Privacy Policy | Aura Scriptworks

1. Data We Collect & The Checkout Handoff

We build local-first: what you make in our tools lives on your device or in your own cloud storage, not on our servers. Aura Scriptworks LLC collects only the operational data we need to provide our services, manage your license, and keep our software working. This policy covers our browser extensions, our websites, and our web applications, including Aura Story Builder (storybuilder.aurascriptworks.com).

Account Data & Authentication Information: Email address and a unique User ID for authentication (via Google OAuth). We do not collect, process, or store your passwords.
Operational Telemetry: Basic app-health pings (e.g., verifying an active license). Our extensions track your activity volume strictly locally on your device — our servers never see your ongoing usage numbers. We only receive a generic, anonymous flag when you reach a specific milestone.
Sharing Records (Aura Story Builder): If you share a book, we keep a small record of the share so the people you chose can open it: the book's title, the ID of its folder in your Google Drive, and, if you shared it with a specific person, that person's email address. The book itself stays in your Drive (see Section 6).
Website & Security Data: Like any website, our hosting provider handles your IP address and basic technical details (such as your browser type) to deliver pages, block abuse, and limit how often the free AI features can be used without an account.
Checkout & Billing (The Merchant of Record): When you initiate a purchase, you are transferred to our Merchant of Record, Lemon Squeezy. To legally process the sale, prevent fraud, and remit global taxes, Lemon Squeezy collects your email, IP address, device data, and payment information. We do not store or process your credit card information. This transactional data is stored and governed by the Lemon Squeezy Privacy Policy.
Affiliate Referrals: If you reach our sites through a partner's referral link, the visit is recorded so the partner can be credited if you buy. See Section 11.

2. Data We NEVER Collect

Your work is yours. Our extensions and apps process what you create on your device by default, and we have no visibility into it. There are two exceptions, both started by you: the optional AI built into Aura Story Builder (Section 4) and sharing a book with someone (Section 6). Even then, we pass your content along and keep none of it. We never collect or keep a copy of:

Phone Numbers: We never collect, process, or transmit your phone number. Our authentication is handled exclusively via Google OAuth — no phone number is ever requested, stored, or used. You may notice that the sign-in library we use, provided by Supabase, includes built-in code for optional phone-number login. That code ships with the library and can't be removed, but we do not use, call, or activate it in any capacity.
Continuous usage metrics or action counts: Your total usage volume stays on your machine; we only know if a milestone flag is triggered.
Your stories, characters, pictures, or library from Aura Story Builder. They live on your device or in your own Google Drive.
The text, data inputs, files, or generated content you process through any of our extensions.
Your browsing history or the pages you visit while using our extensions.
Keystrokes or screen recordings.

For the cookies our websites use, see Section 11.

3. Data Handling and Usage

We use the minimal data we collect strictly to operate the business:

Authenticating your account and verifying your license tier.
Processing payments, renewals, and refunds securely.
Sending transactional emails (like purchase receipts).
Providing customer support when you contact us.
Keeping our services secure and preventing abuse, such as automated traffic against our AI features.
Crediting an affiliate partner when you buy after following their referral link (Section 11).
Optional Updates: If — and only if — you explicitly opt-in via our in-app prompts, we will use your email to send you advanced tutorials, workflow tips, and major sales alerts for Aura Scriptworks tools.

4. Data Storage & Security

Extension & App Data: All data related to your prompt queues, workflow configurations, and (for Aura Story Builder) your story library is stored on your device, in your browser's storage or in a folder you choose on disk, or in your own Google Drive if you connect it (see Section 6). It is never stored on our servers. It only passes through our servers if you use the in-app AI described below or share a book (see Section 6).
On-Device AI Models (Aura Story Builder): Some features, such as voice dictation and the picture eraser, run an AI model directly on your device. The model is downloaded once from Hugging Face; what you dictate or edit never leaves your device.
In-App AI (Aura Story Builder, optional): Aura Story Builder includes optional AI features (planning a story with the AI, having it write your pages, and illustrating them) that run on AI credits. When you use one, the text of that request, and any reference images it needs, pass through our servers to our AI providers (listed in Section 5), and the result comes straight back to you. Any photos you add to an AI chat are provided to our AI provider to process, and are never stored on our servers. We do not store or log the content of these requests or their results, and we never use them to train AI models. The only records we keep are what billing needs: how many credits each request used, and, for pictures queued to be drawn in the background, a reference to the job so the finished pictures can be delivered to your book. Nothing is sent unless you use an AI feature. The prompts Story Builder writes for you to run in your own ChatGPT, Claude, or Gemini account never pass through us at all.
Account Data: Your account data is stored securely in Supabase (PostgreSQL) using industry-standard encryption and strict Row Level Security.
Payment Data: We do not store your credit card information; all financial data is handled exclusively by our Merchant of Record, Lemon Squeezy, which is fully PCI-compliant.

5. Third-Party Services

We use a small stack of trusted, enterprise-grade services to run Aura Scriptworks:

Google (OAuth & Drive API): Account creation and authentication; and, for Aura Story Builder users who opt in, storage of your story library in your own Google Drive (see Section 6).
Google Fonts: Some typefaces in Aura Story Builder load from Google Fonts, so Google receives your IP address and browser details when a page loads.
Supabase: Secure database and authentication handling.
Lemon Squeezy: Our Merchant of Record. Handles all secure payment processing, fraud prevention, global tax compliance, and license key generation, and runs our affiliate program, including recording visits from partner referral links (see Section 11).
Cloudflare: Secure hosting, DDoS and bot protection, rate limiting, and the servers that pass in-app AI requests to our AI providers.
AI providers (Aura Story Builder in-app AI only): EnclaveHost (eyesoff.ai), which runs the AI model inside a secure enclave, and the Google Gemini API, which draws illustrations and takes over text requests if the primary provider is unavailable. They receive only the content of the AI requests you make, and process it under their own terms to produce the result.
Hugging Face: Hosts the AI models that some Aura Story Builder features download to run on your device. Hugging Face receives the download request, never your content.

6. Google User Data (Google Sign-In & Google Drive)

Some of our applications access Google user data through Google's APIs, always with your explicit consent via Google's OAuth consent screen. This section describes exactly what we access, how we use it, how it is stored, and how you can revoke access.

Google Sign-In: When you sign in with your Google account, we receive your name, email address, profile picture, and a unique account identifier. We use these solely to create and authenticate your account. We never receive or store your Google password.
Google Drive (Aura Story Builder — optional): If you choose to connect Google Drive as your storage backend, Aura Story Builder requests the drive.file scope. This scope only permits access to files and folders that the app itself creates in your Drive (a story-builder/ folder containing your stories, characters, settings, and related media). We cannot see, read, or modify any other files in your Google Drive. The same connection also powers the optional Aura Flow integration described below; it requests no additional scopes.
How we use Drive data: Your Drive files are used exclusively to save, load, and sync your Story Builder library across your devices, and to show a book to the people you choose to share it with. When you use Story Builder yourself, file transfers happen directly between your browser (or our Aura Flow extension) and Google Drive. Sharing is the one exception: when someone opens a book you shared with them or by link, our servers use your Drive connection to read that book's files (and, if you gave a person edit access, to save their changes) and pass them along. This reaches only the shared book's folder and happens only while someone has it open. Your story content is never stored on Aura Scriptworks servers.
Aura Flow connection (optional): Our Aura Flow browser extension is part of the same Aura Scriptworks suite and shares this Drive connection. If you have connected Google Drive in Aura Story Builder, Aura Flow can load a book's generated prompts from your story-builder/prompts/ folder and write the resulting images or video into that book's pending/ folder, where you approve or reject each one. This uses the same drive.file scope — no additional Google permissions are requested, and it reaches only files these apps created. Aura Flow obtains a short-lived Google access token the same way Story Builder does; the token is held in memory only and never stored. The connection is active only while you are signed in to Aura Flow with the same account.
What we store: To keep your Drive connection active between sessions, we store a Google OAuth refresh token in our database (Supabase), protected by encryption and strict Row Level Security so that only your authenticated account can access it. Short-lived access tokens are held in your browser's memory only and are never persisted. We also store the folder ID of the app's own story-builder/ folder to avoid repeated lookups. If you share a book, we also store the book's title, the ID of its Drive folder, and the email address of each person you shared it with (a link share stores a random link ID instead of an email). Removing a share or link deletes its record.
Sharing: We do not sell, rent, or share Google user data with any third party, except with the people you choose to share a book with. We do not use Google user data for advertising. No humans read your Drive data, except where required for security purposes, to comply with applicable law, or with your explicit consent.
Revoking access: You can disconnect Google Drive at any time from Storage Settings inside Aura Story Builder — this immediately deletes the stored refresh token from our database, and books you've shared stop opening for others because we can no longer reach them. You can also revoke our access from your Google Account security settings. Your story files always remain in your own Google Drive, fully under your control.
Retention & deletion: Stored Google credentials are deleted immediately when you disconnect Drive or delete your account. Because your files live in your own Google Drive, deleting your Aura Scriptworks account never deletes your stories.

Aura Scriptworks' use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. User Consent

We ask for your consent before collecting personal data tied to an account. Consent is obtained as follows:

Before you sign in: Before you create an account, we handle only what any website needs to deliver pages and protect itself (Section 1), the content of any free AI request you choose to make (passed along and never stored, Section 4), and, if you arrived through a partner's link, the referral described in Section 11.
Account creation: By signing in with Google OAuth, you consent to us receiving your email address and a unique User ID for the purpose of authenticating your account and managing your license.
Optional communications: Marketing and educational emails are only sent if you explicitly opt in via an in-app prompt. This is separate from and never bundled with account creation.
Cookies: Where the law requires your consent for a cookie or similar technology, we ask for it before using it, or we don't use it.
Extension operation: All workflow data processed by our extensions (prompt queues, configurations, captured content) stays on your device, or goes to your own Google Drive if you use the Aura Flow and Story Builder connection. We never transmit it to our servers, so we never ask for consent to do so.

8. Data Sharing and Disclosure

We do not sell your personal data. We share it only:

With the service providers listed in Section 5, to run our services, process your transactions, and verify your license.
With the people you choose to share a book with (Section 6).
With Lemon Squeezy, to credit an affiliate partner when you buy after following their referral link (Section 11).
When the law requires it, such as in response to a valid court order.

Because the extension operates locally to assist with queuing your prompts, no workflow data is ever transmitted to us, and therefore cannot be shared by us.

9. Your Rights

You completely own your relationship with us. At any time, you can:

Access the personal data we have on file.
Correct your account data.
Request the complete deletion of your account and associated data.
Export your account data.
Unsubscribe from our optional educational/promotional emails with one click.

Depending on where you live (for example the EU, the UK, or California), privacy law may give you further rights, such as objecting to or restricting how we use your data. We honor those requests. To make one, contact us (Section 14).

10. Chrome Web Store — Limited Use Compliance

Our browser extensions are distributed through the Chrome Web Store and comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically:

User data obtained through our extensions is used solely to provide and improve the functionality described in each extension's Chrome Web Store listing.
We do not transfer user data to third parties except as described in Section 5 (Third-Party Services) and Section 8 (Data Sharing and Disclosure).
We do not use or transfer user data for advertising, data brokering, or any purpose unrelated to the extension's core function.
We do not allow humans to read user data except where required by law, for security purposes, or with the user's explicit consent.

11. Cookies & Similar Technologies

Our websites use a small number of cookies and similar browser storage. We don't run analytics or advertising cookies.

Essential & Preferences: These keep you signed in across aurascriptworks.com and Aura Story Builder, remember your license status and when it last changed, and remember choices like your light or dark theme and whether you've seen an in-app tour. Aura Story Builder also keeps your library, settings, and drafts in your browser's storage on your device. They are needed for the sites to work as you'd expect.
Affiliate Referrals: Partners in our affiliate program share links to our sites. If you arrive through one, a script from Lemon Squeezy records the visit (the page address, the site that sent you, and a device identifier calculated from your browser's characteristics) and stores a referral ID in a cookie on our domain for a limited period. If you buy during that period, the ID goes with your checkout so the partner is credited. This only runs if you followed a partner's link. Where the law requires your consent for this, we ask for it first or don't use it. Lemon Squeezy handles this data under its own privacy policy.
Advertising & Measurement: We don't use any today. If we start, for example to measure whether our ads lead to sign-ups, we'll list the providers here and update the date at the top of this page before they go live, honor opt-out signals such as Global Privacy Control, and ask for your consent first where the law requires it. We will never use your Google user data (Section 6) or anything you create in our tools for advertising.
Do Not Track: Browsers have no agreed standard for Do Not Track signals, so our sites don't respond to them. Apart from affiliate referrals, we don't track you across other websites.
Your Choices: You can clear or block cookies in your browser at any time. Blocking the affiliate cookie only means a partner won't be credited; blocking essential cookies will sign you out.

12. Children

Our services are intended for adults. Aura Story Builder is made for parents and other grown-ups who create books for the children in their lives; children don't need, and shouldn't create, accounts. We don't knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we'll delete it.

13. Data Retention & Changes to This Policy

Retention: We keep your account data for as long as your account is open. When you delete your account, we delete it along with your license, purchase, and sharing records, and revoke our access to your Google Drive. Lemon Squeezy keeps its own record of your purchases as our Merchant of Record, as tax law requires.
Changes: When we update this policy, we change the date at the top of this page. If a change affects how we use data you've already given us, we'll let you know before it takes effect.

14. Contact

Questions about how we handle your data? If you have an account, sign in on our Support page and message us from the Contact & Bug Reports tab. Anyone, with or without an account, can write to us by mail at:

Aura Scriptworks LLC
4539 N 22nd St Ste N
Phoenix, AZ 85016
USA