Aura Gaming — Privacy Policy

Effective date: September 23, 2026 (previous version: September 6, 2026)

Aura Gaming ("the app", "we") is a mobile broadcasting tool published by Growth Asteroid Marketing (Saif Ullah, sole proprietor) that lets you record your screen and stream your screen or camera live to YouTube and Facebook Live. This policy explains what data the app accesses, how it is protected, and how you can delete it.

1. Data we access

Aura account (optional). To connect a streaming destination you create an Aura account with an email address and password, or sign in with Google or Apple. We store your email address, display name and a user ID with Google Firebase Authentication.
Google / YouTube data (only if you connect YouTube). The app uses Google OAuth with the https://www.googleapis.com/auth/youtube scope, plus openid and email. With your permission the app receives an OAuth access token and refresh token, your channel name and channel ID, and your Google account email. The YouTube scope is used solely to: list the channels you own so you can choose one, create the live broadcast and stream for a stream you start, set the title, description, tags, visibility and thumbnail you enter, and end the broadcast when you stop. We do not read your subscriptions, watch history, comments or any other YouTube data, and we do not post anything you did not explicitly start.
Facebook account data (only if you connect Facebook). The app receives an access token, your name, and the list of Pages you manage. This is used solely to create and manage your live videos and to show viewer counts and comments during your stream.
Camera and microphone. Used only while you stream or record, to produce the video/audio you broadcast. Nothing is captured in the background.
Screen contents. Captured only during an active screen stream or recording that you start, after the operating system's consent prompt. Screen content is sent directly from your device to the platform you selected (YouTube or Facebook) and is never sent to or stored by us.

2. How we use Google user data (Limited Use disclosure)

Aura Gaming's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Google user data is used only to provide the user-facing live-streaming features described above.
We do not sell Google user data, use it for advertising, or use it to build profiles.
We do not transfer Google user data to third parties, except as required to provide the feature (the YouTube API itself), to comply with law, or as part of a merger/acquisition with notice to you.
No human reads your Google user data except with your explicit consent for support, for security purposes, or where required by law.

3. How we protect your data (data protection mechanisms)

We treat OAuth tokens and account identifiers as sensitive data and apply the following safeguards:

Data	Where it lives	Protection
Google/YouTube and Facebook access tokens	Device memory only, for the duration of a session	Never written to disk in plain text; discarded when the session ends or you disconnect.
Google/YouTube refresh token (on device)	iOS Keychain / Android EncryptedSharedPreferences via the operating system's secure storage (flutter_secure_storage)	Hardware-backed, OS-level encryption; inaccessible to other apps; removed when you disconnect or uninstall.
Google/YouTube refresh token (cloud backup, only if you have an Aura account)	Google Cloud Firestore, document `users/{your-uid}/connections/youtube`	Encrypted at rest by Google Cloud (AES-256) and in transit (TLS 1.2+). Firestore security rules allow access only to the authenticated owner of the document; no other user, and no public access, can read it. Stored so that your channel stays connected when you reinstall or change phones.
Google OAuth client secret	Our token-exchange relay server (Hetzner-hosted, EU), never in the app	Stored in a root-only file, used only to exchange your authorization code / refresh token with Google over HTTPS. The relay does not log or persist tokens.
Aura account (email, name)	Firebase Authentication and Firestore `users/{uid}`	Encrypted at rest and in transit; passwords are hashed by Firebase (scrypt) and never visible to us; owner-only security rules.
Stream history, settings, saved games, recordings	Your device only	Protected by your device's app sandbox; never uploaded.

Encryption in transit: every connection the app makes (Google, YouTube, Facebook, Firebase, our relay) uses HTTPS/TLS. Live video is sent over RTMPS where the platform supports it.
Access control: only the developer (Saif Ullah) has administrative access to the Firebase project and the relay server, protected by two-factor authentication and SSH keys. There are no employees or contractors with access.
Data minimization: we request only the scopes needed for streaming, store only the refresh token and channel name, and never store video content, watch history or contacts.
Retention: tokens are kept only while your YouTube/Facebook connection exists. Disconnecting deletes the cloud copy immediately; the on-device copy is deleted when you disconnect or uninstall. Aura account records are deleted within 30 days of an account-deletion request.
Incident response: if we become aware of a security breach affecting your data we will revoke affected tokens and notify affected users by email within 72 hours.

4. Third-party services

Google (YouTube Data API v3, Google Sign-In) — processes your live broadcasts and authentication under Google's Privacy Policy. By using the YouTube features you also agree to the YouTube Terms of Service.
Google Firebase (Authentication, Firestore) — hosts Aura accounts and the encrypted connection backup, under Google's privacy terms.
Meta Platforms (Facebook Live API) — receives your stream and manages your live videos under Meta's Privacy Policy.
Google AdMob — shows optional rewarded ads on the free plan and may collect advertising identifiers per Google's Privacy Policy.
Google Play Billing / Apple In-App Purchase — process subscription payments; we never see your payment details.

5. Data deletion and revoking access

Disconnect YouTube: in the app open Go Live → destination → YouTube → "Switch"/disconnect. This deletes the refresh token from your device and from your Aura account in Firestore. You can also revoke Aura Gaming's access at any time at myaccount.google.com/permissions, which invalidates our tokens immediately.
Disconnect Facebook: Dashboard → account card → Log out, or remove the app at Facebook → Settings → Apps and Websites.
Delete your Aura account and all cloud data: Profile → Sign out / Delete account, or email us from your account address; we delete the Firebase user and all Firestore documents within 30 days.
Local data: uninstalling the app removes all locally stored data and secure-storage entries.

6. Children

The app is not directed at children under 13 and we do not knowingly collect data from them.

7. Changes

We will post any changes on this page and update the effective date. Material changes to how Google user data is handled will be announced in the app before they take effect.

8. Contact

Growth Asteroid Marketing — Saif Ullah
growthasteroid@gmail.com
https://saifbajwa.com/golivecast/