Privacy Policy

Account information and Google sign-in

For email and password accounts, we process your email address, password credential, email-verification status, account identifier and account timestamps. Password credentials are stored as hashes. Verification and password-recovery requests also involve temporary security records and emails.

Google sign-in is optional. When you choose it, you are redirected to Google. Google authenticates you and returns identity information to AuralAsh. AuralAsh does not receive your Google password. We request only basic identity permissions: openid, email and profile. We do not request access to Gmail, Drive, Calendar or your contacts.

The sign-in software reads your Google account identifier, email address, email-verification status, display name and profile-picture URL. For a new Google-created account, we store your normalized email address, verified-email status and profile-picture URL, together with a local account identifier and timestamps. The account's name field is set to your email address rather than your Google display name. We store the Google provider identifier, issuer, account identifier and granted scope information associated with your local account so that subsequent sign-ins can find the same account. Linking Google to an existing account preserves its local profile rather than replacing it with the Google name or picture.

We use this identity information to create or authenticate your AuralAsh account, check that Google has verified your email, and support a Google connection you explicitly request. An existing account with the same email is not linked automatically: first sign in to that account, then choose Link Google account. The local account must remain signed in and verified, and its current email must match the verified Google email when the connection completes.

Google's authorization response and tokens are processed during sign-in. AuralAsh clears Google access, refresh and ID tokens before saving or updating the Google account record; it does not retain them there for subsequent Google API access. Removing the connection in your Google Account settings does not delete information already held in your AuralAsh account.

Sessions, cookies and website requests

We use first-party authentication cookies and server-side session records to keep you signed in and protect sign-in and account-linking requests. Session records include identifiers, creation/update and expiry times, and may include your IP address and browser user agent. Authentication cookies are configured as HttpOnly, Secure on the public HTTPS website, and SameSite=Lax. Blocking these cookies can prevent sign-in from working. Signing out ends the current AuralAsh session; it does not delete your account or sign you out of Google.

The website server processes request information such as IP address, time, requested path, browser user agent, response status and security/rate-limit information to serve the website and protect it from abuse. Authentication links and emails contain temporary security information; do not share them with other people. The current application does not implement advertising or analytics tags, and its newsletter form is disabled.

Service providers and communications

Google processes the Google authentication interaction under its own privacy policy. AuralAsh exchanges the authorization code with Google and receives identity information for the sign-in described above.

AuralAsh stores account and session records in its server-side authentication database on hosting supplied by netcup (netcup.de). This AuralAsh server is located in Vienna, Austria.

Purelymail delivers AuralAsh verification and password-recovery emails; these messages include your recipient email address and the relevant verification or recovery link. They are account-service messages, not newsletter subscriptions. Purelymail's FAQ states that its servers are in AWS US-East-1 in northern Virginia, United States. Its security documentation says deleted email messages, including undelivered originals, remain in its backups for one month and system logs older than one month are deleted. Its privacy policy specifies 30 days for diagnostic logs. These are provider statements, not an independently verified deletion guarantee from AuralAsh. If you email us, your chosen mail provider and the receiving mail service also process your message and addressing information; receiving or forwarded copies are separate from the website account database.

Links to external social websites take you to services operating under their own privacy policies.

Retention and your choices

Authentication sessions are configured with a seven-day validity period and can be refreshed while in use. Verification and password-reset links are configured to expire after one hour. These validity limits do not specify when every associated database, log or backup record is erased. Signing out, letting a session expire, or removing Google sign-in permission does not erase the account or its stored Google identity connection.

AuralAsh is currently in a test phase. We keep a verified account and its Google identity connection while the account is used or remains available at your choice. There is no fixed inactivity-deletion period for verified accounts. You can request deletion at any time. Scheduled cleanup of unverified accounts and expired authentication records has not been activated. Some security and rate-limit records are removed during ordinary authentication processing, but we do not currently specify a fixed maximum time for deleting unverified accounts, expired sessions, temporary verification, password-reset or Google sign-in state records, or rate-limit records.

Routine website access/error log rotation is configured to run daily with 30 rotations and a 30-day maximum-age setting. Application diagnostic logs use a rotating buffer configured for up to three 10 MB files per container rather than a fixed age limit. Routine host system journals are configured with a 14-day retention limit and a 100 MB storage cap. These settings do not establish when every separately retained or exported copy is erased. We do not currently specify a fixed maximum retention period for separately retained diagnostic, security-incident or legal-preservation records.

If you contact us, we process your message, attachments and addressing information to handle your enquiry or privacy request. Messages sent to hello@auralash.rocks are forwarded to the operator's mailbox. During the test phase, we do not specify a fixed maximum retention period for controlled support messages and attachments, sent, trash or forwarded copies, privacy-request verification material, or records of a request and its outcome. Mail providers and recipients may keep their own copies under their policies.

Verification and password-recovery messages may also remain in controlled mailboxes; we do not currently specify a fixed maximum retention period for those mailbox copies. Provider delivery queues and backups are governed by the provider statements described above.

We retain authentication-database backups for recovery. Earlier backups can contain account information that has been deleted from the active database. We do not currently specify a fixed maximum retention period for all controlled backup copies. A deletion operation may also leave a separate administrative record. A complete process covering every retained copy and the reapplication of completed deletions before a backup is restored has not yet been put into operation. Deletion from the active database therefore does not establish erasure from every backup or other retained copy. This does not prevent you from deliberately creating a new account later.

To request access to your account information, correction, removal of the Google connection, or account deletion, email hello@auralash.rocks. The website does not currently provide a self-service account-deletion control. Requests are handled individually. We may ask you to confirm control of the registered email address or sign in through the website before acting on a request. We will not ask you to send us your password, Google tokens, session cookies or a recovery link. If you no longer control the registered email, an alternative way to verify the request needs to be assessed before account information is disclosed or changed.

During the test phase, we do not specify a fixed service target for acknowledging or completing a privacy request. This does not limit any rights or deadlines that apply to you.

When an account is deleted from the active authentication database, its local profile, password credential and Google identity connection are removed, and its AuralAsh sessions and outstanding account-linked security records are revoked. This does not delete your Google account or automatically erase backup or mailbox copies. Removing only the Google connection preserves the local account; a Google-only account needs an alternative sign-in method before that connection is removed. A correction to the sign-in email requires confirmation of the new email and may require removing and explicitly reconnecting Google. You can also remove AuralAsh's permission in your Google Account settings; that action alone does not delete the AuralAsh records.