Privacy Policy

ProteinAura ("we", "our", "us") operates the protein tracking and fitness service at www.proteinaura.xyz (the "Service"). This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it. The service is operated as a sole proprietorship by Yugandhar Tripathi based in India.

1. Data we collect

We collect only the minimum data needed to operate the service:

• Account data from X (Twitter) or Google OAuth: display name, @handle or email, public avatar URL, and a unique provider ID. We never receive your X or Google password.
• Profile data you enter: daily protein goal, height, weight, age, gender, fitness goal, dietary preference, region, timezone.
• Activity data: protein entries (grams + optional food name + timestamp), workout logs, share history, quest progress, badges earned, Aura Points (AP) ledger, streak data.
• Wearable and fitness-app data, only if you connect Fitbit, Oura, WHOOP or Strava under Me → Connected apps. See section 4a.
• Photos uploaded via the Lens (snap-to-log) feature. Photos are sent to our AI provider for protein estimation and stored in our object store; they can be deleted on request.
• Shipping details (only if you win a free gift and choose to claim it): full name, phone, address, pincode, country.
• Payment metadata from Razorpay: subscription IDs, transaction status, amounts. We never store your full card number, CVV, or UPI PIN — those are handled directly by the payment processor.
• Push subscription tokens if you opt into web push notifications.
• Phone number, only if you turn on SMS reminders.
• Usage and device data: pages viewed, referring page, browser and device type, and an approximate country derived from your IP address (used for plan prices and analytics). See section 4 for the tools that collect it.

2. Cookies and local storage

We use first-party cookies only to run the Service:

• auth-token (HTTP-only, 7 days): keeps you signed in.
• google_oauth_state (HTTP-only, 10 minutes): protects the Google sign-in step against forgery.
• auth_next (10 minutes): remembers which page to return you to after sign-in. It holds only a page path.
• pa_int_<app> (HTTP-only, 10 minutes): set only while you connect a wearable or fitness app, to protect that step against forgery. It holds a random value, nothing about you.
• ref_code (HTTP-only, 7 days) and ref_landing (10 minutes): set only when you arrive through a friend's invite link, so the invite can be credited.

The app also keeps small preferences in your browser's local storage (for example, prompts you dismissed and your last share style). Vercel Web Analytics does not use cookies. If we turn on the optional tools listed in section 4 (PostHog, Google AdSense), they may set their own cookies.

3. How we use your data

• To run the core product: tracking entries, computing your goal, streak, HP, leaderboard rank, and Aura Points balance.
• To generate personalised Coach insights and Chef meal suggestions.
• To estimate protein content from food photos (Lens feature).
• To process subscription payments and ship free gifts to winners who claim them.
• To send transactional and notification emails (welcome, leaderboard winner, gift on its way) and optional push notifications.
• To prevent abuse and enforce rate limits.
• To understand how the app is used and to find and fix errors.

We do not sell your personal data, share your profile or activity data with advertisers, or use it to train external AI models.

4. Third-party processors

We share data with the following service providers strictly to operate the Service:

• Vercel Inc. — hosting and edge runtime, and Vercel Web Analytics (cookieless page-view statistics)
• Prisma Postgres (database) and Vercel Blob (image storage)
• X (Twitter) and Google — sign-in (OAuth identity providers)
• OpenAI and/or xAI — AI inference for Lens, Coach, Chef, and image generation. Inputs are routed by our application code based on the configured provider per use case.
• Razorpay — subscription payments. The Razorpay checkout loads from Razorpay only when you start a payment.
• Resend — transactional email
• Web Push — notifications delivered through your browser vendor's push service, if you opt in

Only if you connect them yourself (Me → Connected apps):

• Fitbit / Google (Google Health API), Oura, WHOOP and Strava — we read your data from them; we send them nothing about you. See section 4a.

Used only when we turn them on (not all are active at any given time):

• PostHog — product analytics (a few funnel events such as sign-up and first log). It respects your browser's Do Not Track setting.
• Sentry — error monitoring (crash reports with technical details of the error)
• Google AdSense — ads shown to free accounts on the Home screen. Google may use cookies to serve and measure them under its own policy; Pro accounts see no ads.
• MSG91 — SMS reminders, only if you turn them on

Each processor has its own privacy policy. We choose providers with strong security postures and process data under standard data-processing terms.

4a. Wearables and fitness apps

Connecting an app is optional and you can disconnect at any time. When you connect Fitbit (through your Google account), Oura, WHOOP or Strava, you approve read-only access on that provider's own consent screen, and we read:

• Daily totals only: steps, active minutes, time asleep and sleep efficiency, resting heart rate, heart-rate variability, the provider's recovery or readiness score, WHOOP strain, and the number and length of your workouts (from Strava: workouts only, with their Relative Effort).
• We never store raw heart-rate streams, GPS routes, locations, photos or notes, and we never write anything back to your account there.

How we use it:

• To add sleep, recovery, activity and workouts as factors in your HP and your smart protein goal, and to count a recorded workout as a training day.
• Strava data is shown only to you, is never sent to an AI model, and is kept for at most 7 days. It never feeds your HP, because HP can appear on cards you share.

How we protect and delete it:

• The access tokens the provider gives us are encrypted (AES-256-GCM) before they are stored, and are never shown or logged.
• We refresh your data a few times a day, and when you tap Sync now.
• Disconnecting (Me → Connected apps → Disconnect) revokes our access where the provider allows it and immediately deletes the stored tokens and every daily total we synced from that app. Deleting your account deletes all of it too.
• You can also remove our access from the provider's own settings; we then stop syncing.

5. Data retention

We keep your account and activity data for as long as your account is active. When you delete your account (via Me → Data & account → Delete account), all personal data is permanently removed within 30 days, except where retention is required by law (e.g., transaction records for tax purposes, kept for 8 years per Indian law). So that deleting and re-creating an account can't reset the free AI limits, a record of your AI usage (feature, date and estimated cost) is kept for up to 21 days after deletion, linked only to a one-way hashed identifier, never your name or email. It is then deleted.

6. Your rights

You have the right to:

• Access a copy of your data — export from Me → Data & account → Export my data, or by emailing us.
• Correct inaccurate data — edit your profile and details in Me.
• Delete your account and all associated data — Me → Data & account → Delete account.
• Withdraw consent for push notifications or marketing emails — Me → Notifications.
• Lodge a complaint with India's Data Protection Board if you believe we've mishandled your data, after first contacting us at the email below.

7. Security

We use HTTPS for all traffic, HTTP-only cookies for session tokens, encrypted database connections, server-side input validation, atomic transactions for any financial-impact operation, and rate limiting on sensitive endpoints. No system is perfectly secure; if you suspect unauthorised access to your account, contact us immediately.

8. Children

ProteinAura is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has provided us their data, contact us and we'll delete it.

9. International transfers

Some of our processors (Vercel, OpenAI, xAI, Resend, and PostHog, Sentry and Google when those tools are on, and Fitbit/Google, Oura, WHOOP and Strava if you connect them) operate outside India. Where this involves transferring your data internationally, we rely on each processor's standard data-protection commitments.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced via email and an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions or requests under this policy? Email tripathi.yugandhar@gmail.com or visit our Contact page.