AuroWomen — Privacy Policy

1. Our Commitments

AuroWomen collects only the personal data needed to provide, secure and support its features.

We do not sell personal data. We do not share health, cycle, safety, location or finance information for advertising or profiling. AuroWomen contains no advertising and does not collect advertising identifiers.

2. Information We Collect

Account and profile information: Name, email address, language, timezone, notification preferences, consent records and profile setup state.

Wellbeing and cycle information: Mood, energy, pain, symptoms, notes, check-in history, period dates, cycle length and derived cycle-phase context.

Planner information: Events, reminder times, completion status, rescheduling and accepted suggestions.

Safety information: Trusted-contact names, phone numbers, relationships, primary-contact status, automated SMS consent status, consent timestamp and consent-disclosure version; SOS history; location coordinates and address context captured when a safety feature requests them; delivery attempts and acknowledgements; and encrypted emergency audio evidence recorded only after separate confirmation.

Community information: Posts, comments, submitted reports and users you block or mute.

Finance information: Savings goals, transactions, amounts and notes you enter.

Technical and operational information: Authentication metadata, app environment, feature event names, limited event properties, errors, stack traces, fatal-error status, security logs and rate-limit records. Analytics filters remove fields labelled as names, notes, addresses, emails, phone numbers, coordinates, tokens or keys before upload.

3. Information We Deliberately Do Not Collect

We do not continuously track your location. Location is requested in the foreground only when you use a safety feature that needs it.

We do not access your device contacts. Trusted contacts consist only of information you enter.

We do not collect payment-card or bank-login details. Finance features do not connect to banks, cards or payment systems.

4. How Information Is Used

We use information to operate account access, synchronization, export, deletion, reminders, safety features, community functions and support.

We use it to personalize check-ins, cycle summaries, planning suggestions, safety preparation and finance progress.

We use limited operational information for reliability, debugging, fraud prevention, abuse prevention, moderation, rate limiting, security and legal compliance.

5. Preview Mode and Signed-In Accounts

When you are not signed in, preview information is stored locally on your device. SWEAF® cannot see, synchronize or recover that information.

When you sign in, supported information is stored using Supabase infrastructure with account-based access controls and Row Level Security.

6. Service Providers and Disclosures

Supabase provides authentication, database, private storage, realtime connections and server-side functions.

Twilio may receive a trusted contact’s destination phone number and the minimum SOS message content necessary for delivery when automated SMS is configured, the contact has recorded consent and you trigger an alert. Twilio acts as a messaging service provider. SMS delivery is not guaranteed.

OpenAI processes optional AI insight requests only after separate consent. Minimized wellbeing signals are used without direct identifiers. Raw notes, trusted-contact names, phone numbers, email addresses and exact locations are not included.

Apple and Google process app-store and platform information under their own policies.

Trusted contacts may receive SOS information and available location context when you trigger an alert.

We may disclose information where required by applicable law.

7. Mobile Information and SMS Consent

Automated safety-alert SMS consent is optional and is not required to use AuroWomen or to retain a trusted contact for manual calling or messaging.

We do not sell, rent or use trusted-contact phone numbers or messaging consent for advertising, marketing, lead generation or promotional purposes.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Twilio processes mobile numbers and message content solely as a service provider for requested message delivery.

8. Security

Production traffic uses TLS. AuroWomen’s Supabase API and realtime connections on Android and iOS use certificate pinning and fail closed when the expected certificate identity cannot be verified.

Emergency audio is encrypted on the device using AES-256-GCM before upload. The plaintext recording is removed after the encryption attempt, and the encryption key is stored in secure device storage.

No system can guarantee absolute security.

9. Retention

Account information is retained while the account is active and as reasonably required to operate the service, protect users, resolve disputes or comply with law.

Raw analytics events normally use a 90-day retention period. Non-fatal error reports normally use 180 days and fatal error reports 365 days. Aggregated operational metrics without user identifiers may be retained longer.

When account deletion completes, the authentication identity, supported database records, trusted-contact and SMS-consent records, uploaded encrypted evidence objects, local account records and local evidence-encryption key are removed.

Limited de-identified operational records, abuse-prevention records, legal holds and provider-managed backups may remain until their applicable retention periods expire.

10. Your Rights

Depending on your location, you may have rights to access, correct, export or delete personal information, withdraw consent, restrict or object to processing and complain to a competent authority.

You can export supported data, delete your account and withdraw AI consent from the Profile section.

For another privacy request, contact developer@sweaf.biz. SWEAF® aims to respond within 30 calendar days after receiving sufficient information to verify and process the request.

11. Children

AuroWomen is intended for adults aged 18 or older and is not directed to children.

12. International Processing

Service providers may process information outside your country. Where required, applicable provider safeguards and legal transfer mechanisms are used.

13. Policy Changes

This policy may be updated when AuroWomen’s features, providers or legal obligations change. Material changes will be communicated through the app or by email before taking effect where required.

14. Contact

Data Controller: SWEAF®

Privacy and grievance contact: developer@sweaf.biz