Security practices.

This page describes how the Aurora website (this site) protects the data it handles. Because the site collects almost nothing, the honest summary is: there is very little to protect, and we protect it anyway.

The site's entire data footprint is the wishlist: your email address, the form you used, and a timestamp. There are no accounts, no passwords, no payment details, and no tracking profiles on this website.

• All traffic to the site is encrypted in transit with HTTPS.
• Wishlist entries are stored in Google Cloud Firestore, encrypted at rest by Google.
• The signup endpoint validates input, checks the request origin, and rate-limits by IP to prevent abuse and bulk submissions.
• Database records are keyed by a one-way hash of your email rather than the raw address.
• Database credentials exist only on the server — the browser never talks to the database directly.

If you believe you've found a security issue in this website, we'd genuinely like to hear about it. Email info@goaurora.app with the details and we'll respond as quickly as we can. Please give us a reasonable window to fix the issue before sharing it publicly.

Questions? Reach us at info@goaurora.app.