Legal

Privacy Policy

Last updated: September 12, 2026 · Operated from Alberta, Canada

This Privacy Policy explains how Aurai ("Aurai", "we", "us" or "our") collects, uses, discloses and protects personal information when you use the Aurai website at aurai.boo, the Aurai web app at app.aurai.boo, the Aurai apps for iPhone, Windows and Mac, and related services (together, the "Service"). Aurai is operated from Alberta, Canada, and handles personal information in accordance with applicable Canadian privacy law, including Alberta's Personal Information Protection Act and, where it applies, the federal Personal Information Protection and Electronic Documents Act.

By using the Service, you acknowledge that your personal information will be handled as described in this policy. If you do not agree, please do not use the Service.

1. Information we collect

Information you give us

Account information — your name and email address. If you sign in with an email and password, your password is stored only as a secure one-way hash. If you choose Google or Apple sign-in, we receive the name, email address and (where provided) profile image that you allow that provider to share.
Content you create — the information you enter into Aurai, such as habits, plans and schedules, captures and tasks, notes, nutrition and meal records, financial records you enter manually, goals, settings, and your conversations with Ori, Aurai's assistant.
AI provider keys — if you add your own OpenAI or OpenRouter API key, it is encrypted before it is stored and is never included in data exports.
Messages to us — the name, email address and message you submit through our contact, support, access-request or waitlist forms, and any details you choose to include in an issue report (which may include the Ori conversation you are reporting).

Information collected automatically

Technical information — IP address, browser or device type (user agent), app version, timestamps and similar request information, used to operate the Service, keep you signed in, prevent abuse and diagnose problems.
Cookies and local storage — we use strictly necessary cookies to keep you signed in and to remember that you have entered the website's preview code, and your browser or app storage to remember preferences such as theme and layout. On iPhone, your sign-in session is kept in the device Keychain. We do not use advertising cookies or third-party analytics or tracking.
Bot protection — our forms use Cloudflare Turnstile, which processes information about your browser to tell people from automated abuse.

Information that stays on your device

Apple Health, Calendar and Reminders (iPhone) — these integrations are off until you turn them on and grant permission in iOS. When enabled, the data is read and displayed on your device only. It is not sent to or stored on Aurai's servers, is not used for advertising, and is never sold or shared. You can revoke access at any time in iOS Settings.
Voice input — Aurai never receives your audio, only the text. In the iPhone app, your iPhone's own speech recognition turns speech into text, on the phone whenever your language allows. In the Windows and Mac apps, a speech model downloaded once to your computer does it, and the audio never leaves your computer. In a web browser, the browser's built-in speech recognition does it (for example Apple in Safari, or Google in Chrome), under that provider's own privacy terms. The microphone is used only while you are dictating.
Desktop apps — if you keep Ori on your desktop, the Windows or Mac app checks how long your computer has been idle so Ori can rest while you are away. That check happens on your computer and is not recorded or sent anywhere.

2. How we use information

We use personal information only for the purposes described here, or for purposes a reasonable person would consider appropriate in the circumstances:

to create and secure your account, and to provide, sync and maintain the Service across your devices;
to provide the AI features you choose to use;
to manage access during private beta, including access requests and the waitlist;
to respond to support requests, contact messages and issue reports;
to send service emails, such as email verification, password resets and replies to your requests;
to protect the Service and its users, including preventing fraud, abuse and unauthorized access;
to diagnose problems and improve reliability; and
to comply with legal obligations.

We send marketing or product-update emails only if you have opted in, and you can opt out at any time. We do not sell or rent personal information, and we do not use it for advertising.

3. AI features

AI features are optional. When you use them — for example chatting with Ori or asking Aurai to organize a capture — the text of your request, and the parts of your Aurai content needed to answer it, are sent to the AI provider that processes the request: OpenAI or OpenRouter, using your own key, or OpenAI where Aurai provides the key. OpenRouter may route a request to the model provider you selected. These providers process the information under their own terms and privacy policies. Please avoid including information in a request that you do not want an AI provider to process.

4. How we share information

We share personal information only as follows:

Service providers who process it on our behalf to run the Service: Fly.io (application hosting and database), Cloudflare (website hosting, bot protection and backup storage), and Resend (sending service emails). They may use it only to provide their services to us.
Providers you choose to use: Google or Apple, if you use their sign-in; OpenAI or OpenRouter, if you use AI features; and, if paid plans are offered in future, Stripe to process payments.
Legal and safety reasons: where required or permitted by law, such as to respond to a lawful request, or to protect the rights, property or safety of Aurai, our users or others.
Business transfers: in connection with a sale, merger or reorganization of the Service, subject to this policy.
With your consent or at your direction.

5. Where information is stored

Aurai is operated from Canada, but our service providers store and process information in other countries, including the United States. Aurai's application database is hosted in the United States. Information held in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities. By using the Service, you acknowledge this transfer.

6. How long we keep information

Account information and content are kept while your account is active.
When you delete your account, your account and content are removed from the live database immediately. Copies in routine backups are deleted automatically as those backups rotate out, normally within about seven days.
Contact, support, access-request and waitlist submissions are kept for as long as needed to respond and to manage access, and then deleted. You can ask us to delete them sooner.
We may keep limited information longer where the law requires it or to resolve disputes and enforce our agreements.

7. Your choices and rights

Subject to applicable law, you may ask to access the personal information we hold about you, ask us to correct it, withdraw your consent to its use (which may mean we can no longer provide the Service), or ask us to delete it. You can do much of this yourself:

Export your data — Settings → Account → Export data downloads all of your Aurai content in a single file.
Correct your data — most information can be edited directly in the app.
Delete your account — Settings → Account → Delete account permanently erases your account and content. This cannot be undone, so export first if you want a copy.
Device permissions — microphone, Health, Calendar, Reminders and notification access can be turned off at any time in your device settings.

For any other request, use the contact form. We will respond within the time required by law, normally 30 days, and may need to verify your identity first. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

If you live outside Canada, you may have additional rights under the laws where you live. We will honour requests made under those laws where they apply to us.

8. Security

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit (HTTPS), encryption of stored AI provider keys, hashed passwords, authenticated sessions, access controls, rate limiting, and regular backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security creates a real risk of significant harm to you, we will notify you and the appropriate regulator as required by law.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, if the changes are significant, give reasonable notice — for example by email or in the app — before they take effect.

11. Contact us

Questions, requests or complaints about this policy or our privacy practices can be sent to Aurai's privacy contact through the contact form; choose "My data & privacy" as the reason.