What is held, and what is not.

Stripe, and Supabase.

Payment is taken by Stripe, on Stripe's own pages. Your card number, billing address and payment method are given to Stripe and are never held by Aurith — there is no card data anywhere in this system to lose. Stripe acts as a processor and has its own privacy notice, which governs what it does with what you give it.

Your card is kept, and it is charged again. This is a subscription, so when you pay, Stripe stores your payment method and charges it automatically at the start of each period — every month, or every year — until you cancel. Nobody asks you again each time, and that is the point of it. The card is held by Stripe, not by Aurith; what Aurith holds is a Stripe identifier for you, which is useless to anyone else.

Cancelling is immediate, from your side. Send GET /v1/portal with your API key and it hands back a link to Stripe's own page, where you can change the card, read every invoice, or cancel. There is no notice period, nothing to email, and no telephone call. When you cancel, Stripe stops charging, and your key keeps working to the end of the period you have paid for — then stops.

Aurith is told only that a subscription started, changed or ended, and the email address on it. That is what turns a key on and off.

Supabase holds the sign-in. The email address and password behind an account live with Supabase, which acts as a processor for Aurith just as Stripe does, under its own privacy notice. Aurith never sees the password. Everything else about an account — the plan or packs bought, your feed settings, your API keys (kept only as a one-way hash, so a key is shown once and never again) and how many calls each key has made — is kept on Aurith’s own server.

There is no analytics, no advertising network, no content delivery network and no third-party font. The public pages make no request to anyone but Aurith. The account pages talk to Supabase to sign you in — that is the only other place a request goes.

• No analytics, no tracking, no advertising This site carries no analytics, no advertising and no tracker, and embeds nothing that reports back. The only thing kept on your device is your sign-in session, so that you stay signed in — sign out and it is gone. There is no consent banner because there is nothing to consent to.
• Nothing is sold or shared Not to advertisers, not to data brokers, not to anyone. There is no arrangement under which this could change without this page changing first.
• Ask and it is deleted One email, no form, no reason required.

What is held, and why.

The web host keeps standard server logs, including IP addresses, as every web host does. Those are the host's, are used to keep the server running and to stop abuse, and are not read by Aurith for any other purpose. No IP address is recorded against your account.

An email, a password, and your settings.

Accounts are held by Supabase, which runs the sign-in and the database behind the account pages. Your email address and password are stored there. Aurith never sees the password — it is sent straight to Supabase, which keeps only a hash of it — and nobody at Aurith can read it or recover it for you.

Your settings are what you told Aurith to send: the regions, categories, topics, sources and languages you chose, and the three release times in Toronto time. That is the whole of it, and it exists only so the feed can be built for you.

Plans and packs are recorded so an account knows what it is entitled to. API keys are shown once, when they are made, and only a hash is kept afterwards — the key itself is never stored and cannot be shown again. What is kept per key is how many calls it has made and when it was last used, so the published rate can be enforced and a stray key noticed.

Aurith's own server holds the email address on the account, the plan and packs, the hashed keys, the feed settings and the per-key usage counts above. Nothing else — the news itself carries nothing about you, and reading the feed tells Aurith no more than that a key made a request.

Deleting an account.

Email hello@aurith.ca and it is done: the account and its settings are deleted, and every key on it is revoked at once. One thing stays behind — Stripe keeps the invoices and payment records for the periods you paid, as tax and accounting law requires. That record is Stripe's, holds no card number Aurith can read, and is the only part of a closed account that remains.

A single key can be revoked, and any setting changed, at any time from the account pages, without asking anyone.

Canadian law, used worldwide.

Aurith operates from Canada and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). The site is reachable from anywhere, and the rights below are offered to everyone who uses it regardless of where they are.

• Know Ask what is held about you and you will be told, in plain words, within thirty days.
• Correct Anything wrong is fixed on request.
• Delete Ask and it goes, unless a law requires a business record to be kept — in which case you are told which record and why.
• Take it with you Whatever is held about you, in a plain machine-readable file, on request.
• Withdraw consent At any time, for anything not required to run a service you are paying for.
• Complain To Aurith first, and to the Office of the Privacy Commissioner of Canada if the answer is unsatisfactory.

One address.

hello@aurith.ca — it reaches the person who runs Aurith, who is also the person who would action the request. There is no privacy department to be forwarded to.

If this page changes materially, the date at the top changes and anyone holding a key is told what moved.