Aura Privacy Policy

Edition of 9 October 2026. The list of stored data was checked against the server schema on 3 October 2026 and extended with what appeared in the app later.

What the app is

Aura is an app for yoga and massage: a specialist (called a teacher in the Telegram mini app) keeps their profile and schedule of practices; a student finds practices and books a seat. Aura comes in two forms — the app for Android and iOS and the mini app inside Telegram; it is one product with one account, and this policy covers both. Where the form matters, it is said so.

Which data about you is kept

When you register with an email address, Aura stores on its server:

• an internal user identifier, created by Aura itself so that all your actions belong to one account;
• your email address and a mark that it has been confirmed;
• your password — not the password itself but an irreversible hash of it; we cannot see your password;
• email confirmation codes — the code, the number of attempts and the time; a code lives ten minutes.

If the account was created in or linked to Telegram, Aura also stores your Telegram account identifier, your name and the address of your photo from Telegram; the name and photo are refreshed on every sign-in through Telegram, unless you set your own name or uploaded your own photo. The Telegram mini app has no separate registration: the account is created on first launch, and on every launch Telegram passes a signed set of data about you — only what is listed here is stored from it.

What appears inside the app itself:

• the chosen role — student or specialist;
• the profile for that role. A student's profile holds nothing but its link to the account and the dates it was created and changed. A specialist's profile holds what they fill in: a working name, a description, a city, years of experience, disciplines and styles of practice, and an intro video if they uploaded one;
• the name and photo you set yourself — if you entered your own name or uploaded your own photo instead of the ones taken from Telegram: the name itself and the photo file in storage;
• the practices a specialist publishes — title, description, discipline, style, start date and time, time zone, duration, number of seats, format, the address and coordinates of the venue or the link to the online meeting, price and status;
• bookings — who is booked for which practice, the booking status, and the time and author of a cancellation;
• requests for an individual session — who asks whom, of which kind, the message you attached, and the status of the request before and after the specialist's answer;
• attendance marks — whether a booked person attended, according to the specialist;
• reviews — rating, text, whom it is about and who left it;
• notification preferences — which messages the Aura bot sends you;
• uploaded files — the file itself in storage, and beside it its type, size, duration and verification status;
• account service records — its status, creation and change dates, and the sessions that keep you signed in between launches; a session is stored as an irreversible hash together with the device platform and its expiry;
• a record of consent — which editions of the terms and the policy you accepted, when and in which form of the app, and that you confirmed your age;
• feedback messages — the text you wrote in the Feedback section (“Write to the team” in the mini app), its category, the app and system versions and the language. If you switched on “You may contact me”, your name, email address and Telegram identifier at the time of sending are stored with the message, so that you can be answered;
• an action log — who did what to what, and when; it exists to settle a disputed case.

This is the whole list.

What Aura does not keep

• Your device location. To show practices nearby, the app sends your coordinates to the server as parameters of one request; the server uses them to search and does not store them — there is no field for them. The coordinates in the list above are those of a venue, set by the specialist.
• Interface language and theme — they are stored only on your device.
• Date of birth and documents — we do not ask for them.

What participants see about each other

The specialist whose practice you booked sees your name, your photo and, if the account is linked to Telegram, your Telegram account identifier, so that they can write to you about the session; the mini app does not show the identifier and builds no link from it to a profile or a chat (a product decision, not a technical impossibility), and the Telegram username takes no part in the data exchange at all. Students see what a specialist published in their profile, their average rating and the number of reviews; the app does not show the texts or authors of other people's reviews. Your email address is visible to nobody but you.

Why this data is needed

The email address, the password hash and the code let sign-in recognise you and nobody else. The internal identifier and the Telegram identifier prevent a second account being created for you. The name and photo show you under the same name as in Telegram, or under the ones you set yourself. The record of consent shows on what terms the account was created. Everything else is what the app exists for: showing practices and keeping your bookings and schedule.

Who processes the data

The data controller is sole proprietor Maksim Vladimirovich Kuleshov (ИП Кулешов Максим Владимирович, Russian Federation). For questions about your data, its correction and deletion write to info@aura-aum.ru.

Where the data is stored and who receives it

The Aura server is hosted by the hosting provider Beget in Kazakhstan. This means the data listed above is stored outside Russia and outside India. If you use the app in India, you agree that your data is processed outside India.

Besides the Aura server, data reaches:

• the mail server of the hosting provider Beget — confirmation codes are emailed through it;
• Telegram — if the account was created in or linked to Telegram, Telegram passes Aura the information about you described above, and the Aura bot sends you notifications. The Aura team also receives a notice of new feedback through Telegram: the beginning of the message text, without the author's name;
• Google — in the mini app the map and the lookup of an address by a point run on Google services. When you look at the map or place a point on it, your browser contacts Google servers directly, and Google receives your IP address and the coordinates of the place shown or the point placed. Google's privacy policy applies to these requests;
• Aura's error reporting server (grafana.aura-aum.ru) — if the app crashes, it sends a technical description of the error; sign-in data, email addresses and field contents are scrubbed from it before sending;
• the app stores Google Play and the App Store — they handle installation and updates under their own rules; Aura receives no information about you from them;
• the analytics service Firebase Analytics from Google — only if you allowed it yourself: the app asks on a separate screen, and collection stays off without your permission. If you allow it, the app sends anonymous events: sign-in, screens you open and actions such as booking a practice or publishing a class, plus an approximate location worked out from your IP address. Your name, email, message texts and account content are not sent. The data is not used for advertising. You can change your answer at any time in Settings of your profile; without analytics the app works just the same.

Crash reports. If the app closes with an error, it sends a technical report to Firebase Crashlytics (Google): the device model and system version, the app version, where in the code the error happened and a random installation identifier. Your name, email and account content are not sent. You can turn this off in the app settings.

Data goes nowhere else. There are no advertising services in the app.

Cookies and storage

The app does not use cookies, and the mini app uses no analytics services either. Sign-in data is kept in your device's protected storage (Android Keystore, iOS Keychain) and is removed when you sign out (this is how the app for Android and iOS works). In the mini app sign-in data is kept only in the app's memory and disappears when you close it; the launch parameters from Telegram lie in the browser session storage (sessionStorage) while it runs and are cleared with it. The mini app remembers your consent in Telegram's cloud storage (CloudStorage): a note of which editions of the terms and the policy you accepted, without a name or other personal data. It is kept by Telegram, tied to your Telegram account, and exists so that consent is not asked at every launch; a new edition of the documents cancels it, and consent is asked again. You can erase the note with Telegram's own tools. Language, theme and the fact that you accepted these documents are stored on the device and contain no personal data.

How long data is kept and how to delete it

Data is kept for as long as your account exists.

• You can delete your account in the app for Android and iOS, in the Profile section (the mini app has no such action yet: write to info@aura-aum.ru, and the account and the data tied to it will be deleted within 30 days). Deletion is immediate: sign-in closes, your practices are cancelled, your profile and name stop being shown. Records that other participants need — for example your booking in a specialist's list — remain without your name and photo. The email address, the password hash and the Telegram identifier are erased 30 days after deletion; the account cannot be restored before then.
• Feedback messages stay with the team after the account is deleted, no longer linked to it. If you allowed contact, the name and contact details saved when you sent the message stay with it. You can ask for such a message to be deleted at info@aura-aum.ru. The record of consent also stays and holds nothing but the account identifier.
• An unconfirmed account registered with an email address, in which nothing has been done, may be deleted seven days after it was created.
• At info@aura-aum.ru you can ask which data about you is stored, ask to correct it, or ask to delete it if you cannot sign in to the app. We answer within 30 days.

Changes to this policy

A new edition is published at this same address with a new date. We announce material changes in the app and through the Aura bot in Telegram. By continuing to use the app after publication you accept the new edition.

Terms of Use