Privacy policy

Aura Fight for iPhone and Android, and the website aurafight.app. Last updated: 25 October 2026.

In short. You start playing without giving us anything but your birth year: the app creates a random identifier on your device and that gives you a guest account. If you don't want to lose your fighter, you can save it with your email. Your fighter (its name, its look, its aura and its duels) is public: anyone with its link sees it, and so do the players who come across it in the game. We never store your IP address as it is. The only ads are the ones you choose to watch for a reward, from Google AdMob, personalised only if you agree. Error reports go to Sentry without anything that identifies you. We don't sell your data.

Who is responsible

Aura Fight is made by Javier Rubio Roca, an individual developer in Spain, who is the controller of the personal data described here. Write to support@aurafight.app about anything to do with your data. The developer answers that mailbox, and hello@aurafight.app (general contact) and social@aurafight.app (our social network accounts), from Costia HQ, his own back office, the only place that mail is kept; replies go out from the address you wrote to, and those conversations are kept for 730 days.

Your account

Guest. The first time you open Aura Fight, the app creates a random identifier on your device and keeps it there (in the phone's secure storage; on the web, in the browser's local storage). With it, it gives you a guest account without asking you for anything. Our server never stores that identifier as it is: only an irreversible fingerprint of it (a SHA-256 hash).

Your birth year. When you create your fighter we ask what year you were born, without day or month. If that year means you may be under 13, nothing is created or stored. Otherwise we keep only the year with your account, to know which ads we may request for you (see "Rewarded ads"), and it is deleted with it.

Saving your fighter with your email. If you do, we send you a 6-digit code and a sign-in link; they are valid for 15 minutes and once, and we only keep irreversible fingerprints of them. Your email address stays linked to your account so you can get it back on another device. We also keep each email sign-in attempt (the address and when it was asked for), to limit how many emails are sent and prevent abuse. Each attempt, with its code and link, is deleted 24 hours after it expires.

Apple and Google. You can also save your fighter and sign in with Apple or with Google. We never see a password: Apple or Google confirm who you are and only tell us your email address (Apple lets you hide it) and the identifier they use for you in Aura Fight.

Your session. To keep you signed in we issue our own session token, of which we only keep an irreversible fingerprint. It expires after 180 days and logging out deletes it; an expired session is deleted 30 days later.

Your fighter, and what is public

Your account holds your fighter: the name you give it, its look, its stats, level, experience, aura and rank, its attacks, items and pets, the cosmetics it owns and wears, its duels (each one is a seed and a snapshot of both fighters, including the cosmetics they wore at the time), its attempts against the daily boss, its season aura and its crowns, its achievements and the title it wears, and its destiny (the «1 of 2» card pairs it was offered at each level, which it took and how many times it repeated it).

This is public. Aura Fight is a game for showing off, so your fighter can be seen: anyone with its link (aurafight.app/f/…) sees its name, look, level, aura, rank, wins and losses, season aura and crowns, how many fighters it has brought to its crew ("peña"), its founder number, its last duel (with the opponent's name and look), the title it wears under its name, its achievements and its destiny tree; the title also appears in the image shown when the link is shared. Other players see it as a rival, in their duels and in the season ranking, and every duel (aurafight.app/d/…, with its own image when shared) and every boss attempt can be viewed through its link. Don't use your real name or personal details as your fighter's name. When you create your fighter we check its name against a list of insults and hate terms, and if it matches we ask you for another one; nothing else is stored for it. If a fighter's name is offensive, we may change it or suspend its account.

The crew. If you create your fighter from someone else's link, it is recorded as their pupil, and they see how many pupils they have.

Your diary. When another player challenges your fighter, that duel appears in your diary with a joke line about how it went, the opponent's name, look and title, and whether you can take the revenge. Only you see your diary; we keep how far you have read it.

Reporting and blocking. You can report another fighter (for an offensive name, for cheating or for something else, with an optional comment). We keep who reported it (your account's identifier), which fighter, the reason, your comment and the name the fighter had at that moment, so that the developer reviews it and can change the name or suspend the account. We never tell the reported fighter who reported it. An open report is kept until it is reviewed, and a reviewed one is deleted 180 days later. If you delete your account, your reports stay without your identifier and without your comment; if the reported fighter's account is deleted, its reports are deleted. You can also block another fighter: we keep who blocked whom and when, so that you don't meet as rivals, it cannot challenge you and its duels against you leave your diary. Nobody is told about a block, and it is kept until you unblock it or either account is deleted.

Against cheating, without storing your IP

To limit how many accounts are created from one device or one network, and to spot people bringing themselves into their own crew, we keep with your account the fingerprint of your device identifier and, for each day, a fingerprint of your IP address computed with a secret salt that changes every day. Your IP address is never stored as it is, and one day's fingerprint cannot be linked to another day's. When someone opens a fighter's link, we count the visit the same way: with a daily fingerprint of the IP and the browser, never the IP itself. Device and network fingerprints, and the records of visits to links, are deleted after 90 days. To stop abuse, the server also counts requests per IP in memory, without writing them down.

Where it is stored

Your account lives on Aura Fight's own server, api.aurafight.app, which the developer runs himself in the European Union, in Spain. Cloudflare sits in front of it and of the website, delivering and protecting the traffic. While Spanish internet providers block Cloudflare's addresses during LaLiga football matches, the app on your phone (not the website) reaches the server and the fighters' artwork through a mirror at Gcore (G-Core Labs S.A., Luxembourg), a network provider that passes each request on to Cloudflare: the encrypted connection ends at Gcore, so the request crosses its servers in transit, and Gcore processes the same technical data (IP address, time, address requested) and keeps none of the content. Everything travels encrypted. Database backups are stored encrypted in Cloudflare R2, under EU jurisdiction, for 30 days: whatever is deleted also disappears from them within 30 days at most. Our server writes technical logs (what was requested, when and with what result, without your IP address), which are kept for 14 days in Loki, on the developer's own cluster in the European Union.

The emails we send you

Apart from replying when you write to us, we only write to send you the sign-in code and link when you ask for them, in Spanish or English. No newsletters, no advertising. They come from no-reply@aurafight.app and are sent through Resend (Plus Five Five, Inc., United States), which works for us and keeps its own sending logs for a limited time.

Rewarded ads

On phones, Aura Fight only shows an ad when you tap a button offering you a reward (an extra duel or +100 aura) and choose to watch it. There are no banners, no ads that appear by themselves and no ads when the app opens. The website has no ads.

Google AdMob. To show and measure the ad, limit how often you see it and prevent fraud, Google's software collects the device's advertising identifier (on iPhone only if you allow tracking), your IP address (from which an approximate location is inferred), device and app information, and how you interact with the ad. So that the reward is yours, the app gives Google a one-time code and your Aura Fight account's random identifier, and Google sends them back to us, signed, once you finish watching: that way our server, not the app, grants the reward. We keep which reward it was, when, and from which ad unit. Google never receives your email or your fighter's name.

You choose. Before the first ad, and never when the app opens, we ask for your consent with Google's message in the European Economic Area, the United Kingdom and Switzerland; in US states with privacy laws you can opt out. On iPhone, after an explanation from Google, the app asks whether it may track you (App Tracking Transparency); if you say no, the advertising identifier is not used and nothing else changes. You can change your choice at any time in the app, under your account → "Ad privacy". Ads are requested for a teen audience at most.

If you are under your country's age of digital consent (GDPR article 8; 14 in Spain), going by your birth year and your device's region, we only request non-personalised ads and tag them for users under that age: you are not asked for consent or about tracking, and nothing that relies on your consent is done.

Google also uses this data as an independent controller for its own purposes: see how Google uses information from sites or apps that use its services and Google's privacy policy.

Purchases

Nothing can be bought today. When the shop opens, cosmetics (they only change how your fighter looks, never its strength) will be bought in the App Store or Google Play, which take payment under their own terms; we never see your payment details. RevenueCat, Inc., which works for us, receives the store's receipt and your Aura Fight account's random identifier, so the cosmetic reaches your account and you can restore it on another device; it tells us about every purchase, renewal or refund, and we keep that notice (product, price, date and that identifier). See RevenueCat's privacy policy.

Notifications

After your first duel, the app asks whether you want to hear when someone challenges you; only if you say yes does it ask for the system's permission. If you give it, we keep with your account the notification token your device gives us (from Expo), the platform and the language.

What we notify you of. Only things in your diary: that someone stole your aura, that someone challenged you and you won, and that your revenge has only a few hours left. At most 3 a day, and never during your quiet hours (22:00 to 9:00 unless you change them; a notification due then waits until they end or is dropped). We keep which notification we sent you, for which duel and when, for 30 days, so as not to repeat it and to respect the limit.

How they are sent. We send them through Expo's push service (650 Industries, Inc., United States), which receives your token, the notification's title and text (the opponent fighter's name and our joke line) and the duel's id, and hands it to Apple or Google to reach your phone. We keep Expo's delivery ticket for at most 24 hours, to learn whether a token stopped working; if Expo tells us it no longer works, we delete it.

How to turn them off. In the app, your account → "Avisos", you can switch off each kind of notification and the quiet hours; or turn off Aura Fight's notifications in the device's settings. Logging out removes the token from your account.

Error reports

When the app, the website or our server hits an error, it sends a report to Sentry (Functional Software, Inc., which works for us and stores the reports in the European Union): what went wrong, the app version, the device model and operating system, and what the app was doing. A report never carries your account, your guest identifier, your session token, your email or your IP address; anything else that could identify you (such as sign-in links) is removed before it leaves your device or the server. Reports are kept for up to 90 days.

The website

aurafight.app is served by Cloudflare, which processes your IP address and the request to deliver the pages and protect the site. The website uses no analytics and no cookies. It keeps two strictly necessary things in your browser's local storage: your guest account's random identifier and your session token. If you clear the site's data, you lose access to that guest account unless you saved it with your email.

How long we keep it

How to delete your account, step by step: aurafight.app/delete-account.

• Your account and your fighter: until you delete them. You can do it yourself in the app, on iPhone, Android and the web (your account → "Delete account"), or by writing to support@aurafight.app. Your account, its sign-in methods (Apple, Google or email), your sessions, your notification tokens and settings and the notifications sent, your device and network fingerprints, your inventory, your achievements, your destiny and your diary, your blocks, and your ad reward tokens are deleted at once; your reports stay without your identifier or your comment. If your account had an email address, we also ask Costia (the same developer's accounts service, from which our mailboxes are run) to delete what it holds about you: your suggestions, your conversations with support@, hello@ and social@aurafight.app and your address in its email log. Your fighter disappears from rivals, the ranking, the crew and its link; in duels other players already fought against it, it shows as "Luchador eliminado".
• The session on a device: it lasts 180 days, or until you log out; once expired, it is deleted 30 days later.
• Sign-in codes and links: valid for 15 minutes, and deleted 24 hours after they expire.
• Device and network fingerprints, and the records of visits to links: 90 days.
• RevenueCat's purchase notices: 6 years, for Spanish accounting and tax obligations, and then deleted. If you delete your account earlier, they are kept only for those obligations and with nothing that identifies you.
• Your birth year: with your account, until you delete it.
• Reports: until they are reviewed, and 180 days after review. Blocks: until you unblock or either account is deleted.
• Conversations with support@, hello@ and social@aurafight.app: 730 days, or until you delete your account.
• Notifications sent: 30 days. Expo's delivery tickets: at most 24 hours.
• Database backups: 30 days.
• The server's technical logs: 14 days. Error reports: at most 90 days.
• Everything else: as explained above.

Why we may use it (legal bases)

• Contract: your account, your fighter and the game (including what is public about it, which is part of the game), email sign-in, granting the rewards of the ads you choose to watch, what you buy, and blocks.
• Consent: personalised ads, and storing or reading identifiers on your device for ads where the law requires consent; tracking on iPhone; notifications.
• Legitimate interest: non-personalised ads, which keep the game free; preventing cheating, fraud and abuse (the device and network fingerprints, the limits); reviewing reports and filtering offensive names; technical logs, error reports and backups, to keep the service working and secure.
• Legal obligation: your birth year, to apply the minimum age and the age of digital consent; keeping what the law requires and answering lawful requests from authorities.

Who works with your data

We don't sell your data, and we only share it with those who help us run Aura Fight and are bound to protect it, or as described above: Cloudflare (delivering and protecting the website and the server, and receiving the mail sent to our addresses), Gcore (the network mirror during LaLiga's blocks), Resend (sending the sign-in emails and our replies), Google (ads with AdMob, purchases in Google Play and sign-in), Apple (purchases in the App Store, delivering notifications and sign-in), RevenueCat (purchases), Expo (sending the notifications) and Sentry (error reports). We would only give data to authorities when the law requires it.

Outside the European Union

Your account is stored in the European Union. So are error reports. Google, Apple, RevenueCat, Cloudflare, Resend, Expo and Sentry may process data in the United States and other countries. They do so under the EU-US Data Privacy Framework (and its UK and Swiss extensions) or the European Commission's standard contractual clauses.

Children

You must be 13 or older to play Aura Fight: the app asks your birth year when you create your fighter and, below that age, does not create it. If you are not of age where you live, play with the permission of your parent or guardian. If we learn that an account belongs to a child under that age, we delete it. Players under their country's age of digital consent only get non-personalised ads and nothing that relies on their consent.

Your rights

These rights are for everyone, wherever you live. You can ask for access to your data, a copy in a portable format, its correction or deletion, to restrict or object to its use, and withdraw your consent at any time without affecting what was done before. Write to support@aurafight.app from your account's email address (if it is a guest account, send us your fighter's link) and we will answer within one month at most. You can reset your advertising identifier in the device's settings. You can also complain to the Spanish Data Protection Agency (aepd.es) or the authority where you live.

United Kingdom: the UK GDPR gives you the same rights; you can complain to the ICO (ico.org.uk).

United States: under California's and other states' privacy laws, you can know what we collect, get a copy, correct it, delete it and opt out of the "sale" or "sharing" of your data or targeted advertising with it. We don't sell data for money, and we don't use sensitive data to infer anything about you. Personalised ads may count as "sharing" or "targeted advertising": you can opt out under your account → "Ad privacy". We won't treat you differently for exercising your rights.

Elsewhere: you have the rights the law where you live gives you, and we honour the ones above wherever you live.

Changes

When this policy changes we will update this page and its date, and the app will tell you about any important change.