Security and Your Data

1. Your Content Stays Yours

Your scripts, sides, notes, self-tapes, and everything else you create or upload stays your intellectual property, and we do not claim ownership of anything you make here. Aurica does not train its own models on your content.

2. Content Never Crosses Accounts

Your scripts, tapes, and notes stay yours, never shared with, or visible to, another member's account. Every read and every write is scoped to your account at the application layer.

You can request a copy of your career record: your profile, documents, performances, auditions, contracts, goals and tape links. If you delete your account, your personal data and uploaded content is deleted within 30 days, except where the law requires we keep something longer (billing records, for example, kept seven years for tax compliance).

3. Population Intelligence Exists, and It's Disclosed

Aurica pools anonymized career patterns across its members and returns them to you as benchmarks: booking rate, callback rate, auditions per month, and how the offices you submit to tend to respond. This is the part of Aurica a single-user tool cannot do, and we'd rather explain it than bury it.

What goes in: derived numbers from your activity, and the names of entities already shared across members, such as a production or a casting office. What never goes in: your scripts, your tapes, your notes, your documents, your messages, or anything you've written.

A pattern is computed only when at least five distinct members contribute to it. Below five, nothing is computed and nothing is shown. You are never named. You're included by default; to opt out of every benchmark Aurica computes, turn off "Include my career patterns in benchmarks" in Settings → Data & Privacy.

Separately, Project Constellation, seeing which other joined members are on a production you're also on, is opt-in only, and reciprocal: you see those counts only while you're part of them, and only once three or more members have joined. Your name is never shown, and you can leave at any time.

4. Named Sub-Processors

This is a summary of who touches your data and why. The complete list, with the exact scope of what each vendor receives, is in section 5 of the Privacy Policy.

• Anthropic (Claude): your prompts and working context, to power coaching narrative and document generation.
• OpenAI: recorded audio, including self-tape audio, for transcription and as a fallback for scene-condition analysis; and the text of your records, to organise and search them.
• xAI (Grok): your prompts and working context, only when model routing directs a request to it.
• Hume AI: voice audio, for real-time scene-condition analysis in Scene Partner.
• ElevenLabs: text for the read-aloud voices, and clips you choose to auto-caption in the Editing Bay for transcription. It does not transcribe your self-tapes.
• Amazon Web Services (S3): storage for your uploaded recordings, audio, and documents.
• Railway: application hosting and the database holding your account and your work.
• TMDb: the titles of your résumé credits, to enrich them with production metadata. No personal information sent.
• Resend: your email address and message contents, for transactional and account email.
• Stripe: payment processing. We never store your card number.
• Sentry: error reports from the application and from your browser on this website, which may incidentally include identifiers such as your account id.
• Vercel: hosting for this website and the founding-membership page, and cookieless page-view and page-speed measurement on this website.
• Google: fonts loaded from Google Fonts, and sign-in if you choose to sign in with Google.
• Twilio: text messages, only if you turn on SMS.
• Your browser's speech service: if you use dictation, your browser sends your voice to its own speech recognition service.

We do not sell your personal information.

5. How It's Secured

Your data is encrypted in transit, and stored with infrastructure providers that encrypt it at rest. Authentication uses httpOnly cookies and hashed tokens, and every read and write is scoped to your account at the application layer. We conduct regular security reviews and maintain incident response procedures, though no method of electronic transmission or storage is completely secure, and we can't guarantee absolute security.

Most platforms bury this. We'd rather you read it.

Full legal terms: Privacy Policy · Terms of Service