.

Anthropic’s terms say it may not train its models on what Aurava sends.

Anthropic says it deletes what Aurava sends, and what it writes back, from its systems within 30 days. It may keep them longer in three cases: as the law requires; to combat misuse, with no time limit stated; and, if its automated safety systems flag it, for up to 2 years, with the safety scores kept for up to 7 years. Anthropic also says that, if its contract with a customer permits, it may keep an anonymised form of the customer’s data longer, for research or statistics.

What OpenAI does with it

Aurava sends your writing to OpenAI’s moderation service for one reason: to check for signs that you may be at risk. OpenAI says API data is not used to train its models. Its agreement says it uses what Aurava sends to provide the service, comply with the law, enforce its policies and prevent abuse. OpenAI’s endpoint table lists no abuse-monitoring retention and no stored data for this check.

The same OpenAI page also says, more generally, that by default abuse-monitoring logs are generated for all API feature usage and kept for up to 30 days, unless longer is required by law or reasonably necessary to protect its services or anyone else from harm, and it does not say how that fits with the table. OpenAI’s list of sub-processors says that samples of content its models flag may be shared with sub-processors that help it review that content. It does not say whether that covers this check.

What Google does with it

Your writing passes through Aurava’s own server, which runs on Google Cloud (region europe-west1) and does not save your writing or write it to logs. For that service, Google acts as Lunaplum’s processor. Google’s Firebase page says that Cloud Functions, the service the server runs on, uses IP addresses to run requests and saves them only temporarily. That is Google’s statement about its own handling, separate from the request log in Lunaplum’s project described above. This request also carries the App Check token described below, and what is said there applies to it too.

To make the voice, the app sends Google only the finished scene. That scene is written as you, in your first person, from what you wrote. The request goes from your phone to Firebase AI Logic, which Google’s Firebase page says does not itself store data. Google’s terms for the paid service say it does not use the scene, or the audio it sends back, to improve its products, and those terms control over Google’s general API terms. Google keeps both for 55 days to detect abuse and for legal reasons, and may train only its policy-enforcement models on them. Authorized Google staff may review them if Google’s systems flag them, or if a project keeps showing suspicious activity. Google may store them transiently or cache them in any country where Google or its agents have facilities.

Where to read more

Lunaplum does not keep your writing on any server, does not use it to train any model, and does not sell it or share it with anyone beyond the companies named here. Each company’s own pages are here: Anthropic’s Commercial Terms, Data Processing Addendum, note on how long it keeps data and note on how it analyses usage; OpenAI’s page on API data, Services Agreement, Data Processing Addendum and list of sub-processors; and Google’s Gemini API Additional Terms of Service, page on abuse monitoring, processor terms, Firebase Privacy and Security page and App Check overview.

How to stop it

Open Settings, from the gear on your Profile tab, and turn off Write my scenes. From that moment none of your words are sent to Aurava’s server, Anthropic, OpenAI or Google: no scenes, no lines about what to notice, no safety checks and no new recordings. A request already under way when you switch it off is finished, and if a scene is being written at that moment, the line about what to notice that follows it is still asked for. Scenes already on your phone stay there, recordings stay for up to 30 nights, and a recording already made can still be played. What Aurava sends, in the same place, shows the list from the consent screen at any time. You can turn Write my scenes back on whenever you like.

If it fails

If the scene request fails, because you are offline or the service is unavailable, no other scene is shown in its place. The night offers Try again, and Aurava asks again when you tap it or the next time you open the app, which sends the same writing then. If only the line about what to notice fails, your scene stays and the line is left out. If the voice fails, nothing is kept and the scene’s words are not sent again until you tap to listen again, and the scene is still there to read. The app stays fully usable.

Abuse protection

Every request to Aurava’s server and to Google’s voice service carries a token from Firebase App Check, showing that it comes from the real Aurava app. For each of those requests the app asks Google’s App Check service for a fresh, limited use token, and it asks at no other time. That exchange is with Google, and it carries nothing you wrote.

To issue the token, Google’s App Check service uses material from your device to confirm that the device and the app are genuine. Google says it does not keep that material itself. It sends the material to the attestation provider, whose own terms then apply to it. Google says the token it issues may retain some information about that material. It keeps tokens used with its replay-protection features for at most 30 days.