Privacy

Updated 14 October 2026

Service operator: Aura Certificate

The data we use

For your account, we use your email, nickname, protected password, country and time zone. We record your age declaration and acceptance of the Terms. Your date of birth is optional. We also keep information about credits, invites and account activity.

To create cards, we use uploaded photos, public content from the social profiles you select, any context you add and analysis results. We do not ask for social media passwords.

When you contact us, we process your name or nickname, email and message. Technical data such as IP address, browser, device, access and error information may be processed to operate and protect the site.

Why we use it

We use this data to manage accounts, cards, credits and support and provide the service described in the Terms. Without the required details, we cannot complete the request.

We prevent abuse and protect the service on the basis of our legitimate interest in security. We also process data needed to meet legal obligations and protect our rights. Optional analytics require your consent.

AI analysis creates an entertainment result, rather than decisions with legal or similarly significant effects on a person. You can report errors or challenge a restriction through the Contact page.

Providers and external services

Microsoft Azure hosts the service. OpenAI receives images and text for analysis and content checks. To retrieve public posts, we send the username to Lundehund’s TikTok API and imwhodifferent’s Instagram Scraper API through RapidAPI.

Brevo handles service emails. Cloudflare Turnstile uses technical browser signals to protect against abuse. Google handles usage statistics only with your consent.

Some providers may process data outside the European Economic Area and retain it for security or legal obligations. Contact us for information about the countries involved and applicable safeguards. We do not sell your personal data.

Card visibility

Public is the default: anyone with the link can open the card. Friends requires a password. Story lasts 24 hours from creation; changing your choice does not restart the clock. Manage visibility in My cards, where you can still find expired Stories.

Cards show the images, nickname or social username and result. Email, date of birth and country are not public. We ask search engines not to index cards, but viewers can save or forward them: copies shared elsewhere are no longer controlled by your settings.

Data retention

Original images uploaded directly are automatically deleted within 30 days of upload. Copies of images retrieved from social media are temporary and deleted when processing ends. Generated cards remain stored, including when they are no longer visible.

Account data is kept to manage your relationship with the service. Request deletion from your profile: access is blocked and cards are no longer visible while the request is being completed.

For support messages, we consider the time needed to handle the request and any follow-up. For technical logs, we consider diagnostic and security needs, including investigations into possible abuse. Legal obligations or disputes may require further retention.

Cookies and analytics

Necessary cookies enable sign-in, security, drafts, language selection and access to protected cards. See the Cookies page for names and durations.

Google Analytics 4 collects visit and interaction statistics only with your consent. You can refuse or withdraw consent through Cookie preferences without losing access to the service.

Your rights and how to contact us

Where the law provides, you can access your data, correct it, request deletion, restrict its use or receive it in a portable format. You can object to processing based on legitimate interests. You can withdraw consent at any time; processing lawfully carried out before withdrawal remains valid.

Use the form on the Contact page to exercise your rights or report content. We may ask you to confirm your identity to protect your data. You can also complain to the Italian data protection authority, the Garante, or the competent authority in your country.

Are you sure?