What is held, and what is not.

Stripe, and Supabase.

Payment is taken by Stripe, on Stripe's own pages. Your card number, billing address and payment method are given to Stripe and are never held by Aurith — there is no card data anywhere in this system to lose. Stripe acts as a processor and has its own privacy notice, which governs what it does with what you give it.

Your card is kept, and it is charged again. This is a subscription, so when you pay, Stripe stores your payment method and charges it automatically at the start of each period — every month, or every year — until you cancel. Nobody asks you again each time, and that is the point of it. The card is held by Stripe, not by Aurith; what Aurith holds is a Stripe identifier for you, which is useless to anyone else.

Cancelling is immediate, from your side. Send GET /v1/portal with your API key and it hands back a link to Stripe's own page, where you can change the card, read every invoice, or cancel. There is no notice period, nothing to email, and no telephone call. When you cancel, Stripe stops charging, and your key keeps working to the end of the period you have paid for — then stops.

When a subscription starts, changes or ends, Stripe tells Aurith. The account email and Stripe identifier are used to turn a key on and off.

Supabase holds the sign-in. The email address, password, name, business name (optional), country, state/province and phone number behind an account live with Supabase, which acts as a processor for Aurith just as Stripe does, under its own privacy notice. Aurith never sees the password. Everything else about an account — the plan or packs bought, your feed settings, your API keys (kept only as a one-way hash, so a key is shown once and never again) and how many calls each key has made — is kept on Aurith’s own server.

There is no analytics, no advertising network, no content delivery network and no third-party font. The public pages make no request to anyone but Aurith. Account pages talk to Supabase for sign-in, and payments go through Stripe; Supabase and Stripe process data for Aurith.

The "Ask Aurith" assistant runs on Aurith's own server and stores nothing. What you type stays on that server — no other company sees it — and is gone when you close the browser tab. Don't type passwords, card numbers or API keys into it; it never needs them.

• No analytics, no tracking, no advertising This site carries no analytics, no advertising and no tracker, and embeds nothing that reports back. The only thing kept on your device is your sign-in session, so that you stay signed in — sign out and it is gone. There is no consent banner because there is nothing to consent to.
• Nothing is sold; processors are named We do not sell personal information. Supabase processes sign-in data and Stripe processes payments for Aurith; data is shared with them only as needed to provide the service, not with advertisers or data brokers.
• Ask and it is deleted One email, no form, no reason required.

What is held, and why.

The web host keeps standard server logs, including IP addresses, as every web host does. Those are the host's, are used to keep the server running and to stop abuse, and are not read by Aurith for any other purpose. No IP address is recorded against your account.

Account details, access and settings.

Accounts are held by Supabase, which runs the sign-in and the database behind the account pages. The account record also holds the full name, business name (optional), country, state/province and phone number you gave at sign-up, stored together with the sign-in record at Supabase. Aurith never sees the password — it is sent straight to Supabase, which keeps only a hash of it — and nobody at Aurith can read it or recover it for you. This account information is used only to run the account, answer billing questions and contact the customer about their account.

To enforce the refund limit we may check whether a new account belongs to someone already refunded, using the name, email, phone and card details we and Stripe already hold.

Your settings are what you told Aurith to send: the regions, categories, topics, sources and languages you chose, and the three release times in Toronto time. That is the whole of it, and it exists only so the feed can be built for you.

Plans and packs are recorded so an account knows what it is entitled to. API keys are shown once, when they are made, and only a hash is kept afterwards — the key itself is never stored and cannot be shown again. What is kept per key is how many calls it has made and when it was last used, so the published rate can be enforced and a stray key noticed.

Aurith's own server holds the email address on the account, the plan and packs, the hashed keys, the feed settings and the per-key usage counts above. Supabase holds the sign-in record and the name, business name (optional), country, state/province and phone number given at sign-up. The news itself carries nothing about you, and reading the feed tells Aurith no more than that a key made a request. None of this account information is sold. It is shared only with the processors already named: Supabase and Stripe.

Deleting an account.

Email hello@aurith.ca and it is done: the account and its settings are deleted, and every key on it is revoked at once. One thing stays behind — Stripe keeps the invoices and payment records for the periods you paid, as tax and accounting law requires. That record is Stripe's, holds no card number Aurith can read, and is the only part of a closed account that remains.

A single key can be revoked, and any setting changed, at any time from the account pages, without asking anyone.

Canadian law, used worldwide.

Aurith operates from Canada and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). The site is reachable from anywhere, and the rights below are offered to everyone who uses it regardless of where they are.

• Know Ask what is held about you and you will be told, in plain words, within thirty days.
• Correct Anything wrong is fixed on request.
• Delete Ask and it goes, unless a law requires a business record to be kept — in which case you are told which record and why.
• Take it with you Whatever is held about you, in a plain machine-readable file, on request.
• Withdraw consent At any time, for anything not required to run a service you are paying for.
• Complain To Aurith first, and to the Office of the Privacy Commissioner of Canada if the answer is unsatisfactory.

One address.

hello@aurith.ca — Aurith handles privacy requests directly.

If this page changes materially, the date at the top changes and anyone holding a key is told what moved.