Privacy Policy

This policy explains, in plain language, what data AuraPoints.world handles. We collect the minimum needed to run the game and to stop one person voting ten thousand times from the same tab.

Data you give us

• Email: for logging in and resetting your password. Never shown publicly.
• Password: stored hashed with Argon2id. We can't read it or recover it.
• Username and display name: public by definition — they are your URL.
• Country (optional): used only for country leaderboards.
• Avatar (optional): re-encoded on upload, which strips all metadata including EXIF location.
• Bio (optional): public. Don't put contact details or private information in it.

Technical data

• Anonymous identity cookie: if you vote without an account we mint a random, opaque identifier in a first-party cookie. Its only job is to stop your vote being counted twice. It does not follow you to other sites and contains nothing about you.
• IP address: not stored in plaintext. We store a salted hash, used only for abuse limits. Rotating that salt severs the link to older records.
• Browser: a truncated hash of the user agent, for the same purpose.
• First-party analytics: we record on our own server which pages are viewed and which actions happen (votes, battles, times a link is shared). It tells us whether the game is working. It does not leave here.
• Google Analytics: we also use Google Analytics 4 to measure traffic. It is a Google service, which means Google receives data about your visit: pages viewed, approximate country, device type and browser. Google sets its own cookies to tell visits apart. We do not send it your email, your password or your IP address in the clear, and we run no advertising or remarketing.
• If you would rather not appear in Google Analytics, any ad blocker or Google's own opt-out extension will stop it. The site works exactly the same without it.

How long we keep it

IP and user-agent hashes are purged after 90 days. Aura events are kept while the profile exists, because they are the score. Delete your account and we remove your profile, email and avatar.

Who we share it with

Google Analytics is the only third party that receives anything, and only the browsing data described above. Beyond that we share nothing: we don't sell data, don't pass it to advertisers, and there is no other external integration. Outbound mail (password resets) is sent from our own server.

Children

This service is not directed at children under 13, and we don't ask for a date of birth because we don't want data we don't need. Tell us about an account belonging to a child and we will remove it.

Your rights

You can access, correct or delete your data by contacting us from the email associated with your account.

Last updated: 2026-08-25.