AuraClash collects almost nothing. No location. No photos or videos. No contacts. No advertising or tracking. This page explains the little that we do hold, and how to get rid of it.
AuraClash is operated by Suleiman Al Khoury, Spain, acting as the data controller for the purposes of the EU General Data Protection Regulation (GDPR). You can reach us at support@auraclash.app about anything on this page.
AuraClash is for people aged 13 and over. The app asks for your birth year before an account is created. If you are under 13, no account is created and nothing about you is stored. We do not keep your birth year — it is used to decide whether you may continue, and then it is gone.
| What | Why |
|---|---|
| Your handle | It identifies you to other players. You choose it; it is permanent. |
| Your fighter (avatar choices) | Your appearance in the app. Assembled from our own components — you cannot upload anything. |
| Aura, Victory Points, wins, losses, streak | The game itself. |
| Battle history and votes | To run battles and settle results. Individual votes are never shown to anyone, including the players. |
| Crew membership | So your crew's leaderboard works. |
| An anonymous account identifier | Created by our authentication provider so your progress belongs to you. It contains no personal details. |
| A device identifier for a battle session | Hashed, and used only to stop the same device voting twice in one battle. |
| Blocks and reports you make | To keep you away from people you have blocked, and to act on reports. |
| Battle videos | Only if you record one for an async battle. It is screened, combined with your opponent’s, and shown to the people invited to vote. It is deleted after 24 hours. The finished version is delivered to your phone and kept by you, not by us. |
| A notification token for your device | Only if you turn notifications on. It lets us tell you that someone called you out, or that a battle you fought has a result. It identifies the app on your phone, not you. |
We send a notification for five things, and nothing else: someone calls you out, your call-out is accepted, your call-out is declined, voting opens on a battle you joined, and a battle you fought ends. We never send marketing, we never send anything on a schedule, and we never notify you about other people’s battles.
Everything except being called out stays quiet between 10pm and 8am in your own timezone. Being called out still arrives, because the invitation expires.
You can turn each of the five off separately in Settings, or turn all of them off in your phone’s system settings. If you never turn notifications on, no token is ever sent to us.
Delivery uses Firebase Cloud Messaging, run by Google. They receive the token and the text of the notification so they can deliver it. Deleting your account deletes your tokens.
There are two different things here and it matters which is which.
The Battle Camera — filming an in-person clash — is unchanged. That video is processed on your phone and saved to your camera roll. We never receive it.
An async battle video does leave your phone. You record 30 seconds, it is uploaded, and then:
Screening is done by Sightengine, who receive the video to check it and do not keep it. A single report from any viewer hides a video immediately, before anyone reviews it.
Both players can see who is watching their battle, and can block any of them.
Our backend runs on Supabase (database, authentication), hosted in the European Union, acting as our processor under a data processing agreement. Apple and Google process app distribution and, if you choose to link your account, sign-in. If you turn notifications on, Google (Firebase Cloud Messaging) and your phone’s platform — Apple on iOS — deliver them. If you record an async battle video, Sightengine screens it on our behalf. Nobody else. We do not sell data and we have no advertisers.
Your handle, fighter, aura, rank, win-loss record and streak are visible to people you battle and to your crews. You are not listed on any public global leaderboard unless you switch that on yourself in Settings — it is off by default. Individual votes are never revealed to anyone.
We process this data to perform the service you asked for (Article 6(1)(b) GDPR) and, for safety features such as blocks and reports, on our legitimate interest in keeping the app usable and safe (Article 6(1)(f)).
Your profile and game history stay until you delete your account. Reports are kept while we act on them. Battle sessions that are abandoned are cleaned up automatically.
Settings → Delete account. It is immediate and permanent: your profile, handle, aura, Victory Points and battle records are removed, and your name is stripped from records of battles other people took part in. There is no undo and we cannot restore it afterwards. You can also email support@auraclash.app and ask us to do it. Full step-by-step instructions are on the account deletion page.
Under GDPR you may request access to your data, correction, deletion, restriction, portability, or object to processing. Email support@auraclash.app and we will respond within one month. If you are unhappy with our response you may complain to your local data protection authority; in Spain that is the Agencia Española de Protección de Datos.
AuraClash is not intended for children under 13 and we do not knowingly hold data about them. If you believe a child under 13 has an account, email support@auraclash.app and we will delete it.
If this policy changes we will update this page and the date at the top. If a change is significant, we will say so in the app.