This policy explains how long Aura Arena keeps different data, how account and content deletion works, and when a legal or safety exception may apply.
Retention principles
- Aura keeps data only as long as reasonably necessary for the disclosed purpose, unless law, safety, audit, fraud prevention, dispute resolution or a legal hold requires longer.
- A public copy, private copy, processing copy, derived signal, transaction record and backup may have different deletion times.
- When direct identification is no longer needed, Aura should delete the data or irreversibly anonymise it. Pseudonymisation is not anonymisation if the key still exists.
- Deleting an account does not erase content already shared by someone else, data held by a merchant or provider under its own terms, or records Aura must preserve.
Default retention schedule
- Unsubmitted camera captures or abandoned drafts: up to 30 days after last activity.
- Non-highest challenge attempts: up to 7 days after the verified result or replacement attempt.
- Highest verified videos and private videos: while active and until the user deletes the content or account, subject to restricted exceptions.
- AI-ad contest drafts: up to 30 days after contest close or last activity unless campaign terms say otherwise.
- Final contest submissions and judging records: campaign term plus up to 3 years, unless a rights, tax, fraud, dispute or legal exception applies.
- Public profile and content: removed from discovery promptly after a verified deletion request; hard-deleted or anonymised within 30 days where feasible.
- Reward, voucher, provider and finance records: up to 7 years where needed for accounting, tax, fraud, support, reconciliation or legal defence.
- Reports, moderation, appeals, copyright notices and support records: normally up to 3 years after closure, with restricted longer retention for high-risk incidents or holds.
- Security, device and fraud signals: normally 12 months; raw analytics and crash events: normally 13 months.
- Backups: normally expire within 90 days after live deletion and are access-restricted.
How account deletion works
- Start deletion through the App or the privacy contact. Aura may ask for OTP or another verification to prevent an attacker from deleting the account.
- Aura restricts login and removes the account and content from ordinary discovery as soon as reasonably practicable.
- Aura starts deletion jobs for profiles, videos, thumbnails, drafts, derived signals, notification tokens and non-essential logs.
- Rewards, claims, finance, audit, rights and safety records are reviewed for a lawful retention exception and pseudonymised where possible.
- Processors are instructed to delete or return data. Aura records systems covered, exceptions, completion and failed or retried jobs.
- Encrypted backups expire through the normal cycle and are not restored into production except for disaster recovery.
Content deletion
When you delete a video or submission, Aura should remove it from feeds, profiles, search, leaderboard cards, campaign galleries and other Aura-controlled surfaces.
Deletion does not automatically erase an award or claim record, a report, a rights notice, an anonymised statistic or a copy downloaded and reposted by someone else.
Aura may retain a restricted evidence copy for safety, copyright, fraud, legal or dispute purposes and must record the reason and review date.
Legal holds and exceptions
A legal hold may suspend ordinary deletion for a court matter, regulator request, law-enforcement investigation, rights dispute, child-safety investigation, fraud review, tax or accounting obligation, contractual claim or evidence preservation.
A hold must identify its scope, owner, reason, start date, access restrictions and review or release date. It must not become a general retention policy.
Parent and guardian requests
A verified parent or lawful guardian may request deletion or restriction of a child's data. Aura may request evidence of authority and may consult the child where required or appropriate.
If a request conflicts with a safety investigation, legal hold or another person's rights, Aura will explain the limitation and act when the exception ends.
Deletion confirmation
A deletion confirmation should say what was deleted, what was removed from public view, what may remain and why, the expected backup expiry and how to contact Aura if data appears to remain.
Aura should not say that all data has been permanently deleted when an exception, provider copy or backup remains.