Privacy Policy

Last updated: March 10, 2026

Aria ("we," "us," or "our") operates the Aria mobile application and website. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our services.

1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, username, and optional profile information (bio, social links, avatar). Authentication is handled by Supabase.

Audio Data

During live sessions, audio is streamed in real-time through LiveKit. Audio is ephemeral — it is not stored after the session ends unless the session is explicitly recorded (stage sessions only, with participant consent). Recorded sessions are retained for up to 90 days.

Chat Messages

Messages sent in session chat are transmitted in real-time. Non-flagged messages are not persisted on our servers after the session ends. Messages flagged by our automated safety systems may be retained in moderation logs for up to 90 days for safety review, after which they are deleted.

AI-Generated Content

Session summaries generated by our AI are stored and associated with the session. Transcription data used to generate summaries is retained for up to 90 days, then deleted.

Usage Data

We collect anonymized usage analytics (sessions joined, features used, app performance) through TelemetryDeck and Apple App Analytics. These services do not track individual users.

Date of Birth

We collect your date of birth during account creation for age verification. Your date of birth is immutable once set and is never displayed publicly or included in public API responses.

Moderation Data

When our AI moderation systems flag content, we record the moderation event including the flag category, severity level, and action taken. Transcription segments analyzed for moderation purposes are processed in real-time and discarded after analysis — they are not stored.

Content Hashes

We generate SHA-256 hashes of session summaries and transcripts for integrity verification. These hashes are stored alongside the parent content and deleted when the parent content is deleted.

Consent Records

When you consent to recording in a session, we log a consent record containing your user ID and a timestamp. See our Recording Consent Policy for details.

Audit Trail Data

We maintain audit records for account-level changes (profile edits, account deletions), moderation actions, and enforcement decisions. These records are used for legal compliance and to support the appeals process.

Recording Protection Data

On supported devices, the Aria iOS app detects screen recording activity during live sessions. When detected, the app displays a protective overlay and mutes session audio to prevent unauthorized capture. No screen content, screenshots, or recordings from your device are collected or transmitted to our servers. Recording protection capabilities may vary by platform and device.

Device Information

We collect device tokens for push notifications (APNs). We do not collect device identifiers, advertising IDs, or location data.

2. How We Use Your Information

• To provide and maintain the Aria service
• To authenticate your identity and secure your account
• To deliver live audio and chat functionality
• To generate AI session summaries
• To moderate content and enforce Community Guidelines
• To send push notifications (session invites, connection requests)
• To improve the app through anonymized analytics
• To process payments (via Stripe, for subscriber sessions)

3. Third-Party Services

We use the following third-party services:

• Supabase — Authentication and database hosting
• LiveKit — Real-time audio streaming infrastructure
• Stripe — Payment processing for subscriptions
• Apple Push Notification Service (APNs) — Push notifications
• TelemetryDeck — Privacy-first analytics

When enabled for recorded sessions, we also use:

• ACRCloud — Audio fingerprinting to detect unauthorized copyrighted music

Each third-party service has its own privacy policy. We encourage you to review them.

4. Data Retention

• Profile data: Retained until you delete your account
• Date of birth: Retained until you delete your account
• Live audio: Ephemeral; not stored after session ends
• Recorded sessions: Up to 90 days
• Session transcripts: Up to 90 days
• AI summaries: Retained until you delete your account
• Content hashes: Same retention as parent content
• Chat messages: Non-flagged messages are ephemeral; messages flagged for moderation retained up to 90 days
• Moderation flags: Up to 1 year
• Consent records: Retained until you delete your account
• Deletion audit records: Retained as required for legal compliance
• Profile change history: Up to 1 year
• Harassment alerts: Up to 1 year

Data retention is managed by automated systems. Records past their retention period are permanently deleted on a rolling basis once retention enforcement is enabled for each data category.

5. Your Rights

You have the right to:

• Access your personal data (Profile → Settings)
• Correct inaccurate data (edit your profile)
• Delete your account and all associated data (Profile → Settings → Delete Account)
• Export your data (Profile → Settings → Export My Data)

Account deletion is permanent and cascades across all data (profile, connections, subscriptions, moderation records).

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

We Do Not Sell Your Personal Information

Aria does not sell, share, or rent your personal information to third parties for monetary or other valuable consideration. Our revenue comes exclusively from creator subscriptions — never from advertising or data sales.

Your California Rights

• Right to Know: You can request details about the categories of personal information we collect, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You can request deletion of your personal information (Profile → Settings → Delete Account).
• Right to Correct: You can correct inaccurate personal information through your profile settings.
• Right to Portability: You can export your data in a portable format (Profile → Settings → Export My Data).
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, use the in-app controls described above or contact us at privacy@aria-live.app.

7. Data Security

We implement industry-standard security measures including encrypted connections (TLS), secure authentication tokens, and access controls. Audio streams are encrypted in transit. No system is 100% secure, but we take reasonable measures to protect your data.

8. Children's Privacy

Aria is not intended for users under 13 years of age. We collect date of birth at signup to verify age eligibility. Date of birth is immutable once set and is never displayed publicly. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete the account and all associated data. For full details on how we protect younger users, see our Children's Privacy (COPPA) policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. Continued use of Aria after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related questions or data requests:

Email: privacy@aria-live.app