Privacy & Data Policy

Welcome to Aura AI Studio. We prioritize user privacy, local data isolation, and cryptographic security. This Privacy & Data Policy details how your information, input prompts, assets, and authentication credentials are handled within our application.

1. Data Ownership & Storage

• User Ownership: You retain 100% ownership of all prompts, generated images, synthesized audio, code snippets, and exported documents (Word, Excel, Markdown) produced within Aura AI Studio.
• Storage Isolation: Registered user data is organized into isolated local directories (e.g., /dataai/users/<username>/) segmented into subfolders for chats, images, audio, documents, and code.
• Guest Mode: If using the application in Guest Mode, session data remains temporary and is stored strictly in local session memory rather than tied to a persistent account.
• Full Data Deletion: You can permanently delete individual chats, images, audio files, or your entire storage history at any time through the built-in Storage & History panel.

2. Password & Account Security

• Cryptographic Hashing: User passwords are never stored in plaintext. Passwords are salted with unique random bytes and hashed using SHA-256 before being written to the database.
• Session Tokens: Authentication sessions utilize securely generated bearer tokens with expiry checks to safeguard against unauthorized access.

3. API Keys & External Communication

• External AI Providers: When submitting generation requests:
  • Text & Reasoning Prompts: Routed to Google Gemini or OpenAI inference endpoints to construct responses.
  • Image & Music Generation: Routed directly to Hugging Face Inference models (including FLUX.1-schnell, Stable Diffusion XL, and MusicGen).
  • Only necessary input text and generation parameters are transmitted to the respective model API.
• Custom API Keys: If you provide a personal API key in Settings, it is used exclusively to authorize your requests and unlock higher rate limits. Custom keys are never logged, stored externally, or shared.
• System Keys: Internal tokens are strictly maintained in local .env configurations and are never exposed in client application bundles or public repositories.

4. Client-Side Processing & Offline Fallback

• Local In-Browser Operations: Image editing, blurring, brightness/contrast adjustments, face swapping compositing, cropping, and mask drawing run directly on your device using HTML5 Canvas APIs.
• Procedural Neural Fallback: If external APIs encounter network failures or rate limits, the application can synthesize artwork procedurally on your machine without outbound data transfer.
• Zero Telemetry / Trackers: Aura AI Studio contains no third-party tracking beacons, commercial ad pixels, or behavioral analytics cookies.

5. Desktop & Microsoft Store Packaging Standards

• Local Sandboxing: When running as a packaged desktop application (MSIX / Windows):
  • The application only reads and writes to its designated app data directory and files you explicitly open or save.
  • System modifications (such as executing terminal commands, file deletions, or package installations) require explicit user authorization.
• No Covert Background Tasks: Aura AI Studio does not run hidden background daemons, background network monitors, or secondary processes when closed.

6. Terms of Use Summary

• Aura AI Studio is provided for personal, creative, and professional productivity.
• Users agree not to utilize the AI engines to generate illegal, harmful, or copyright-infringing content in accordance with the Acceptable Use Policies of Google AI and Hugging Face.