Aura Catch

Privacy Policy — Aura Catch

Effective date: October 18, 2026 · Document version: 1.1

1. General information

This Privacy Policy defines the rules for processing personal data of users of the Aura Catch mobile application and web platform (the "Application").

The Data Controller is:
Dariusz Szweda
ul. Batalionów Chłopskich 15
41-400 Mysłowice, Poland

For all personal data protection matters, you can contact us at: office@auracatch.com

2. Scope of processed data

Aura Catch processes the following user data:

  • email address provided during account registration or sign-in, or provided in the web version to receive price alerts,
  • the identifier of an anonymous guest session (a random account ID issued by Supabase, with no name or address),
  • the list of tracked products and target prices,
  • in the web version: anonymous usage events (visit, search, product added, offer clicked) with a country code, without IP address and without data identifying a person.

The Controller does not process special categories of personal data or sensitive data.

The Application uses camera and microphone access. Image and voice are processed temporarily by the Gemini AI API to recognize products and are immediately removed from memory (Zero Retention). We do not store photos or voice recordings on our servers.

3. Purposes of processing

Personal data is processed solely to:

  • create and maintain a user account (including the anonymous guest session in the web version),
  • enable use of the Application features,
  • send price-drop alerts by email — only after consent has been given,
  • handle technical and account security communication,
  • keep our own anonymous usage statistics of the web version,
  • fulfill legal obligations,
  • prevent abuse and ensure service security.

4. Legal basis for processing

Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR), based on:

  • Article 6(1)(a) GDPR — consent: email alerts and non-essential cookies and scripts (affiliate partners, Google AdSense ads); consent can be withdrawn at any time,
  • Article 6(1)(b) GDPR — performance of a contract / electronic service provision,
  • Article 6(1)(f) GDPR — legitimate interest of the Controller (security and proper Application operation, and our own usage statistics, which can be switched off in the privacy settings),
  • Article 6(1)(c) GDPR — compliance with legal obligations.

5. Data sharing

The Controller does not sell users' personal data.

Data may be shared only with entities supporting the Application, such as:

  • Supabase (database, authentication and backend hosting),
  • Vercel (hosting of www.auracatch.com),
  • Resend (sending price alert emails),
  • Google (Gemini AI API — product recognition from photos and voice),
  • Google Ireland Limited (Google AdSense — ads in the web version, only with consent; privacy policy: https://policies.google.com/privacy),
  • technical, infrastructure and IT security service providers.

Data may be transferred outside the EEA only under mechanisms compliant with GDPR (in particular standard contractual clauses).

6. Affiliate links and partner programs

Aura Catch uses affiliate links and partner programs:

  • CJ Affiliate (Commission Junction) — partner offers and promotions shown in the Application,
  • Skimlinks — a script in the web version that turns regular store links into partner links; loaded only after consent has been given in the cookie settings,
  • Amazon Associates — partner links to Amazon offers.

The Controller may receive a commission from qualifying purchases made through affiliate links available in the Application. Partner offers are labelled.

Clicking affiliate links may redirect users to external websites that have their own privacy policies and data processing rules. Affiliate partners may set their own cookies to attribute commissions.

The Controller is not responsible for privacy practices of third parties.

7. Cookies and data stored in the browser (web version)

The Aura Catch web version does not use its own cookies. It uses browser storage (localStorage) and — with consent — the affiliate partner script and Google AdSense scripts, which may set cookies. On the first visit a banner offers three choices: "Accept all", "Essential only" and "Settings".

Categories:

a) Essential (always active, basis: Article 6(1)(b) and (f) GDPR):

  • the Supabase session (an anonymous guest account holding your product list) — kept until you clear site data; the guest account is deleted after 30 days of inactivity,
  • Application settings (theme, country, language, the "welcome shown" flag) — until you clear site data,
  • your cookie decision together with the consent version number — until you clear site data or the consent version changes.

b) Affiliate partners (Skimlinks) — only with consent (Article 6(1)(a) GDPR):

  • the s.skimresources.com script is added to the page only after consent; without consent it is not loaded on the first visit nor after a page reload,
  • Skimlinks may set its own cookies to attribute commissions; their retention is defined by the Skimlinks privacy policy (https://skimlinks.com/privacy-policy).

c) Statistics — can be switched off at any time:

  • our own anonymous usage events stored in the Controller's database (see section 9); a random visit identifier exists only until the browser tab is closed,
  • no third-party analytics tools (no Google Analytics).

d) Ads (Google AdSense) — only with consent (Article 6(1)(a) GDPR):

  • the pagead2.googlesyndication.com script is added to the page only after consent; without consent ads are neither shown nor loaded,
  • Google may set advertising cookies and measure impressions; the rules and retention periods are described in Google's privacy policy (https://policies.google.com/technologies/ads); PRO plan users see no ads,
  • personalised ads (matched to interests from a Google profile) are shown only after consent to personalisation; without it Google shows non-personalised ads based on the page content and approximate location,
  • for users in the European Economic Area, the United Kingdom and Switzerland, consent for ads and related purposes is collected by Google's certified message compliant with the IAB TCF 2.2 standard (partner list and purposes inside the message); it replaces the Aura Catch banner and can be reopened from the Profile.

Changing your decision: Profile → "Privacy settings (cookies)". Withdrawing consent for affiliate partners or ads takes full effect after the page is reloaded. Clearing site data in the browser removes all the data above and shows the banner again.

8. Guest session in the web version

The web version works without creating an account: on the first visit an anonymous session (random identifier) is created and the list of tracked products is tied to it. The list is available only in that browser. A guest session with no activity for 30 days and no active products is deleted automatically together with its data.

9. Usage statistics of the web version

To assess whether the web version is used and whether users come back, the Controller records anonymous events in its own database: visit, search, product added, partner or store offer clicked, email alert requested and confirmed — together with a country code and the guest session identifier. We do not store IP addresses or the email addresses typed in. The legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR); events are deleted after 120 days. Statistics can be switched off in the privacy settings — then no events are sent.

10. Email alerts

In the web version the user may provide an email address to receive price-drop alerts. The address is stored after consent (checkbox) and confirmation via a link sent to that address. Every alert email contains an unsubscribe link; alerts can also be switched off in the Profile. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Price information and disclaimer

Aura Catch monitors product prices across multiple markets and online stores. Despite due diligence:

  • prices shown in the Application may be delayed,
  • prices may differ from current store prices,
  • product availability may change,
  • information may contain technical or synchronization errors.

The Controller does not guarantee completeness, correctness, or timeliness of presented prices and is not liable for purchasing decisions made based on data shown in the Application.

The binding product price is always the one displayed directly by the seller at the time of purchase.

12. Data retention

12.1. For FREE plan users: tracked product data is removed from the database 30 days after the tracking period ends.

12.2. Account data is stored until the user uses the "Delete account and data" feature.

12.3. An anonymous product price history (not linked to any user) is kept for up to 180 days in order to show the lowest price of the last 180 days.

12.4. Anonymous guest sessions (web version) with no activity for 30 days and no active products are deleted automatically.

12.5. Web usage statistics events are deleted after 120 days.

12.6. The cookie decision is kept in the browser until site data is cleared or the consent version changes.

13. User rights

The user has the right to:

  • access their data,
  • rectify data,
  • erase data,
  • restrict processing,
  • data portability,
  • object to processing,
  • withdraw consent at any time (privacy settings, the link in an email, the Profile),
  • lodge a complaint with a competent supervisory authority.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (PUODO).

14. Data security

The Controller applies appropriate technical and organizational measures to protect personal data against loss, unauthorized access, or disclosure.

Super admin, administrator, or any helper of the website administrator does not and will never have access to users' private financial data.

15. Privacy Policy updates

The Controller reserves the right to update this Privacy Policy. The current version will be published in the Application and on the website.

Last updated: October 18, 2026 (added sections on cookies and browser data, Google AdSense ads, the guest session, usage statistics and email alerts; updated the list of affiliate partners).