Privacy Policy

AuraBar is operated by Blendhouse Holdings, Inc., a Delaware corporation ("we," "us," or "our"). We built AuraBar on a simple principle: your wellness data belongs to you. This policy explains what we collect, why we collect it, how we protect it, and how you stay in control.

1. Information We Collect

Information you provide directly

• Account & contact details — name, email address, phone number, and any profile information you add to your AuraID.
• Instagram handle — optional. If you give it to us when joining the waitlist, we store it alongside your entry so we can recognise you if we meet on Instagram. We do not connect to your Instagram account, we cannot see anything on it that is not already public, and leaving the field blank has no effect on your place in line.
• Glow Score quiz responses — wellness goals, lifestyle habits, energy patterns, dietary preferences, and other inputs you share when taking our quiz.
• Purchase history — blends ordered, visit frequency, and payment information (processed by our third-party payment provider; we do not store full card numbers).
• Communications — messages you send us via email, chat, or social media.

Information from connected devices (only when you opt in)

• Wearable data — if you choose to connect Apple Health, Oura, WHOOP, or other supported platforms, we receive the specific metrics you authorize (e.g., sleep, heart-rate variability, activity). You can disconnect at any time.
• Menstrual and cycle data — only if you separately turn on cycle tracking. See Section 5 for exactly what we read and how it is used.

Information collected automatically

• In-store visit data — when you scan your AuraBar QR code at one of our retail locations, we record the time, location, the drink/blend ordered, and the supplements it contained.
• Usage data — pages visited, features used, session duration, and general interaction patterns within our website and app.
• Device & browser data — device type, operating system, browser type, IP address, and approximate location (city level).
• Cookies & similar technologies — aurabar.io does not set cookies and does not run advertising or third-party analytics trackers. We store a small amount of data in your browser’s local storage (for example, whether you already joined the waitlist or finished the Glow Score quiz) so the site does not ask you twice, and a random session identifier in your browser’s session storage so that one visit is counted as one visit rather than several. That identifier is never used for advertising and is discarded when you close the tab. You can clear both at any time in your browser settings. Our mobile app uses analytics separately, as described below.

2. How We Use Your Information

• Calculate and refine your Glow Score and personalized blend recommendations.
• Process orders and manage your account.
• Send transactional communications (order confirmations, score updates) and, with your consent, marketing messages you can unsubscribe from at any time.
• Improve our products, formulations, and platform experience through product analytics. These analytics record which screens you open and which features you use, tied to an account identifier — they do not include your health metrics or your Glow Score.
• Process in-store orders by charging the payment method on file when you scan your QR code at the bar.
• Send push notifications you've opted into — daily check-in reminders, streak protection, score milestones, and order updates.
• Generate aggregated, de-identified insights for our retail merchandising decisions.
• Comply with legal obligations.

3. What We Never Do

• We never sell your personal data.
• We never share identifiable health or wellness data with advertisers.
• We never use your data to deny you services or discriminate in any way.

4. When We Share Information

We share personal information only in these limited circumstances:

• Service providers — companies that help us operate, bound by contract to use your data only on our behalf. These include:
  • AI coaching: Anthropic — when you chat with Aura, the relevant portions of your recent health metrics, check-ins, and Glow Score history are sent to Anthropic's Claude API to generate the reply. If you have turned on cycle tracking, your current cycle phase is included. This happens only when you send a message, and Anthropic does not use your data to train its models.
  • Product analytics: PostHog — receives which screens you open and which features you use. It does not receive your health metrics or your Glow Score.
  • Location search: Mapbox — powers place search when you tag a location on a meal or workout.
  • Payment processing: Stripe
  • SMS authentication and notifications: Supabase / Twilio
  • Push notification delivery: Expo and Apple Push Notification service
  • Database hosting: Supabase (data resides in US)
  • Approximate location lookup: ipapi.co — when you load aurabar.io, your IP address is sent to ipapi.co to resolve your city, region, and network provider. We store the result with our record of your visit, and with your waitlist entry if you join.
  • Web fonts: Google Fonts — loading aurabar.io requests fonts from Google, which receives your IP address as part of that request.
• With your consent — for example, if you choose to share your Glow Score in a Glow Circle or on social media.
• Legal requirements — if required by law, regulation, or valid legal process.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with advance notice to you.

Aggregated Marketing Insights for Partners

We may share aggregated, de-identified data (e.g., "users who purchase Rise Up blends are most active in the morning") with select partner brands so they can advertise products that may benefit you. Partner brands never receive your name, email, phone, or any data that could identify you, unless you separately and explicitly opt in to receive offers from a specific partner. You may opt out of all aggregated-data sharing at any time in Profile → Privacy & Marketing.

5. Reproductive & Menstrual Health Data

If you turn on cycle tracking in Profile, AuraBar reads menstrual flow records (and, where available, basal body temperature) from Apple Health, and uses your cycle phase to adjust your Glow Score and to give Aura context when you chat with her.

We treat this as the most sensitive category of data we hold. Specifically:

• It is collected only after you explicitly turn cycle tracking on. It is never collected by default, and turning it off stops collection.
• It is never sold, never shared with advertisers, and never used for marketing or for any partner insight, aggregated or otherwise.
• It is never disclosed to law enforcement except where we are compelled by valid legal process. Where we are legally permitted to notify you first, we will.
• It is deleted along with the rest of your data when you delete your account.
• The one third party that receives anything derived from it is Anthropic, and only as your current cycle phase, and only in the moment you send Aura a message. Your underlying flow records are never sent.

You can turn cycle tracking off at any time in Profile, and you can revoke AuraBar's access entirely in iOS Settings → Privacy & Security → Health → AuraBar. Washington residents may also exercise the rights described in Section 10 under the My Health My Data Act.

6. Your Rights & Choices

Regardless of where you live, we extend these rights to every AuraBar user:

• Access — request a copy of the personal data we hold about you.
• Correction — update or correct inaccurate information.
• Deletion — ask us to delete your account and associated data.
• Portability — receive your data in a commonly used, machine-readable format.
• Opt out — unsubscribe from marketing emails, disconnect wearable integrations, or disable optional cookies at any time.
• Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting prior processing.
• Delete in-app — you can permanently delete your account and all associated data directly from the app at Profile → Delete Account. Deletion is immediate and irreversible.

To exercise any of these rights, contact us at privacy@aurabar.io. We respond within 30 days.

7. Data Retention

We keep your data only as long as your account is active or as needed to provide our services. If you delete your account, we remove your personal data within 30 days, except where retention is required by law (e.g., financial transaction records).

8. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No system is perfectly secure, but we treat the protection of your wellness data as a core responsibility.

• Card numbers are never stored on AuraBar servers; payment data is tokenized by Stripe and held in their PCI-DSS Level 1 environment.
• QR scan tokens used in-store rotate every 5 minutes and can only be used once.
• Friends connected via Glow Circles can see your display name and Glow Score but never your email, phone, or payment information.

9. Children's Privacy

AuraBar is not intended for anyone under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

Users between the ages of 13 and 17 may use AuraBar only with verifiable parental consent. Account creation requires confirming you are 16 or older.

10. State-Specific Rights

California (CCPA/CPRA): California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion, and opt out of any "sale" or "sharing" of personal information. We do not sell personal information. To make a request, email privacy@aurabar.io.

Washington (My Health My Data Act) and Nevada (SB 370): if you are a resident of Washington or Nevada, the health data described in this policy — including any menstrual or cycle data covered by Section 5 — is "consumer health data" under your state's law. You have the right to confirm whether we collect it, to know which third parties receive it, to withdraw your consent to its collection and sharing, and to have it deleted. We do not sell consumer health data, and we will not do so without the separate written authorization those laws require. To exercise these rights, email privacy@aurabar.io.

Residents of other U.S. states with consumer privacy laws (Colorado, Connecticut, Virginia, and others) have similar rights as described in Section 6.

11. If You Are in the EEA or UK

Our legal basis for processing your health data is your explicit consent under Article 9(2)(a) of the GDPR, which you give when you connect Apple Health or turn on cycle tracking, and which you can withdraw at any time by disconnecting those sources or deleting your account. For non-health data, we rely on performance of our contract with you (to run your account and process orders) and on our legitimate interests (to secure and improve the service).

You have the right to access, correct, export, delete, and restrict processing of your data, to object to processing based on legitimate interests, and to lodge a complaint with your local supervisory authority.

Your data is stored in the United States. Transfers out of the EEA and UK rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) with the processors named in Section 4.

To exercise any of these rights, contact us at privacy@aurabar.io.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the effective date at the top. For material changes, we will notify you via email or a prominent notice on our website before the changes take effect.