Privacy Policy

We collect the account and product data needed to run AuraFarmer:

• Email address and authentication records, including when you sign in with Google, Instagram, or TikTok.
• The public profile you create: username, display name, avatar, bio, country, and the social links you choose to show.
• Challenge activity: proofs you submit, votes, reports, and Aura granted or purchased.
• Purchase records for optional Aura Boosts. Card payments are processed by Stripe. We do not store full card numbers.
• YouTube channel data and tokens, only if you connect a channel. That data is described below.

We do not collect a date of birth. Age is confirmed when you accept the age statement during onboarding. We do not sell personal data.

AuraFarmer accesses Google user data only when you choose Sign in with Google or connect a YouTube channel.

Sign in with Google uses the openid, email, and profile scopes. From that sign-in we receive:

• Your Google account email address.
• Your name.
• Your Google profile picture.
• Your Google account identifier.

Connecting YouTube uses the https://www.googleapis.com/auth/youtube.readonly scope. From that connection we receive:

• Your YouTube channel identifier, channel name, handle, and avatar.
• The identifier of your uploads playlist.
• The title, publish date, thumbnail, and video identifier of recent uploads, so you can pick one as challenge proof.
• An OAuth access token and refresh token for that YouTube permission.

We use Google user data only to provide the AuraFarmer features you request.

We use Google account email, name, profile picture, and account identifier to create your AuraFarmer account, sign you in, show your name and profile picture, and keep a single account for you.

We use YouTube channel data, video metadata, and OAuth tokens only to show the channel you connected, list recent uploads so you can choose one as challenge proof, and verify that the selected video belongs to your channel and was published after the challenge started.

We do not use Google user data for any other purpose. We do not use it for advertising, and we do not sell Google user data.

We do not transfer or disclose your Google user data to third parties for purposes other than the ones provided in this policy.

We share, transfer, or disclose Google user data only with these parties, and only as needed to operate AuraFarmer:

• Our database provider, which stores your account and the encrypted YouTube tokens.
• The infrastructure provider that hosts AuraFarmer, which processes this data in transit solely to run the service.
• Resend, our email provider, which receives the email address on your account when we send authentication messages. If you signed in with Google, that address is the email Google provided.
• Stripe, our payment processor, which receives the email address on your account only if you buy an Aura Boost. Stripe does not receive YouTube data or OAuth tokens.
• Public authorities, when the law requires us to disclose information.

We do not sell Google user data. We do not share YouTube videos, channel data, or OAuth tokens with other AuraFarmer users. Other people see only the public proof you choose to submit.

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information, including Google user data.

• Google user data is encrypted in transit with HTTPS (TLS).
• YouTube OAuth access tokens and refresh tokens are encrypted at rest with AES-256-GCM.
• Those tokens are decrypted only on our servers. They are not sent to the browser or to other users.
• Access to production systems that store Google user data is limited to the people who operate AuraFarmer.
• Google and YouTube authorization use OAuth with a signed, short-lived state value. Google sign-in also uses PKCE.

We will retain your Google user data for the length of time needed to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law. When that retention period ends, we will delete or destroy the data.

• We retain your Google account email, name, profile picture, and account identifier for as long as your AuraFarmer account exists.
• We retain your YouTube channel name, handle, avatar, and channel identifier while the channel is connected. A disconnected connection record may remain until you ask us to delete your account.
• We retain YouTube OAuth access tokens and refresh tokens only while the channel stays connected. When you disconnect YouTube, we revoke the token with Google and delete the stored access token and refresh token.

You may request for your data to be deleted by emailing privacy@aurafarmer.top from the email address on your AuraFarmer account. We delete the Google user data tied to that account within 30 days, except records we must keep to comply with the law.

You can disconnect YouTube at any time in Settings. You can also revoke AuraFarmer access from your Google Account permissions. Revoking access stops further use of that Google permission.

AuraFarmer use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We limit our use of Google user data to providing or improving user-facing features that are visible in AuraFarmer.

We do not allow people to read YouTube data unless you ask us to, it is necessary for security or to investigate abuse, the law requires it, or the data is aggregated for internal operations. We do not use Google user data to train generalized artificial intelligence or machine-learning models, for advertising, or to determine credit-worthiness or for lending.

Questions about this policy, or a request to access or delete your data, can be sent to privacy@aurafarmer.top.