How to reach a human.

This is the most serious thing that can happen in Aura, so it is first on the page.

A safety number is a fingerprint of the keys you and the other person are actually using. If you compare it in person or over a channel you trust and even one digit differs, one of two things is true: either they reinstalled or added a device — the common, harmless case — or someone is sitting between you.

Do this:

1. Do not mark the contact as verified. That is the one action that is hard to walk back.
2. Stop sending anything sensitive in that conversation until it is resolved.
3. Ask them, on a different channel — a phone call, in person, another app — whether they recently reinstalled Aura, got a new phone, or added a device. That explains almost every mismatch.
4. If they say they did not, and the number still does not match, treat the conversation as compromised: assume it has been read, and do not use it to sort the problem out.
5. Then tell us, with the detail below.

Report an unexplained mismatch to: [email protected] (subject: "Safety number mismatch")

Include your own display name, when the mismatch appeared, and whether the other person has confirmed they did not change devices. Do not send us the message contents — we do not need them, and on Android and desktop we could not read them anyway.

Report to: [email protected] (subject: "Security vulnerability report"). The machine-readable version of this section is published at /.well-known/security.txt.

What helps: the affected surface (Android, desktop, hosted web, or the server), a description of the issue, and the steps to reproduce it. A proof of concept is welcome; a video is usually less useful than a short written sequence.

Our side of the bargain. We will acknowledge a report within 7 days and tell you what we intend to do about it within 30. We will not threaten or pursue legal action against anyone who reports in good faith, stays within their own accounts and test data, does not degrade the service for others, and gives us a reasonable window before publishing. We have no bug bounty and no money to offer; we will credit you if you want to be credited.

The in-app route is better and faster where it exists, because it attaches the account context automatically:

• Android, one-to-one chats: report and block from the conversation, or from the Safety Center in Settings. Blocking takes effect immediately, whether or not you also report.
• Android, group threads: there is no report button inside a group today. Report the person from a one-to-one chat with them, or from the Safety Center.
• Hosted web and desktop: there is no report or block control in the interface at all. Use the address below, or report from an Android device on the same account.

Where the in-app route does not cover your case: [email protected] (subject: "Abuse report")

Be aware of what we can and cannot act on. On Android and desktop we cannot read the message you are reporting — we hold only ciphertext — so a report is your account of what happened plus the metadata we can see, and we will act on that or not act at all. We will never ask you to send us decrypted message content as a condition of taking a report seriously.

If you have filed a report and disagree with the outcome, an appeal route exists and is handled server-side.

If someone is in immediate physical danger, contact your local emergency services first. We are not an emergency service, we have no ability to locate a user, and we should not be the first call.

Access, portability, correction, erasure, restriction, objection, or a complaint about how we handled any of those: [email protected] (subject: "Privacy request")

Before you write: access and erasure are self-service on Android and are instant — Settings → Export my data, and Settings → Delete my account. The privacy policy describes exactly what each contains.

We aim to respond within one month, the statutory period. One limit worth knowing in advance: we hold no email address or phone number for you, so we have no way to verify a request that does not come from an authenticated Aura device. We will ask for something only the account holder could know, and where we cannot establish that a request is genuine we will decline it rather than hand over or destroy someone's account on an unverifiable claim.

Deletion has its own page with the full steps and consequences: delete your account.

Lost your recovery key or your only device? Then your account is unrecoverable, and there is nothing we can do about it. This is not a policy we could waive — we never had your keys, so there is no reset to perform and no backdoor to use on your behalf. Contacting us will not change the answer, and we would rather you read that here than spend a week hoping.

Anything else about an account: [email protected]

Bugs, questions, feedback, business enquiries, press: [email protected], or by phone at +977 985 603 4616.

Questions about the terms of service go to the legal contact named on that page.

For installation trouble, the downloads page covers the two problems people actually hit: macOS refusing to open an unsigned build, and Android's warnings when installing an APK from outside the Play Store.

Stated up front so you do not spend time on a request that has no possible outcome:

• Recovering a lost account, passphrase or recovery key. We do not hold the material required. There is no exception.
• Retrieving your old messages. On Android and desktop we hold only ciphertext we cannot open, and delivered messages are pruned from the server 30 days after your device collects them.
• Reading, restoring or moderating message content on Android or desktop. We do not have it.
• Removing a message from someone else's device. Once it has been delivered and decrypted, it is theirs. No messaging system can recall that, whatever it claims.
• Unblocking yourself from someone's account. Blocking is the recipient's decision and we do not override it.