Aura ScriptworksAura ScriptworksAura Scriptworks
Back to Store

Privacy Policy

Your workflow is your business. Here's how we protect it.

Last updated: September 27, 2026

1. Data We Collect & The Checkout Handoff

We believe in a local-first architecture. Aura Scriptworks LLC only collects the absolute minimum operational data required to provide our services, manage your license, and ensure our software is functioning. This policy covers our browser extensions and our web applications, including Aura Story Builder (storybuilder.aurascriptworks.com).

  • Account Data & Authentication Information: Email address and a unique User ID for authentication (via Google OAuth). We do not collect, process, or store your passwords.
  • Operational Telemetry: Basic app-health pings (e.g., verifying an active license). Our extensions track your activity volume strictly locally on your device — our servers never see your ongoing usage numbers. We only receive a generic, anonymous flag when you reach a specific milestone.
  • Checkout & Billing (The Merchant of Record): When you initiate a purchase, you are transferred to our Merchant of Record, Lemon Squeezy. To legally process the sale, prevent fraud, and remit global taxes, Lemon Squeezy collects your email, IP address, device data, and payment information. We do not store or process your credit card information. This transactional data is stored and governed by the Lemon Squeezy Privacy Policy.

2. Data We NEVER Collect

Our extensions and apps process your work locally on your device by default. We have zero visibility into your actual workflow. The one exception is the optional AI built into Aura Story Builder, which is described in Section 4; even there, we pass your request along and keep none of it. We never collect, read, or transmit:

  • Phone Numbers: We never collect, process, or transmit your phone number. Our authentication is handled exclusively via Google OAuth — no phone number is ever requested, stored, or used. You may note that our bundled authentication library (@supabase/supabase-js) contains internal code supporting optional phone/OTP login. This is a standard, non-removable artifact of the Supabase GoTrueClient library. We do not use, call, or activate these functions in any capacity.
  • Continuous usage metrics or action counts: Your total usage volume stays on your machine; we only know if a milestone flag is triggered.
  • The text, data inputs, files, or generated content you process through any of our extensions.
  • Your browsing history, URLs, or website visits.
  • Keystrokes or screen recordings.
  • Cross-site tracking cookies or intrusive behavioral analytics.

3. Data Handling and Usage

We use the minimal data we collect strictly to operate the business:

  • Authenticating your account and verifying your license tier.
  • Processing payments, renewals, and refunds securely.
  • Sending transactional emails (like purchase receipts).
  • Providing customer support when you contact us.
  • Optional Updates: If — and only if — you explicitly opt-in via our in-app prompts, we will use your email to send you advanced tutorials, workflow tips, and major sales alerts for Aura Scriptworks tools.

4. Data Storage & Security

  • Extension & App Data: All data related to your prompt queues, workflow configurations, and (for Aura Story Builder) your local story library is stored entirely on your device — in your browser's local storage, or in a folder you choose on disk. This data never leaves your machine and is never transmitted to our servers, unless you explicitly opt in to a cloud storage backend like Google Drive (see Section 6), or you use the in-app AI described below.
  • In-App AI (Aura Story Builder, optional): Aura Story Builder includes optional AI features (planning a story with the AI, having it write your pages, and illustrating them) that run on AI credits. When you use one, the text of that request, and any reference images it needs, pass through our servers to our AI providers (listed in Section 5), and the result comes straight back to you. We do not store or log the content of these requests or their results, and we never use them to train AI models. The only records we keep are what billing needs: how many credits each request used, and, for pictures queued to be drawn in the background, a reference to the job so the finished pictures can be delivered to your book. Nothing is sent unless you use an AI feature. The prompts Story Builder writes for you to run in your own ChatGPT, Claude, or Gemini account never pass through us at all.
  • Account Data: Your account data is stored securely in Supabase (PostgreSQL) using industry-standard encryption and strict Row Level Security.
  • Payment Data: We do not store your credit card information; all financial data is handled exclusively by our Merchant of Record, Lemon Squeezy, which is fully PCI-compliant.

5. Third-Party Services

We use a small stack of trusted, enterprise-grade services to run Aura Scriptworks:

  • Google (OAuth & Drive API): Account creation and authentication; and, for Aura Story Builder users who opt in, storage of your story library in your own Google Drive (see Section 6).
  • Supabase: Secure database and authentication handling.
  • Lemon Squeezy: Our Merchant of Record. Handles all secure payment processing, fraud prevention, global tax compliance, and license key generation.
  • Cloudflare: Secure hosting and DDoS protection, and the servers that pass in-app AI requests to our AI providers.
  • AI providers (Aura Story Builder in-app AI only): EnclaveHost (eyesoff.ai), which runs the AI model inside a secure enclave, and the Google Gemini API, which draws illustrations and takes over text requests if the primary provider is unavailable. They receive only the content of the AI requests you make, and process it under their own terms to produce the result.

6. Google User Data (Google Sign-In & Google Drive)

Some of our applications access Google user data through Google's APIs, always with your explicit consent via Google's OAuth consent screen. This section describes exactly what we access, how we use it, how it is stored, and how you can revoke access.

  • Google Sign-In: When you sign in with your Google account, we receive your name, email address, profile picture, and a unique account identifier. We use these solely to create and authenticate your account. We never receive or store your Google password.
  • Google Drive (Aura Story Builder — optional): If you choose to connect Google Drive as your storage backend, Aura Story Builder requests the drive.file scope. This scope only permits access to files and folders that the app itself creates in your Drive (a story-builder/ folder containing your stories, characters, settings, and related media). We cannot see, read, or modify any other files in your Google Drive. The same connection also powers the optional Aura Flow integration described below; it requests no additional scopes.
  • How we use Drive data: Your Drive files are used exclusively to save, load, and sync your Story Builder library across your devices. All file transfers happen directly between your browser (or our Aura Flow extension) and Google Drive — your story content is never transmitted to, processed by, or stored on Aura Scriptworks servers.
  • Aura Flow connection (optional): Our Aura Flow browser extension is part of the same Aura Scriptworks suite and shares this Drive connection. If you have connected Google Drive in Aura Story Builder, Aura Flow can load a book's generated prompts from your story-builder/prompts/ folder and write the resulting images or video into that book's pending/ folder, where you approve or reject each one. This uses the same drive.file scope — no additional Google permissions are requested, and it reaches only files these apps created. Aura Flow obtains a short-lived Google access token the same way Story Builder does; the token is held in memory only and never stored. The connection is active only while you are signed in to Aura Flow with the same account.
  • What we store: To keep your Drive connection active between sessions, we store a Google OAuth refresh token in our database (Supabase), protected by encryption and strict Row Level Security so that only your authenticated account can access it. Short-lived access tokens are held in your browser's memory only and are never persisted. We also store the folder ID of the app's own story-builder/ folder to avoid repeated lookups.
  • Sharing: We do not sell, rent, or share Google user data with any third party. We do not use Google user data for advertising. No humans read your Drive data, except where required for security purposes, to comply with applicable law, or with your explicit consent.
  • Revoking access: You can disconnect Google Drive at any time from Storage Settings inside Aura Story Builder — this immediately deletes the stored refresh token from our database. You can also revoke our access from your Google Account security settings. Your story files always remain in your own Google Drive, fully under your control.
  • Retention & deletion: Stored Google credentials are deleted immediately when you disconnect Drive or delete your account. Because your files live in your own Google Drive, deleting your Aura Scriptworks account never deletes your stories.

Aura Scriptworks' use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. User Consent

We do not collect any personal data before you consent to it. Consent is obtained as follows:

  • Account creation: By signing in with Google OAuth, you consent to us receiving your email address and a unique User ID for the purpose of authenticating your account and managing your license. No data is collected before this step.
  • Optional communications: Marketing and educational emails are only sent if you explicitly opt in via an in-app prompt. This is separate from and never bundled with account creation.
  • Extension operation: All workflow data processed by our extensions (prompt queues, configurations, captured content) remains on your device. No consent to transmit this data is ever requested, because we never transmit it.

8. Data Sharing and Disclosure

We do not sell, rent, or share your personal data with outside third parties for marketing or advertising purposes. Data is only shared with the trusted third-party service providers listed in Section 5 strictly for the purpose of securely processing your transactions and authenticating your license.

Because the extension operates locally to assist with queuing your prompts, no workflow data is ever transmitted to us, and therefore cannot be shared by us.

9. Your Rights

You completely own your relationship with us. At any time, you can:

  • Access the personal data we have on file.
  • Request the complete deletion of your account and associated data.
  • Export your account data.
  • Unsubscribe from our optional educational/promotional emails with one click.

10. Chrome Web Store — Limited Use Compliance

Our browser extensions are distributed through the Chrome Web Store and comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically:

  • User data obtained through our extensions is used solely to provide and improve the functionality described in each extension's Chrome Web Store listing.
  • We do not transfer user data to third parties except as described in Section 5 (Third-Party Services) and Section 8 (Data Sharing and Disclosure).
  • We do not use or transfer user data for advertising, data brokering, or any purpose unrelated to the extension's core function.
  • We do not allow humans to read user data except where required by law, for security purposes, or with the user's explicit consent.

11. Contact

Questions about how we handle your data? Contact us through the feedback form on our website.

You may also reach us by mail at:

Aura ScriptWorks LLC
4539 N 22nd St Ste N
Phoenix, AZ 85016
USA