Privacy notice
Not yet reviewed by a lawyer. This page explains in plain words how Aurnis works and what you can expect. It will be reviewed and may change before paid plans or public launch; if it changes in a way that matters to you, we will tell you.
1. Who is responsible for your data
Aurnis, a business operating in India under the name Aurnis (company registration is in progress), India (the registered address will be published here once the company is registered) (“Aurnis”, “we”) decides how and why your personal data is used for your account and the service. This is called being the “controller”. You can reach us about privacy at privacy@aurnis.com.
The people in your space also see some of your data, and the Space admin and leaders decide how the space is run. They are not Aurnis staff. Aurnis is built for personal and household use; if someone uses it to run a business, that person is responsible for their own use of other people’s data.
Representatives, where required: EU: none appointed (Aurnis is not offered in the EU at launch). UK: none appointed (Aurnis is not offered in the UK at launch).
2. The short version
- We collect what is needed to run a shared record of money and chores: your account details and what you and your housemates enter.
- We do not sell your data. We do not show ads. We do not use advertising or tracking cookies, and we do not use third-party analytics.
- We never hold or move your money.
- Aurnis is for adults (18 and over).
- You can download your data and delete your account yourself, in Settings.
3. What we collect
You give us
- Account: email address, password (we store only a protected, one-way scrambled version), display name, @username, optionally a photo, and the confirmation that you are 18 or over, with the time and the version of the terms you accepted. Optional two-step sign-in (authenticator) details.
- What you and your space enter: bills, amounts and who owes what, payment claims and confirmations (including a method label such as “cash” and any note), chores and tasks, swaps, house rules, penalties and the reasons for them (if your space uses them), key dates, shopping lists, notes and reminders, statements, and roles.
- Files you choose to upload: photos as proof that a chore was done, and documents such as a lease. Please upload only what other members need to see.
- Messages and requests: what you send to us for support.
- Early-access list: your email address, the page you signed up from, and a scrambled (hashed) form of your network address that we use only to stop abuse and clear after 7 days.
We create or receive
- Activity records: an audit log of important actions in a space (who did what, and when), and short-lived records of sign-in and code attempts that protect against guessing.
- Notification settings and device addresses: your choices, and, if you allow notifications on a device, the address your browser gives us to reach it.
- Password safety check: when you choose a password, we send the first 5 characters of a one-way hash of it (not the password, and not your email) to the Have I Been Pwned service to see whether it appeared in a data breach. If the service is unavailable we skip the check.
- Technical data: like every website, our hosting and security providers process your network address and browser details when you connect, to deliver the service and to protect it from attacks. We do not use this to profile you.
- About you from others: when someone invites you, or adds you to a space, we receive your email address or name from them.
- Billing: if you buy a paid plan, our payment provider processes your payment details. We receive the plan, status and dates, not your full card number.
What we do not collect
We do not collect your date of birth, location, contacts, government ID, health information, or advertising identifiers, and we do not use cookies or tools that follow you across other websites. A phone number can be stored in the account but is not requested today; if that changes we will ask for your consent first.
4. Why we use it, and our legal basis
| What we do | Why | Legal basis (where such a basis is required) |
|---|---|---|
| Create and secure your account; run your space; show members what their roles allow; produce statements | To provide the service you asked for | Contract |
| Send service messages: sign-in and security emails, invites, bills due, statements ready, reminders you set | To make the service work | Contract; our legitimate interest in keeping you informed |
| Send push notifications to a device | Only if you allow them in your browser | Consent, which you can withdraw at any time |
| Keep the audit log; limit sign-in and code attempts; detect abuse and attacks | Security, fraud prevention, settling disputes between members | Legitimate interests |
| Early-access list emails | To tell you when Aurnis opens | Consent, withdrawn with the unsubscribe link |
| Confirm your age and keep a record of the terms you accepted | To show we meet our legal duties | Legal obligation; legitimate interests |
| Billing and tax records, if you buy a paid plan | To take payment and obey tax law | Contract; legal obligation |
| Improve Aurnis using counts from our own database (for example, how many spaces finished setup) | To fix confusing steps | Legitimate interests. These counts are not tied to what you personally entered, and are not shared with anyone |
| Respond to the law, courts and regulators; protect our rights | To meet legal duties | Legal obligation; legitimate interests |
5. Who sees it
- Other members of your space, as the roles allow. Everyone in a space sees its shared bills, chores and rules. Leaders can see each member’s balance and statement. Your name, @username and photo are shown to the people you share a space with.
- Companies that process data for us (section 6), only to provide the service, under contracts that limit what they can do with it.
- Authorities, courts and advisers, when the law requires it, or to protect people from harm or to establish or defend legal claims. We tell you first where we are allowed to.
- A buyer, if Aurnis is sold or merges, under the same promises as this notice.
- No one else. We do not sell or rent personal data, and we do not share it for advertising.
6. Companies that help us run Aurnis
These “processors” handle data on our behalf. The current list, with what each does and where, is on the Sub-processors page: database, sign-in and file storage; hosting and network security; transactional email; a password breach check; browser push services (only if you allow notifications); and the payment provider, once paid plans open.
7. Where your data goes
Your data is stored in the cloud region where our database is hosted, which we will name here once production is set up. Our providers may process data in other countries. Where the law restricts transfers (for example from the EU, UK or Switzerland), we rely on the safeguards the law accepts, such as the standard contractual clauses in our providers’ agreements, and we choose providers that offer them.
8. How long we keep it
| Data | How long |
|---|---|
| A space’s money history, chores, rules, lists and statements | While the space exists. Deleted 30 days after the space is deleted. |
| Your account (name, @username, photo, settings) | Until you delete it. After you ask, you have 30 days to change your mind, then your identity is removed and your name on shared records becomes “Former member”. |
| Records in a shared space that mention you | They stay, because other members’ balances depend on them, but are no longer linked to your name once your account is deleted. |
| Proof photos | The file is deleted 90 days after upload. |
| Documents (such as a lease) | While the space exists, or until a leader removes them. |
| Notifications | 90 days after they are sent. |
| Invites | 30 days after they are used, expire or are cancelled. |
| Sign-in and code attempt records | 7 days. |
| Audit log of actions in a space | 3 years. |
| Early-access list | Until you unsubscribe. The scrambled network address is cleared after 7 days. |
| Spaces nobody uses | We warn the owner after 18 months of no activity and close the space after 24 months if it is still unused. |
| Billing records | As long as tax and accounting law requires (often 6 to 7 years), held by our payment provider and us. |
| Backups | Deleted data can remain in backups until they expire, within 30 days. We do not use backups for anything else. |
9. Your rights and choices
For everyone. In Settings you can see and change your details, download a copy of your data, manage notifications, and delete your account. Space leaders on a paid plan can also export a whole space. You can unsubscribe from any marketing email with the link in it. To use any other right below, write to privacy@aurnis.com. We may need to check it is you, and we answer within one month (45 days in some US states), and we do not charge for reasonable requests.
If the GDPR or UK GDPR applies to you (for example you live in the EU, the UK or Switzerland), you may also ask us to: access your data; correct it; erase it; restrict or object to how we use it; and move it to another service. Where we use your consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object. You can complain to your data protection authority (in the UK, the Information Commissioner’s Office).
If you live in a US state with a privacy law (for example California, Colorado, Connecticut, Virginia, Texas), you may ask to know, access, correct, delete and receive a copy of your personal information, and to appeal a refusal. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling, so there is nothing to opt out of. We do not treat you differently for using your rights. Where a law lets you use an authorised agent, we accept requests from one with proof of authority.
If you live in India, the Digital Personal Data Protection Act, 2023 applies to us as a “data fiduciary”. You may ask to see a summary of the personal data we hold and how it is used, to correct or complete it, to have it erased once it is no longer needed, to nominate someone to act for you if you cannot, and to have any complaint heard. Our grievance contact is Aurnis, privacy@aurnis.com; we acknowledge a complaint within 3 working days and aim to resolve it within 30 days. If we have not resolved it, you may complain to the Data Protection Board of India. We use your data only for the purposes in this notice, with your consent or for the lawful uses the Act allows, and we ask for a parent’s consent for no one because the service is for adults only.
If you live in Canada, you may ask to access and correct your information and to withdraw consent, and you may complain to the Office of the Privacy Commissioner of Canada or your provincial authority.
About other people’s data in a space. If you ask about information that other members entered, we will explain what we can without exposing their data. Disputes between members about what is on the shared record are for them and their space’s leaders to settle.
10. Children and age
Aurnis is for people aged 18 and over. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a child has an account, write to privacy@aurnis.com. We will suspend the account and delete the child’s information promptly. If you add information about a child to a space (for example a photo), that breaks our terms; please do not.
11. How we protect it
- Data is encrypted in transit, and stored with access rules in the database that limit each person to their own space and role, tested automatically.
- Files are kept in private storage and opened only through short-lived links for people allowed to see them.
- Sensitive actions need you to sign in again. Optional two-step sign-in is available. Our staff area is restricted and requires a second factor.
- We limit guessing attempts, keep an audit trail, and delete data on a schedule (section 8).
- If a breach puts your data at risk, we will tell you and the authorities as the law requires, and as fast as we can.
No system is perfectly secure. To report a weakness, see Security.
12. Cookies and similar storage
We use only what is needed to keep you signed in and to remember your choices (for example light or dark theme and the space you opened last). We do not use advertising, analytics or tracking cookies, so there is no cookie banner. The full list is on the Cookies and storage page.
13. Email and notifications
Service emails (sign-in, security, invites, bills, statements, reminders) are part of the service. Early-access and marketing emails are sent only to people who asked for them, and every one has an unsubscribe link. Push notifications are sent only to devices where you allowed them, and you can turn them off in Settings or in your browser.
14. Changes to this notice
If we change this notice in a way that matters, we will tell you by email or in the app before it takes effect. The version number and effective date are at the top.
15. Contact and complaints
Aurnis, India (the registered address will be published here once the company is registered). Privacy questions and requests: privacy@aurnis.com. If we have not solved your concern, you may complain to your local data protection authority.