Privacy notice

Last updated: 23 October 2026

This notice explains which personal data is processed when you visit this website or use the auria app, why that happens, and what rights you have.

The principle behind it is simple: auria earns money from the product, not from your data. There is no advertising, no cross-site tracking, no sharing with data brokers, and no selling of profiles. What we process, we need in order to run the service.

Controller

The controller within the meaning of Article 4(7) GDPR is:

uxflows UG (haftungsbeschränkt)
Auenstr. 134
80469 München
Germany

Email: hello@auria-app.de

Telephone: +49 151 29120669

Further details are given in our legal notice.

Data protection officer

We have not currently appointed a data protection officer. On our current assessment, the statutory appointment requirements do not apply; in particular, fewer than 20 people are permanently engaged in automated processing of personal data. We reassess this and the need for a data protection impact assessment when the product changes materially. For any data protection question, write to hello@auria-app.de.

When you visit this website

Server log files

When you open this website, your browser transmits technically necessary data that our host records in log files. A page cannot be delivered without them. Recorded are the IP address, date and time, the URL requested, the status code, the amount of data transferred, browser and operating-system identifiers, and, where applicable, the page previously visited.

The purpose is delivering the page, detecting faults, and defending against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in secure and functioning operation. This data is not combined with other sources and is not analysed on an individual basis. We create no separate copy or log drain. The logs remain available only for the standard runtime-log period of the active production hosting plan and are then removed automatically.

Cookies and browser storage

This website sets no cookies for advertising or analytics purposes. There is no analytics tool, no tracking pixel, no social media button, and no embedded third-party content.

Only strictly necessary cookies are set:

cc_cookie stores your choice in the consent dialog so that we do not have to ask again on every visit. Lifetime six months.
Operations portal session cookies are only for signed-in staff in the internal area. As an ordinary visitor to the website you never receive these cookies.

No consent is required for strictly necessary cookies (Section 25(2)(2) TDDDG). Should services requiring consent be added later, they will only run after your express agreement; the legal basis would then be Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR. You can change your choice at any time: .

Fonts

Plus Jakarta Sans is downloaded when the website is built and served from our own server. Visiting the website therefore creates no connection to Google, and your IP address is not transmitted to Google.

Waitlist

If you join the waitlist, we process your email address in order to notify you as soon as a place in the test phase opens up. We do nothing else with it: no newsletter, no advertising, no sharing.

Sign-up uses a double opt-in procedure. After you submit the form you receive a confirmation email; your address is only added to the list once you click the link inside it. If you do not respond, nothing happens. Our processor Brevo handles sending and managing the list. The legal basis is your consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time without giving reasons through the unsubscribe link in any email, or informally to hello@auria-app.de. The address is then deleted. We delete all entries at the latest when the waitlist ends.

Two safeguards keep the form from being abused by machines. The first is a field invisible to you and a check of how long the form was open. Neither uses a cookie or tracking, and nothing is stored. The second is a limit on attempts: for this we derive a one-way checksum from your email address and your IP address (HMAC-SHA256 with a server-side key) and count only those. The addresses themselves are not stored. The counters are deleted automatically after two days. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in preventing abuse.

When you use the auria app

Account and sign-in

For an account we process your first name or display name, your email address, and, if you sign in with a password, a password hash. The password itself is never stored in plain text. In addition, we record registration and most recent sign-in, your acceptance of the terms and test-phase conditions with version and timestamp, and your confirmation that the account holder is at least 18.

The legal basis is Article 6(1)(b) GDPR because the service cannot be provided without an account. We keep records of contract acceptance and the 18+ confirmation under Article 6(1)(b) and (f) GDPR; our legitimate interest is in being able to demonstrate the agreed and permitted account access.

Signing in with Apple or Google

Instead of email and password, you can sign in with Apple on iPhone and iPad and with Google on Android devices. Apple or Google carry out the sign-in itself as independent controllers, under their own privacy notices. An account you only use this way has no password with us.

From the provider we receive a signed sign-in token containing an identifier for your Apple or Google account and your email address. With Apple you can use a relay address instead (“Hide My Email”); Apple then forwards our emails to you. We use your first name as your display name as long as you have not chosen one yourself; you can change it at any time. Google’s token also contains your full name and the address of your profile picture. Our sign-in service discards this information before it is stored on our servers. We get no access to other Apple or Google services such as calendars, contacts, or files.

If an auria account with the same confirmed email address already exists, the sign-in is linked to that account; no second account is created.

When you sign in with Apple, we additionally store an access token from Apple. Its only purpose is to revoke auria’s connection with Apple when you delete your account. The app also remembers on your device that the session comes from an Apple sign-in and checks on opening whether you have removed auria’s access in your Apple ID settings; if so, it signs you out. We store no such token for Google.

The legal basis is Article 6(1)(b) GDPR. When you sign out, the app removes the sign-in state from your device. You can also remove auria’s access in your Apple or Google account at any time. Your auria account then continues to exist until you delete it; you can sign in with a new password via “Forgot password”.

Household, people, and content

In auria you create a household and, within it, people, appointments, tasks, routines, shopping lists, and meal plans. Profile pictures and notes are optional additions. You enter this content yourself; it is processed solely in order to display it to you and to the other members of your household.

So that auria can suggest frequently needed shopping items, the household keeps the name of items that were added, how often and when they were last on the list. This history belongs to the household and contains no reference to the person who entered an item. “Stop suggesting” deletes an entry immediately.

Every household is separated at the technical level: the database enforces through row-level security that an account can only see data from households it belongs to. This is not a setting in the interface but a rule inside the database itself. For data concerning account holders and signed-in users, the legal basis is Article 6(1)(b) GDPR. Where an entry concerns another household member without an account, the necessary processing is based on Article 6(1)(f) GDPR. Our legitimate interest and that of the household using the service lies in the expressly requested shared organisation. We give particular weight to children’s interests and therefore limit the feature to concise organisational information.

If you enter information about other people, such as a collection time for your child or a family member’s name, you decide what information to provide. Please respect the rights and interests of the people concerned and enter only what is necessary to organise your household. Our own data-protection obligations remain unaffected. Titles are free text and can reveal sensitive information despite the limited feature set. auria neither asks for special-category data under Article 9 GDPR nor infers health or other sensitive profiles. It is not intended for diagnoses, medication plans, religious or political information, or similarly sensitive details. Please keep organisational entries concise and do not use free-text fields for such information.

Connected families (Family Connect)

You can connect your household with another family, for example to coordinate shared events. A connection only exists once both families confirm it. You explicitly choose which people in your household become visible to the other family; their name and colour are shared. For people with their own account, this is the name they confirmed themselves under “What should we call you?”, otherwise the name used in your family. Newly added people are not included automatically. A connection does not give access to your private tasks, internal event notes, household address or dates of birth. Connections only exist between two directly connected families; nothing is passed on through a third family.

When you invite people to a shared event, the selected invitees receive its title, date and time, an optional meeting place and response deadline, and the note written expressly for guests. We store responses per person and event revision, and acknowledgements of notices per account. So that a notice can show what changed, we store the change with it: for the host, each person's response; for guests, the previous and new value of time, meeting place, title, guest note and response deadline. These details are deleted together with the notice; whoever makes a change gets no notice about it. For shared items to bring along, the host and guests with current confirmed attendance see the first name and household of the person claiming an item, even when the guests are not connected to each other. Your private tasks are not published as a result. With push notifications enabled, the message states the kind of news (such as “New reply”) and, if “Show content in notifications” is on, the title of the shared event, never names or notes; its technical navigation target contains notice, event and household identifiers and is transmitted with the notification to Expo and the platform push provider. The app checks access again when it is opened. When a family uses one of your invitation links, the adults of your household likewise receive a generic message without names; its navigation target contains only your household identifier.

Profile photos stay within your household by default. Adults decide only about their own photo. If you share it with connected families, this applies only to direct, confirmed connections for which you are selected, including future ones. Attending the same event is not enough. We currently do not share children’s photos with connected families; children appear there only with first name, colour and initials. You can withdraw a photo choice, change the selected people and end a connection at any time. The server then stops issuing new image addresses. Image addresses are valid for at most 60 seconds; however, we cannot reliably recall images another family has already viewed.

For account holders the legal basis is Article 6(1)(b) GDPR, because you expressly request and confirm the connection. For people in your household without their own account, in particular children, we base showing first name and colour on Article 6(1)(f) GDPR; our legitimate interest and that of the connected families lies in the shared organisation you want, and we therefore limit the information to this minimum. We store your photo decisions with time and text version as evidence.

Brain Dump and AI

Only with your separate permission, the text you typed or dictated in a Brain Dump is sent to our server function and from there to Google’s Gemini interface. What comes back is a structured suggestion that you can accept, adjust, or reject.

The text, current date, and time zone are transmitted so that “Thursday” can be placed correctly. Your own first name and the first names of mentioned active household members may be added with short-lived references and a self marker so auria can suggest an assignee. Your account email address, account identifier, and existing appointments and tasks are not added separately. Anything you enter in the text is, however, transmitted as part of that input. The model has no free access to your database and cannot create, change, or assign anything itself. An entry is created only after your express confirmation.

For data concerning the account holder, the legal basis is Article 6(1)(b) GDPR to perform the AI sorting you request. Where the text concerns other household members, the legitimate interest under Article 6(1)(f) GDPR described above also applies. Our AI transparency page explains this in more detail.

Your permission for AI sorting

You can optionally allow AI sorting during registration. The checkbox is initially empty and is not required to create an account. The server records your account, decision, information version and time, including subsequent changes, until account deletion. This supports operating the requested feature and enforcing your choice (Article 6(1)(b) and (f) GDPR). Your choice applies across devices and can be changed under Profile > Legal > AI sorting. Without current permission no Brain Dump is sent to Gemini, including after a pause in speech. After a withdrawal is confirmed, new model requests are blocked; inputs already transmitted and suggestions already created are not automatically recalled or deleted.

Country, time zone and relevant notices

Location settings follow your device time zone or your manual country/time-zone choice. We store the zone and its source with your account, derive the country to select regional notices and count their potential audience by country, and use local time for reminders and quiet hours. We do not collect GPS coordinates for this. The legal bases are Article 6(1)(b) GDPR for local-time functions and Article 6(1)(f) for relevant feature notices and internal audience planning. You can change these settings; account-related settings are deleted with the account.

Voice input

You can dictate a Brain Dump instead of typing it. The conversion from speech to text is handled by your operating system’s speech recognition: Apple’s on iPhone and iPad, Google’s on Android devices.

Depending on the device, language, and settings, that recognition happens on the device or on the respective provider’s servers. We cannot influence this and therefore do not promise you that the recording stays on your device. What happens to the voice data there is governed by Apple’s and Google’s own privacy notices. Only the finished text reaches us, never an audio recording, and we store no voice recordings. You grant microphone access in the operating system and can withdraw it there at any time. The text field always remains available.

Scanning QR codes

To join a family, you can scan the invitation QR code from the inviting member’s device instead of typing the code. The camera is evaluated for QR codes only, entirely on your device. No photo is taken, no image is stored, and none is transmitted to us or to anyone else.

Only the invitation token contained in the code reaches us — exactly the value you could also paste by hand. You grant camera access in the operating system and can withdraw it there at any time; entering a link or code always remains available.

Calendar subscriptions

You can add calendars from school, clubs, or your local authority, either through an address in ICS format or as an uploaded file. With an address, our server fetches the calendar regularly; the provider in question then learns our server’s IP address, not yours. The complete feed address is stored only in an isolated server area; the app shows only the provider. With an uploaded file, no later retrieval takes place and the file itself is not retained on our servers.

For each event, we import only its title, time, all-day flag, and location. Descriptions, attendees, organizers, attachments, and links are not imported. All adults in the household can see these events; children, teens, and helpers cannot. Please do not add calendars whose titles or locations contain sensitive information about other people.

For data concerning the person adding the calendar, the legal basis is Article 6(1)(b) GDPR. Where events contain information about other people, processing is based on our and your legitimate interest in shared household organization under Article 6(1)(f) GDPR. A subscription can be removed at any time; the events created from it and the stored feed address are then deleted. The same happens if the person who added it leaves the household, loses their adult role, or deletes their account.

Information for people named in imported events (Article 14 GDPR)

When someone adds an external calendar to auria, an event title or location may contain information about people who do not have an auria account. We receive this information from the calendar selected by an adult household member and process only title, time, all-day flag, and location for shared household organization. The legal basis is Article 6(1)(f) GDPR. The information is visible to the adults in that household and is stored by our processor Supabase in the Frankfurt EU region.

The information is deleted with the calendar subscription, including when it is removed, when the person who added it leaves or loses their adult role, or when their account is deleted. Data subjects can use the contact details above to request access, rectification, erasure, or restriction and to object to processing; they also have the right to lodge a complaint with a data protection authority. Because external calendars regularly contain no reliable contact details for every person named and individual notice may be impossible or disproportionate, we make this information publicly available.

Device calendars and Apple Calendar

On iPhone or iPad you can link individual calendars from your device (for example from iCloud, Google, or Exchange) to auria. auria only reads those calendars and takes over the title, time, all-day flag, and location of each event; notes, attendees, and links stay on your device. For each calendar you decide whether only you see the events, all adults in the household, or whether others merely see that you are busy. The default is “Only me”. Children, teens, and helpers never see linked device calendars. Which device calendar is meant is known only to your device; what we store on our servers are the events taken over, the name of the calendar and of its account, your own label and colour for it, and a device name.

The other way round, you can have your auria events copied into a separate “auria” calendar in Apple Calendar. This is a deliberate setting and is off to begin with. Title, time, and a link back to the event in auria are transferred. Optionally, your events appear there only as “Busy”, without the title. Notes are never transferred to Apple Calendar. The link contains technical identifiers (event, household, export scope) so that auria recognises its own copies. The transfer happens on your device; Apple processes the copies within your iCloud account as an independent provider under its own privacy notice. Anyone you share your iCloud calendar with sees the copies too. Adults in the same household can take the shared calendar into their own Apple Calendar this way.

The legal basis is Article 6(1)(b) GDPR, and Article 6(1)(f) GDPR for information about other people in events. If you deselect a calendar or remove its connection, we delete the events taken over immediately. If you disconnect the calendar on one device only, the events already taken over remain in the household. If you switch the export off, auria removes its copies from one month back to one year ahead; older copies stay in your Apple Calendar, and you can delete the “auria” calendar there. We cannot remove copies in Apple Calendar when an account is deleted; we point this out in the deletion dialog.

Push notifications

If you allow push notifications, your operating system issues a device token that we store in order to deliver notifications to you. Delivery runs through Expo’s push service to Apple or Google. If “Show content in notifications” is on under Notifications (the default), notifications may include: the title and due or reminder time of tasks and events, the title of one entry still open today and how many others remain, the display name of the person who says thanks, goes shopping, asks to join, invites you or has joined, the title of the task someone thanks you for, up to two titles of new tasks, shopping items or meals with the weekday and how many others there are, your family’s name for invitations and joining, the title of an event shared with connected families, and in the Morning Briefing the number of events, tasks and new entries and the time of the next event. These details are sent through Expo to Apple or Google for delivery. Content only goes to devices whose sign-in to auria still exists and was used within the last 14 days, and a family’s notifications only go to its current members. After signing out, a device no longer receives notifications for that account. If you signed out without an internet connection, the app completes this the next time it starts with a connection; until then, for at most 14 days, content may still arrive. With the setting off, every notification only states its kind (such as “Task due”). The technical navigation target may contain identifiers of the task, event, notice or household. Depending on your device settings, a notification may appear on the lock screen.

Older app versions may still schedule event reminders locally. During the move to server delivery, the app removes existing local reminders to avoid duplicates.

The legal basis is your consent under Article 6(1)(a) GDPR. You give it deliberately in auria by choosing ‘Sure’ or ‘Allow notifications’, then confirm the operating-system permission. We retain the time it is recorded, state and version of that choice as a consent record until account deletion. You can withdraw it at any time in your device settings. Once auria observes the changed system permission when you next open the app, the device token is disabled and no longer used for new notifications; disabled tokens are deleted within 30 days. Technical delivery receipts are retained for no more than 26 hours and content-free queue metadata for no more than 30 days.

Widgets

On iPhone and iPad you can add auria widgets. They show events, tasks, and routine steps with a time for today and tomorrow, as well as the open items on the shopping list. A widget shows only what you also see in the app: events that appear there only as “Busy” appear the same way in the widget, and only adults see the shopping list.

So that the widgets can show something without the app being open, auria places an excerpt on your device, in a storage area shared by the app and its widgets (an “App Group” in Apple’s terms). It contains the titles and times of entries, the titles of open shopping items, the initials and colours of the people involved, and small copies of their profile pictures where you also see them in the app. Notes, locations, and technical identifiers are not stored there. auria does not additionally encrypt this storage area; it is protected only by the safeguards of iOS or iPadOS on your device. auria places the excerpt there even if you have not added a widget, and updates it while the app is running; the widgets themselves fetch nothing. No additional data is sent to our servers or to third parties for this, and we do not measure whether or how you use widgets.

Depending on where you place them, the widgets appear on the Home Screen, on the Lock Screen, in StandBy, in CarPlay, or as iPhone widgets on your Mac desktop. Anyone looking at that screen can read what the widget shows. On the Lock Screen of a locked device, iOS hides titles and names; times and numbers remain visible.

The legal basis is Article 6(1)(b) GDPR, and Article 6(1)(f) GDPR for information about other people in entries. When you sign out or delete your account, auria replaces the stored excerpt with a prompt to sign in and deletes the profile pictures; profile pictures that are no longer needed are deleted at the next update. If you do not want to see the widgets, simply remove them from the screen.

App installation status

When you are signed in and open the app in the foreground, we store the last technical status of the installation: platform (iOS or Android), form factor (phone, tablet or unknown), app version, build number, the OTA runtime identifier, and the identifier and creation time of the app update currently running (or that the version shipped with the app is running). There is only one row per account; a new status overwrites the previous one. There is no history, no persistent device identifier, no device model and no IP address. The purpose is support, matching app updates, and linking technical errors to the installed binary. Processing is based on our legitimate interest in a reliable service under Article 6(1)(f) GDPR. The row is deleted with the account. The app can only write it, not read it; access is limited to administrators in the secured operations portal.

Technical diagnostics and security logs

When you are signed in, the auria app, our server-side functions, and the internal web portal may send technical errors and security-relevant events to our product database at Supabase. These events may include a pseudonymous account ID, timestamp, event type, a general error category and, where available, a standardized technical error code, app, runtime, build and platform version, and a session ID that is valid only for the current app launch.

Errors that occur during a failed request are also recorded: the name of the database table or server function involved, the HTTP status, and the technical error code. Errors arising in our server-side functions are recorded in the same way. If an event cannot be transmitted immediately, typically because the connection has dropped, it is held on your device for a short time and sent with the next app launch.

If the app reports an error or crashes, we add purely technical details needed to find the cause: the kind of error as a fixed category (for example “read a property of an empty value”), the location in the program code as line and column numbers, the open screen as a template without content (for example “appointment details”, never a specific appointment), the identifier of the running app update, the operating system’s major version (on Android, the API level), whether the app runs on a phone or tablet, how long it had been running and whether it was in the foreground or background. We do not transmit the wording of the error message. Connection failures that occur in quick succession are combined into a single event with counters; this includes whether the app was in the foreground or background, how long it had been running and how many requests failed across a background phase.

Task, appointment, shopping, meal, or Brain Dump content, passwords, authentication tokens, request headers, IP addresses, and persistent device identifiers are not logged. Text fields are additionally sanitized for common email addresses, phone numbers, URLs, UUIDs, and token patterns before transmission.

The purpose is to detect and resolve technical errors and protect the service. Processing is based on our legitimate interest in a secure and reliable service under Article 6(1)(f) GDPR. Technical events are automatically deleted after no more than 90 days. Diagnostic errors disappear immediately when the account is deleted. Short-lived security records remain without an account ID until the end of the 90-day period so an administrative account cannot erase its own MFA or sign-in trail by being deleted. App users cannot read them; access is limited to the secured operations portal. Its monitoring view shows only the number of accounts affected by an error. To handle a specific support request, an administrator can view that one account’s technical events on the account detail page: event name, route, app version, general error description, and standardized error codes. Every such access is recorded in the admin audit.

When an authorised person accesses an account in the internal operations portal or performs a support or security action, we record the time, acting administrator account, action type, target account or display name at that time, and a concise reason. Task, appointment, and Brain Dump content does not belong in this audit. The basis is our legitimate interest in access control, abuse investigation, and accountability for administrative actions under Article 6(1)(f) GDPR. Read-only access records are kept for no more than twelve months and interventions for no more than 36 months. Evidence of a deletion may therefore remain without access to the deleted product content.

Internal usage statistics

To understand which auria features are actually used, we evaluate data that is created in our Supabase product database anyway when the service runs. We collect nothing extra for this: there is no analytics or tracking tool in the app or on the website, nothing is stored on or read from your devices for this purpose, and no third party receives any data.

We only count that something happened, for example that a meal was planned, a shopping item was added or ticked off, a task was completed, or a Brain Dump was sorted. This uses the time and the pseudonymous account and household ID already attached to those entries. Titles, notes, shopping items, and appointment or Brain Dump content are not included. We also count how many accounts and households have push notifications and calendar connections switched on.

The counting runs entirely inside the database. The only output is totals per feature: the number of actions, households, and accounts. Once a day we record these totals per day as plain numbers without names, content, or account or household identifiers. The daily figures do not reveal who used what, so they remain even when the underlying entries or your account are deleted. Only the auria team sees the statistics, in the secured operations portal. We do not build profiles from them or make decisions about individuals.

Separately from the statistics, the operations portal shows support staff, per account and household, when something was last created, how many entries there are, and how an account signs in (email, Apple, or Google), always without content. Opening an individual account or household is recorded in the admin audit.

The legal basis is our legitimate interest in developing auria based on how it is actually used and in planning its operation (Article 6(1)(f) GDPR). Because only existing metadata is counted and the result does not relate to any person, the evaluation affects your interests only minimally. If you object, we remove your account from the counting; daily figures already recorded contain no link to you and remain unchanged.

Feedback through Help & Feedback

Via ‘Help & feedback’ in your profile you can voluntarily send us a short text. Together with the text we store your account ID, language, app version with build number and further technical version details of the app, device type, operating-system version and a session ID that is valid only for the current app launch. No persistent device identifier, IP address or household content is recorded.

Only the auria team reads your feedback, in the internal operations portal. There we record its processing status and can add an internal note. We do not pass the text on to third parties, and it is not analysed automatically.

The legal basis is Article 6(1)(b) GDPR to handle your request about the service. Please do not include details about other people. We delete your feedback no later than twelve months after it has been dealt with, and in any case after no more than 24 months. If you delete your account, it is deleted immediately along with it.

System emails

We only send messages that are necessary to operate your account: registration confirmation, password reset, sign-in codes, changes to your email address, household invitations, and notices about security-relevant events. The legal basis is Article 6(1)(b) GDPR. There is no newsletter and there are no marketing emails.

Children and young people

Holding an auria login account requires a minimum age of 18. This applies to the whole account and therefore also to access to the AI-assisted Brain Dump. Parental consent does not replace this requirement.

Children can be added to a household as a person without an account of their own. Those details are managed by the responsible adult in the household, who decides what is entered and can change or delete it at any time. We do not create login accounts for minors.

Where your data is processed

Your entries, your account, and uploaded images are stored in Frankfurt am Main, Germany: the app’s database and file storage are hosted by Supabase in the eu-central-1 region.

For individual features we involve services that may also process data outside the European Union:

Voice input: Apple’s or Google’s speech recognition turns your words into text, on the device or on the provider’s servers depending on the device and language.
Brain Dump: the text goes to Google’s Gemini API, which turns it into a suggestion.
Push notifications: Expo (United States) forwards them to Apple or Google, which deliver them to your device.
App updates: Expo (United States) delivers updates to the app.
Sign in with Apple or Google, and installation via the App Store and Google Play.

Even with the providers in Frankfurt, support, maintenance, or individual platform services may involve processing outside the EU; this is noted for each provider. What data a service receives and how the transfer is safeguarded is described above for each feature and in the next section.

Who we involve

We use carefully selected service providers. Where a provider acts as our processor, we put the agreement required by Article 28 GDPR in place. The list below reflects the currently intended product operation and is updated when it changes.