AuraSound privacy policy

This page describes AuraSound, formerly AuraDSP, and Android test version 5.3.5, build 140: the file studio, account, manual backup, Google Play subscription verification and support pages. It describes purchase data processed when those features are used; it does not mean purchase testing or production approval is complete. These website pages are available in Arabic and English.

Data on your phone

Audio settings, presets, appearance, language, page arrangement, control shortcuts and listening preferences are stored locally. Access to app tools in the commercial release requires Google sign-in and a verified subscription or trial entitlement. Language, help, privacy and account management remain available outside app tools. Built-in audio samples and tone tools run locally on your phone; cloud backup does not upload their audio. Backup does not upload recordings, media files, contacts or medical diagnostic data. Listening preferences are choices about sound, not a medical test result.

Local file studio

The studio reads only the audio file you choose with Android's file picker. It copies the audio needed for work into the app's private temporary storage for trimming, level and fade adjustments, preview, and estimated vocal and music separation with a model running on the phone. This path does not use the microphone, upload the file or separated audio to a server, or include them in preferences backup. Separation is imperfect and varies by recording; the studio does not determine rights to use the file.

Working audio and unexported results are kept in the app's private cache. Clearing the project requests cancellation and deletion of working files. The studio cleans up working files when it closes and removes abandoned temporary directories when it next starts. If Android terminates the process abruptly, temporary files can remain until later cleanup. This storage is not a permanent project library; export any result you want to keep before clearing or closing the project.

When you choose Export, you select the name and destination in Android's document picker. The destination can be on your phone or with a cloud storage provider you choose; that provider's service and your settings govern any transfer and storage there. The studio does not change the imported original. Clearing a project or deleting an account does not delete files already exported; remove those at their destination.

Track information and player controls

Connecting your music player is optional. Choosing to connect opens Android settings for notification access. This is a broad permission described by the system; AuraSound uses it to find media playback sessions and read the title, artist, album, artwork supplied by the player, playback state, progress and supported commands. The component does not inspect or store message notification content. Track information and artwork remain temporarily in memory for display only; they are not sent to Firebase or another server or included in backups. The app does not fetch cover artwork from external websites.

Play, pause, previous and next request the action from the current player only. Players may omit information or commands. You can revoke notification access in Android settings. Stopping monitoring or leaving the app clears the displayed track data and detaches the observer; this does not stop music playing in the other app.

Optional response to audio output

The optional audio display analyzes limited-resolution waveform and frequency data from the current audio output using Android's visualization facility. Android requires RECORD_AUDIO, shown to users as the Microphone permission. This component uses audio output only; it does not open the microphone or record an audio file. Data is reduced to temporary display values; samples are not saved or uploaded.

Analysis starts only when you choose it and stops when you stop it, leave the app or revoke permission. A device or audio source may not provide usable data; missing data is shown as unavailable. Near-zero values describe only the available samples, not silence in the room or hearing protection. You can decline permission and use the other app tools. Reading track information alone does not require this permission.

Account and credentials

An account is required for access to app tools, cloud backup and paid-access verification. The app uses Google sign-in through Google Firebase Authentication. The service verifies your Google identity and provides your account identifier, email address, display name, session information, sign-in provider and email verification status. Google handles sign-in and account selection; the app does not ask for your Google password or read your inbox. The support website retains email and password authentication and password reset only to let legacy account holders recover access for account deletion.

The app interface and account deletion page do not store your password or session tokens in localStorage. The Android app retains a session refresh token and the account information needed to sign in, using encrypted local session storage protected by Android Keystore when available. If secure storage is unavailable, you may need to sign in again.

Optional cloud backup

When you choose to save a backup, audio settings, presets and names you entered, appearance, page arrangement, shortcuts and listening preferences are sent to our backend on Google Cloud Functions, which stores them in Cloud Firestore under your account identifier, with a schema version and save time. There is one current backup, replaced when you save again. Saving, restoring and deleting it pass through account and app verification and server usage limits. There is no automatic background synchronization. Your password and audio files are not part of the backup.

App and device integrity checks

When you request an account, authentication, account-recovery or cloud-backup operation in the app, AuraSound may request a Firebase App Check token using Google Play Integrity. Google processes technical information about the app, device, operating environment and app licensing to produce a verification result that helps prevent service abuse. The app receives a verification token and attaches it to trusted Firebase requests when available; it does not send this token to the JavaScript interface or other apps. Local sound tuning alone does not start this check.

Saving, restoring or deleting a cloud backup, subscription verification, checkout and purchase restoration require a valid attestation token. If verification is unavailable, the operation stops with user guidance; this build has no direct database fallback. Attaching a token to authentication and account-recovery requests remains optional with a limited wait, and it is not a condition of account deletion. Automatic background token refresh is disabled. See Firebase's data disclosure and Play Integrity data information.

Purposes and service providers

Account information is used for authentication, account management and secure access. The backup lets you restore preferences across your devices. We use Google Firebase Authentication and Cloud Firestore for accounts and data, Google Play Billing for the official subscription interface, Cloud Functions for verification, access management and deletion, Pub/Sub and Cloud Scheduler for subscription and refund updates, and Firebase Hosting for these support pages.

Firebase also processes IP addresses and technical request and client information to operate and protect its services, including preventing abuse during registration and authentication. Visits to these support pages may be logged by Firebase Hosting. AuraSound does not use these addresses to infer your location or target advertising. The app does not access advertising identifiers or contacts for its account and backup features.

This build has no advertising, usage analytics or crash reporting tools added by AuraSound. We do not sell account or backup data or use it to create advertising profiles. Google processes data to provide these services and handles its service data under its terms. See Firebase privacy and security information.

Encryption and processing locations

Account, backup and support-page connections use HTTPS to encrypt data in transit. Encryption of the session on your phone is separate from cloud backup: the backup is stored in Firestore and is not end-to-end encrypted with a key held only by you. This policy does not describe the service as anonymous.

Google and its providers may process service data outside your country or database region. Choosing a Firestore region does not mean all authentication, integrity and support processing occurs in that same region. See Firebase processing-location information at the link above.

Subscriptions and link sharing

Subscriptions use Google Play, with weekly and monthly plans. Google's purchase window shows the price, currency, renewal period and offer available to your account before confirmation. Eligible users may see a seven-day free offer; creating an AuraSound account or sharing a link does not grant a local trial, start a charge or begin automatic renewal. AuraSound does not receive your card number or bank-account details from Google Play.

When you request paid access, buy a subscription or restore it, the app sends your Firebase account identifier, authentication and attestation information, Google Play purchase token (purchaseToken) and product identifier to our backend hosted by Google. A pseudonymous hash derived from your account identifier is passed to Google Play to bind the purchase to your account; your AuraSound account password is not passed into the purchase flow. Firestore retains the purchase token needed for re-verification and its account binding. Payment-card details are not sent to the AuraSound backend.

The backend checks Google Play directly and records the subscription state, plan, offer, test-purchase or free-trial status, acknowledgement and renewal state, and available start, expiry, verification, cancellation and resumption times. It retains one-way hashes of order identifiers and linked tokens. Change notifications arrive through Google Pub/Sub, and scheduled jobs review status and voided or refunded purchases. We use Google's results to update access and prevent receipts from being bound to multiple accounts or reused after revocation; we do not read your full Google account purchase history or audio files for these purposes.

Temporary records prevent duplicate requests and conflicting operations, with request times and notification-completion states. Subscription data and purchase tokens are not included in preferences backup or exported audio. Link sharing opens a chooser where you select an app and recipient; AuraSound does not automatically send messages or upload contacts. Referral rewards are not enabled in this release.

Retention and deletion

Account data and cloud backup remain until you request deletion; saving a new backup replaces the current one. You can delete only the backup in the app, or delete the account and backup in the app or on the account deletion page. Google sign-in verifies current accounts; the website also supports password verification for legacy accounts. The backend requires a recent sign-in for deletion. Website deletion does not require the app or a Play Integrity token. If the sign-in account is deleted while server cleanup is still finishing, the page reports that pending state rather than confirming complete backup deletion.

Purchase tokens and verification records support subscription updates, restoration and fraud prevention. The current system has no single automatic deletion period for all purchase records. Account deletion removes the Firebase identity, preferences backup and linked UID records, and replaces purchase records tracked for that account with pseudonymous deletion markers that remove the UID, plain purchase token and subscription-detail history. One-way ownership, account, token and order hashes, refund proofs and observation or deletion times remain to prevent reuse; these markers contain neither the email nor the plain purchase token and are not described as anonymous. The current code does not set an automatic deletion date for these proofs.

Notification-deduplication records expire 30 days after processing. Rate-limit and request-lock records carry shorter expiry times according to the operation and are deleted through Firestore policies; actual deletion can follow the expiry time later. These records are separate from purchase-ownership proofs. Providers may retain operational logs or backups under their schedules; successful account deletion does not mean immediate erasure from every infrastructure system. See Firebase retention details.

Website account deletion leaves local settings, working audio and exported results unchanged. Clear the project or app data for local files, and delete exported results at their destination. Account deletion also does not cancel Google Play renewal; manage any existing subscription separately through Google.

To protect the database against deletion or corruption, we use Firestore point-in-time recovery with a window of up to seven days and a daily backup schedule with seven-day retention. Data deleted from the active database may remain in recovery history or an earlier backup until its retention period ends. These copies are not used for sign-in or marketing; access is administrative and limited to recovery. Before restored data is returned to service, deletion requests and current subscription states must be reviewed to avoid reactivating a deleted account or an old entitlement. This protection is separate from the manual preferences backup in the app.

Your choices

You can change language and read help and privacy information before subscribing. Account management, deletion and purchase restoration do not require an active subscription; app tools require Google sign-in and a verified entitlement in the commercial release. Your session and subscription status are restored automatically when available; restoring a preferences backup remains your choice. Deleting the app or an AuraSound account does not automatically cancel an existing Google Play subscription. Use Google Play subscription management if needed.