Privacy Policy

Aura - Gym · com.aurora.gym · Last updated: October 16, 2026

Deutsch · English · Español · Français · Italiano · Nederlands · Polski · Português (BR) · Türkçe · Русский · 日本語 · 한국어

1. The principle

Aura - Gym is a training log. Everything you enter — workouts, sets, plans, custom exercises, body weight, body measurements, progress photos and settings — stays on your device as long as you don’t create an account. There are no analytics tools and no crash reports sent to us.

The account is optional (section 6). Only when you sign in with Google does data go to our server: your profile, friends, shared plans, the leaderboard if you take part and — if you leave it on — cloud sync (section 7). Body weight and body measurements are only synced with your explicit consent. Progress photos never leave your device.

The app comes in two editions:

• Edition from Google Play: free with ads (Google AdMob, section 4) and an optional ad-free subscription (section 5).
• Directly installed edition: no ads and no subscription. It only uses the internet for the optional account.

2. Data on your device

Your entries are kept in the app’s protected storage. Other apps cannot read them. If you uninstall the app or clear its data in Android’s settings, they are gone from the device — a cloud copy (section 7) stays until you delete it or your account.

Android backup: If you have turned on Google backup on your device, Android includes the app’s data, encrypted, in the backup of your Google account so it comes back on a new device. Progress photos, the subscription status and the account sign-in are excluded — a new device signs in by itself. This backup is controlled by Android, not by Aura - Gym; you turn it off in the system settings under “Google → Backup”. A direct device-to-device transfer (cable or nearby) may include the photos.

Body weight and body measurements are health data. They only leave your device through the Android backup, a backup file you create yourself (section 3) or — only with your explicit consent — cloud sync (section 7).

3. Backup file and sharing

Backup file: Under “Settings → Data” you can create a backup as a file. It contains workouts, plans, body data and settings (no photos) and is not encrypted. You decide where it goes in Android’s file dialog — on the device or in a cloud folder of your choice. That location is governed by its provider’s terms.

Sharing your summary and Aura ID: After a workout you can share a picture of your summary, and in the friends list your Aura ID. Both go through Android’s share menu to the app you pick — only when you tap it.

4. Ads (Google Play edition only)

Where: One full-screen ad after you finish a workout (at most every 20 minutes) and, if you choose, a rewarded ad that gives you 24 hours of Premium. Never during a workout, no banners. With Premium active there are no ads.

Who: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google AdMob). When an ad loads, Google receives information such as your device’s advertising ID, your IP address, device type and system version, language setting, the app identifier, and whether and how an ad was viewed or tapped. Google also processes this data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. How Google handles this data: Google Privacy Policy and How Google uses information from sites or apps that use its services. Ads receive no data from your account, your profile or your workouts.

Your consent: In the European Economic Area, the United Kingdom and Switzerland, a consent dialog (Google User Messaging Platform, following the IAB TCF standard) asks you on first launch before any ad is loaded. Personalized ads are shown only with your consent; without it, Google shows non-personalized or limited ads. You can change your choice at any time under “Settings → Data → Privacy settings for ads”.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); where only non-personalized ads are served without consent, our legitimate interest in financing the free edition (Art. 6(1)(f) GDPR).

Advertising ID: You can reset or delete it in Android’s settings under “Privacy → Ads”.

5. Subscription and day pass (Google Play edition only)

Subscription: “Aura - Gym Premium” is a monthly subscription handled by Google Play Billing. Aura - Gym does not see any payment data — no card number, billing address or name. You give those to Google. The app only learns whether the subscription aura_gym_premium is active, together with the purchase token Google requires for confirmation. This status stays on the device and does not go to our server. On startup the app asks Google whether the subscription is still running — so Premium comes back by itself after a reinstall. You can cancel at any time in Google Play.

Day pass: If you watch a rewarded ad to the end, the app remembers on the device until when Premium applies. Nothing more.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

6. Account, profile, friends and plan gallery (optional)

Sign-in: You sign in with your Google account through Android’s account picker. Google gives the app a sign-in token; the app sends it once to our server, which verifies it with Google and keeps only the permanent identifier of your Google account — not your email address, not your Google name, not your Google profile picture. The server assigns you an Aura ID (format AURA-XXXX-XXXX). Every device you are signed in on gets a random device key; the server stores only a hash of it. The app shows your email address only on your device, so you can see which account is connected.

What the server stores: Aura ID, Google account identifier, when the account was created and last synced, your device keys (as hashes) and your profile: name, if you like a profile picture (scaled down to 192 × 192 pixels, without location or camera data), whether you are findable by name, and your visibility settings. Optional: year of birth, height and weight — only if you make them visible to “Friends” or “Everyone”; with “Only me” they stay on your device — as well as experience, training goal, current plan and gym.

Who sees what: Your name, profile picture, Aura ID and published plans are visible to any signed-in person who finds you — by your Aura ID or, only if you are findable, by your name. Body and training details are visible only to those you choose: nobody (“Only me”), confirmed friends (“Friends”) or all signed-in users (“Everyone”). If one of you has blocked the other, neither sees the other anymore.

Friends and following: The server stores friend requests, friendships, whom you follow and whom you have blocked. Suggestions only come from your circle of friends (friends of your friends who are findable themselves). There is no feed, no likes and no comments.

Plan gallery: If you publish a plan, every signed-in person sees it with your name: the plan’s name and description, goal, experience, days, exercises, sets, rep ranges, RPE, rest times and notes, plus the custom exercises it uses. Target weights are not shared. Ratings (1–5 stars) and adoptions are counted once per person; others only see the average and the count, not who rated.

Leaderboard (optional): If you take part, the app reports your number of workouts, your training volume and your streak for the current week. Only friends who take part themselves can see it. If you leave, your entry is deleted.

Reports: If you report a profile or a plan, the server stores the reason, your Aura ID and a snapshot of what was reported (name and text) for review; reports are deleted after 180 days. Abusive profiles or plans can be blocked.

Retention: until you delete your account. An account that no device has synced with for 400 days is deleted automatically by the server, with everything attached to it.

Deletion: In the app under “Profile → Account & sync → Delete account” — this immediately deletes your profile, picture, friendships, follows, published plans with their ratings, your ratings, leaderboard entry and cloud copy. Without the app: see Delete your account. Signing out only disconnects the device; the account remains.

Legal basis: Art. 6(1)(b) GDPR (you use the account features); for body details in your profile (health data) your explicit consent (Art. 9(2)(a) GDPR), which you give by choosing “Friends” or “Everyone” and withdraw at any time with “Only me”; for reports and blocking our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

7. Cloud sync (optional, with an account)

What: Finished workouts with their sets, plans, custom exercises, your settings on exercises (favorites, notes, rest times) and the app’s settings. Also the name of the device that uploaded last (e.g. “Pixel 9”), so that you can tell where a version comes from if two devices differ. A running workout is only uploaded once it is finished. Progress photos are never uploaded.

Body data only with consent: Body weight and body measurements are only synced if you explicitly consent under “Account & sync” (Art. 9(2)(a) GDPR). They are kept separately on the server; the time of your consent is stored as proof. You can withdraw it at any time — the server then deletes the cloud copy of your body data immediately; it stays on your devices.

How: The app uploads its state as a compressed document over an encrypted connection (TLS). The server keeps it in a database that runs and stores data exclusively in the European Union. The data is not end-to-end encrypted; we only look at it if you ask us to or the law requires it. If two devices have changed independently, the app asks which version should count instead of silently overwriting one.

Turning off and deleting: Under “Account & sync” you can turn sync off or delete the cloud copy; “Delete account” deletes it along with everything else.

Legal basis: Art. 6(1)(b) GDPR; for body data Art. 9(2)(a) GDPR.

8. Permissions and what they are for

For progress photos and the profile picture the app needs no photo or camera permission: it uses Android’s photo picker, which only hands over the pictures you select. The music control during a workout only sends “play/pause/next” to the music app that is currently playing — it does not read anything.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future — for ads under “Settings → Data → Privacy settings for ads”, for body data in sync and in your profile under “Profile → Account & sync” and “Edit profile”.

In practice: without an account your data exists only on your device and we have no copy. With an account you correct your profile in the app, delete the cloud copy or the whole account under “Account & sync”, and can get your data at any time as a backup file (section 3). For a copy of what we store, write to us with your Aura ID (section 12). Data that Google processes for ads, sign-in or the purchase is managed in your Google account.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

10. Recipients

Cloudflare — with an account only: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, runs the Aura - Gym server (Cloudflare Workers) and its database (Cloudflare D1, storage location European Union) for us as a processor. Requests from the app pass through Cloudflare’s global network. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework.

Google — Google Ireland Limited: signing in with Google (section 6); in the Google Play edition also delivery of the app, purchase handling via Google Play Billing (section 5) and ads via Google AdMob (section 4).

There are no other recipients. We do not sell any data.

11. Children

Aura - Gym is not directed at children under 16.

12. Controller and contact

Controller within the meaning of Art. 4(7) GDPR

Contact for access and erasure requests

The same details are in the legal notice.

13. Changes

If a feature is added that handles data differently, it will be described here before it appears in the app. The current version carries the date at the top.