AURA Privacy Policy

Effective date: November 1, 2026
Last updated: November 1, 2026

This Privacy Policy explains how Sapphire Labs, LLC d/b/a AURA Fit ("AURA," "we," "us," or "our") collects, uses, shares, and protects personal information when you:

use the AURA mobile application (the "App");
visit aurafit.io or any other website we operate (the "Website");
join our waitlist, subscribe to our emails, or take part in a promotion, raffle, or event; or
contact us for support or send us feedback.

Together, these are our "Services." This policy is part of our Terms of Use. If you do not agree with this policy, please do not use the Services.

Privacy at a glance


What we collect	Account and profile details, the activities you record, health and fitness data you allow us to read, location when you track an outdoor activity, and basic device and usage data.
Why	To run AURA, show your progress, power social features like Circles, keep the Services secure, and improve them.
What we never do	Sell your personal information. Use Apple Health data for advertising or marketing. Share your health data with data brokers.
What others see	Only what you choose to share through social features, your profile, or sticker exports.
Your control	Change permissions at any time, download your data, or delete your account from inside the App.
Questions	support@aurafit.io

1. Who we are

Sapphire Labs, LLC d/b/a AURA Fit, located at 3700 Standridge Dr., Ste. 202, The Colony, Texas 75056, is responsible for your personal information (the "data controller" under laws such as the EU and UK GDPR).

AURA is a fitness tracking and performance product. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Do not rely on AURA for medical decisions. Talk to a qualified health professional before starting or changing any exercise program.

2. Information we collect

2.1 Information you give us

Account information: name, email address, password (stored in hashed form), date of birth, and gender. If you sign in through a third-party service such as Sign in with Apple, we receive the information that service shares with us.
Profile information: username, profile photo, height, weight, units preference, and fitness goals.
Activity and session content: workouts and sessions you log or import, titles, notes, photos you attach, personal records, and streaks.
Social content: Circles you create or join, invites you send or accept, posts, reactions, comments, and the things you choose to share with other members.
Feedback and support: messages you send us and in-app feedback. When you send feedback, a screenshot of the screen you are on may be attached automatically, and you may add more screenshots. Screenshots can show personal information that is visible on your screen, so please review them before sending.
Waitlist, emails, and promotions: name, email address, preferred language, and any information you give us when entering a raffle, contest, or event, as described in that promotion's official rules.

2.2 Information collected automatically

Device information: device model, operating system and version, app version, language, time zone, and device identifiers.
Usage information: features used, screens viewed, interactions, session length, crash reports, and performance logs.
Website information: IP address, browser type, pages visited, referring page, and approximate location derived from your IP address, collected through cookies and similar technologies (see Section 8).

2.3 Location information

Precise location (GPS): only with your permission, and only to record routes, distance, pace, and maps for outdoor activities you choose to track.
Weather and conditions: when an activity has location data, we use it to retrieve weather conditions (for example, temperature, feels-like, wind, and humidity) for the time and place of that activity. We send only the location and time needed to obtain that information to our weather provider.
Approximate location: we may infer your general region from your IP address for security, analytics, and to show the right language or units.

You can turn off location access at any time in your device settings. Some features, such as route maps and conditions, will not work without it.

2.4 Apple Health data

With your explicit permission, AURA may read and, where you allow it, write data to Apple Health, such as:

workouts, exercise minutes, and active energy burned;
steps and distance;
heart rate and heart-rate zones;
sleep analysis;
nutrition and water intake; and
body measurements.

We only access the specific data types you authorize. You can change or revoke these permissions at any time (see Section 12). Section 4 explains the extra protections that apply to this data.

2.5 Health and fitness data is sensitive

Much of the information AURA processes, including heart rate, sleep, body measurements, and workout history, is health or fitness information. Some laws treat it as "sensitive data," "special category data," or "consumer health data." We collect and use it only with your consent and only to provide the Services you ask for, and we apply the additional protections described in this policy.

3. How we use your information

We use personal information to:

Provide the Services: create and manage your account, record and display your activities, sync with Apple Health, calculate progress, streaks, and records, and show weather conditions.
Run social features: operate Circles, rankings, comparisons, invites, your profile, and sharing tools.
Personalize your experience: show relevant insights, content, and settings such as units and language.
Communicate with you: send service messages (for example, security notices and changes to these terms), respond to support requests, and, where permitted, send product news and promotions.
Run promotions: administer waitlists, raffles, and events, including contacting winners, under the applicable official rules.
Improve the Services: understand how features are used, fix bugs, and develop new features, using aggregated or de-identified data wherever we can.
Keep the Services safe: detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms.
Meet legal obligations: comply with laws, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

Artificial intelligence: AURA does not use artificial intelligence, machine learning, or other AI-powered systems or tools to process your personal information, including your health and fitness data. Your insights, progress, streaks, and records are calculated with fixed rules, not AI models. If this changes, we will update this policy before we start.

Legal bases (EEA, UK, and Switzerland)

Purpose	Legal basis
Providing the App, your account, and core features	Performance of our contract with you
Health and fitness data, including Apple Health data	Your explicit consent
Precise location	Your consent
Social features and what you choose to share	Performance of contract and your consent
Marketing emails	Your consent (you can withdraw it at any time)
Analytics, security, and fraud prevention	Our legitimate interests in running a secure, reliable product
Non-essential website cookies	Your consent
Legal compliance and defending claims	Legal obligation and legitimate interests

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already happened, but some features may stop working.

4. Health and fitness data from connected services

4.1 How we protect it

We take extra care with health and fitness data we receive from Apple Health and the other services you connect (Section 4.2):

Purpose limited: we use this data only to provide health and fitness features within AURA, such as displaying your metrics, tracking progress, and generating your personal insights.
No selling: we do not sell health data from Apple Health or any connected service.
No advertising or marketing: we do not use it for advertising, marketing, or similar data-mining purposes, and we do not disclose it to advertising platforms, data brokers, or information resellers.
No AI training: we do not use it to train, fine-tune, or improve any artificial intelligence or machine-learning model, and we do not permit anyone else to.
No unauthorized sharing: we do not disclose it to third parties except (a) to service providers that process it on our behalf solely to provide the Services, under strict confidentiality obligations; (b) with your express consent; or (c) where required by law.
No iCloud storage: we do not store Apple Health data in iCloud.
Your control: you decide which data types AURA can access and can change that at any time.

4.2 Connected services

You can connect AURA to the services below. We read data only from the services you connect, and only after you grant permission.

Apple Health, Health Connect, Google Health, Samsung Health, Huawei Health, Garmin, Fitbit, Oura, WHOOP, Polar, Suunto, and COROS.

We use a third-party integration provider, Spike, to connect to these services on our behalf. Spike receives your data from the service you connected and passes it to us. It processes the data only to provide this connection to us.

You can disconnect any service at any time in Settings. Disconnecting stops any new data reaching us. To remove data already received, delete your account, which erases it (see Section 10).

You can also revoke AURA's access from the connected service's own app or website, which has the same effect.

5. Social features and what other people can see

AURA includes social features. Please think about what you share.

Circles: members of a Circle you join can see your name, username, profile photo, and Circle activity, such as streaks, rankings, personal records, training volume, and head-to-head comparisons. If you leave a Circle, past season results may remain visible to its members.
Your profile and profile link: your public profile, and any profile link you share, can show your name, username, profile photo, and the stats you make visible. Anyone with the link, and apps that create link previews, may be able to see that information.
Posts and sessions: sessions and posts you share are visible to the audience allowed by your settings. Route maps can reveal where you train. Use the option to hide your map, or avoid sharing routes that start or end at your home or workplace.
Stickers and exports: when you export a session as an image or sticker and post it to another platform (for example, Instagram), that content is governed by that platform's terms and privacy policy, not ours. Once you share content outside AURA, we cannot control how others use, copy, or keep it.
Invites: when you invite someone, we use the information needed to deliver the invite. We do not access your device's address book unless you grant permission.

You are responsible for the content you choose to share and for having the right to share any information about other people.

6. How we share your information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We share it only as follows:

6.1 Service providers

We use trusted vendors that process personal information on our behalf and only under our instructions, such as:

cloud hosting and data storage;
authentication and security;
product and website analytics (for example, Google Analytics on our Website);
email delivery and marketing (for example, Mailchimp);
crash reporting and performance monitoring;
feedback and issue tracking (for example, Atlassian Jira);
wearable and health-app integration (Spike; see Section 4.2);
weather data providers; and
customer support tools.

These providers must protect your information, use it only to provide services to us, and may not use it for their own purposes.

6.2 Other users

We share the information you choose to make visible through social features, as described in Section 5.

6.3 Legal requirements and protection

We may disclose information if we believe in good faith it is required by law, regulation, legal process, or a governmental request, or necessary to protect the rights, property, or safety of AURA, our users, or others, including to enforce our Terms and investigate fraud or security issues.

6.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. The recipient will be required to honor this Privacy Policy for the information it receives, and we will notify you of any change in ownership that affects your information.

6.5 With your consent

We share information with other third parties when you direct or allow us to, for example when you connect a third-party service.

6.6 Aggregated and de-identified data

We may share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you. We will not attempt to re-identify such data, and we require recipients not to do so.

7. Data security

We use technical and organizational measures designed to protect your information, including:

encryption of data in transit and at rest;
secure authentication;
access controls that limit personal data to personnel who need it; and
regular security reviews.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for using a secure device. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law.

8. Cookies and website analytics

Our Website uses cookies and similar technologies to operate the site, remember your preferences, and understand how visitors use it (for example, through Google Analytics).

Strictly necessary cookies are required for the Website to work.
Analytics cookies help us measure and improve the Website. Where required by law, we use them only after you consent through our cookie banner.

You can manage cookies through our cookie settings and your browser. You can also opt out of Google Analytics using Google's browser add-on. We honor recognized opt-out preference signals, such as Global Privacy Control, where required by law.

9. Waitlist, emails, and promotions

If you join our waitlist or subscribe to our emails, we use your name, email address, and language preference to send you updates about AURA. You can unsubscribe at any time using the link in any email or by contacting us. We may still send you service messages that are necessary for your account.

Raffles, contests, and events are governed by their own official rules, which may describe additional information we collect and how winners are announced. If the rules and this policy conflict on a promotion-specific point, the official rules apply to that promotion.

10. Data retention

We keep personal information only as long as we need it for the purposes described in this policy:

Data	How long we keep it
Account, profile, and activity data	While your account is active
After you delete your account	Erased when you delete your account, and in all cases within 72 hours. Residual copies in secure backups are overwritten within 90 days and are never restored to active use.
Support messages and feedback (including screenshots)	Up to 24 months after the issue is closed
Waitlist and marketing contacts	Until you unsubscribe or ask us to delete them
Promotion entries	For the duration of the promotion and any period required by law or the official rules
Security and system logs	Up to 12 months

We may keep information longer when required by law, to resolve disputes, to enforce our agreements, or to protect against fraud and abuse. De-identified or aggregated data may be kept without time limits.

11. Your rights and choices

Depending on where you live, you may have the right to:

Access the personal information we hold about you;
Correct inaccurate or incomplete information;
Delete your personal information;
Port your information in a structured, machine-readable format;
Withdraw consent at any time where we rely on consent;
Object to or restrict certain processing, including processing based on legitimate interests;
Opt out of marketing communications;
Appeal a decision we make about your request; and
Complain to a data protection authority in your country.

Delete your account in the App: you can delete your account at any time from Settings in the App. Deleting your account deletes your AURA data as described in Section 10. It does not delete data stored in Apple Health on your device.

How to make a request: email support@aurafit.io from the email address associated with your account. We will need to verify your identity before acting on your request, and we may ask for more information to do so. You may use an authorized agent where the law allows; we may ask for proof of authorization. We will respond within the time required by applicable law.

No discrimination: we will not treat you differently for exercising your privacy rights.

12. Managing Apple Health permissions

You can control what AURA can access in Apple Health at any time:

Open the Health app on your iPhone.
Tap your profile picture in the top-right corner.
Under Privacy, tap Apps.
Select AURA.
Turn individual data types on or off.

You can also manage these permissions in the iPhone Settings app. Exact steps may vary by iOS version.

Revoking permission stops future access. It does not delete data that was already synced to AURA. To delete synced data, use the data deletion option in the App or contact us.

13. Additional information for U.S. residents

13.1 Consumer health data

Some U.S. state laws, including in Washington, Nevada, and Connecticut, give additional rights over "consumer health data." For these purposes:

What we collect: the health and fitness information described in Sections 2.3–2.5, including workouts, heart rate, sleep, body measurements, and nutrition data, and inferences such as streaks, records, and progress insights.
Sources: you, your device, Apple Health, and connected services you authorize.
Why: only to provide the features you request, as described in Sections 3 and 4.
Who we share it with: service providers that process it on our behalf, other users only as you choose (Section 5), and others with your consent or where required by law.
Consent: we collect and share consumer health data only with your consent or as necessary to provide the Services you request.
No sale: we do not sell consumer health data.
No geofencing: we do not use location data to create virtual boundaries around health care facilities.

You may confirm whether we hold your consumer health data, access it, request deletion, and withdraw consent by contacting support@aurafit.io. You may appeal any denial by replying to our response with the subject "Appeal."

13.2 State privacy rights

Residents of California and other states with comprehensive privacy laws have the rights described in Section 11, plus the right to know the categories of personal information we collect, use, and disclose. In the last 12 months we have collected the categories described in Section 2 (identifiers, personal records, characteristics such as age and gender, internet and device activity, geolocation, sensitive personal information including health data, and inferences) from the sources and for the purposes described in Sections 2 and 3, and disclosed them for business purposes to the recipients in Section 6.

We do not sell or "share" (for cross-context behavioral advertising) personal information, and we do not use or disclose sensitive personal information for purposes other than those allowed by law. We do not knowingly sell or share the personal information of consumers under 16.

14. International users and data transfers

AURA is used in several countries, and your information may be processed in countries other than your own, including the United States, which may have different data protection laws.

When we transfer personal information from the EEA, UK, Switzerland, or other regions with transfer rules, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms. You may request more information about these safeguards by contacting us.

If you live in El Salvador or elsewhere in Latin America, you have the rights granted by your local data protection laws, which you can exercise as described in Section 11.

15. Children's privacy

AURA is intended only for people who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it promptly. If you believe a minor has given us personal information, please contact us at support@aurafit.io.

16. Third-party services and links

The Services may link to or integrate with third-party websites and services, such as Apple Health, Sign in with Apple, and social media platforms. We are not responsible for their privacy practices. Their use of your information is governed by their own policies, which we encourage you to read.

17. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on our Website and in the App and update the "Last updated" date above.

If we make material changes, we will notify you in advance by email or in the App. Where the law requires, including for any new use of your health data, we will ask for your consent before the change applies to you. For other changes, continuing to use the Services after the effective date means you accept the updated policy.

18. Language

This policy may be made available in Spanish and other languages. If there is any conflict between a translation and the English version, the English version prevails, unless local law requires otherwise.

19. Contact us

If you have questions, concerns, or requests about this Privacy Policy or your personal information, contact:

AURA Privacy Team
Sapphire Labs, LLC d/b/a AURA Fit
3700 Standridge Dr., Ste. 202
The Colony, Texas 75056
Email: support@aurafit.io