Privacy

Who this covers

This policy explains what Aara Labs LLC collects, why we ask, who else handles it, and what you can do about it. It covers the aara.space website and the Aara mobile app.

We are based in Atlanta, GA. Questions go to the support form at aara.space/support.

What the website collects

The website’s only job is the beta waitlist. When you join, we store your email address and the area you picked, or the city you typed on the other-cities list. That is everything we ask you for.

After you join we offer four optional questions: how often you do each activity in a typical week, when you are usually free, whether you already keep a routine, and what would help it stick. Every one is skippable, and any you answer are saved to the same waitlist entry.

What the website records without asking

Two things reach that entry without you typing them. If you arrived through a poster, a code or a campaign link, we record which one, so we know where people find us. That is a short label such as a venue or campaign name, and it says nothing about you. We also keep a random identifier in your browser so that a page view and a join can be counted as one visit rather than two.

Neither is used to build a profile of you, and neither is shared for advertising. The identifier sits in your browser’s local storage as aara_web_device_id, and a campaign label may be kept in a first-party cookie named aara_ref. Clearing your browser storage removes both.

How the area list is ordered

When you open the waitlist, our host estimates your rough area from your connection, at city and state level only, so the nearest options appear first. Nothing is chosen for you, and the estimate is not stored.

We never ask your browser for your location on the website, and we never read or keep coordinates there. The website does not collect precise location.

What the app collects

When you use the app we collect your email address, your first name, your birthday, the area where your sessions would happen, and the answers you give while setting up. As you use Aara we store the plans you make, the check-ins you complete, and the messages you send.

You can add a photo and profile answers if you want to. We do not analyse faces or bodies in photos. The app stores your location precisely enough to find people near you, and other people are shown only an approximate distance, never your coordinates.

What other people can see

Other people on Aara see your first name, your photo and profile answers if you added them, the activities you do, and an approximate distance from them. They do not see your email address, your birthday, your coordinates, or your reliability score.

Reliability and behaviour scores are private to you. We do not show them to anyone else, and we do not use them to rank you publicly.

When you write to support

The support form collects your email address, the topic you pick, and your message. Submissions are stored by our host and emailed to our internal inbox so that a person can reply.

Please leave out health details, or anything else you would rather not put in writing. A support message is read by a person and kept as a record of the conversation.

Why we ask

We use what we collect to pair you with a fitness partner, to keep your plans in sync, to send the emails the product depends on, to answer your messages, and to keep Aara safe and working.

We do not sell your personal information, and we do not run third-party advertising trackers.

Who else handles it

We use other companies to run Aara, and they handle data only on our instructions. Netlify hosts the website and stores support submissions, and Akismet checks those submissions for spam. DigitalOcean hosts our servers and database. Resend sends our email. Stripe and RevenueCat handle payments. UserJot handles the feedback you choose to send. Your post is tied to an id we assign. Your account email goes with it so UserJot can email you when the status changes. It is never shown on the post or to other people. Expo delivers the app’s code updates. Google provides the reCAPTCHA check on waitlist submissions, and its maps service helps find places to meet.

The reCAPTCHA check runs only at the moment you submit the form, and only when it is switched on for the site, so if you read the page and leave, nothing about you reaches Google. When we look up a place to meet, we round your location to a coarse grid before it leaves our servers.

One more is named here before it runs, so that the list is complete on the day it does rather than after it. PostHog will handle product analytics: how the app is used, and by which anonymous device. It is not switched on today, and it receives nothing about you until it is.

How the app updates itself

The app can update its own code without a trip to the app store. Each time you open it, the app asks Expo, the company that runs that service, whether newer code is waiting. This happens as the app starts, whether or not you are signed in. The request carries a random identifier for your install, which platform your phone runs, and which version of the app’s code you are running. It carries no name, no email, no account, and nothing you have written in Aara. Like every request over the internet, it reaches Expo from your connection, which shows roughly what area you are in. The app itself sends Expo no location.

That identifier is a random string held on your phone. It is not an advertising identifier, it is tied to no account, and deleting Aara removes it. If the app failed to start the last time you opened it, the request also carries the beginning of that error message, so the fault can be found. Expo uses this to work out which code to send you. Its privacy policy is at expo.dev/privacy.

Where it lives

Aara’s servers and database are in the United States.

If you use Aara from outside the United States, your information is processed in the United States, where privacy law differs from the law where you live.

How long we keep it

We keep your account data while your account exists. When you delete your account, we delete it.

We keep a waitlist entry until you ask us to remove it, or until we close the waitlist for your area. Support messages are kept as a record of the conversation.

Your choices

You can correct your details in the app, and you can delete your account there at any time. Deleting is real: your profile, your plans and your messages go.

If you are on the waitlist and not yet in the app, write to the support form and we will remove your entry. Every email we send you carries an unsubscribe link.

Your rights

Depending on where you live, you may have the right to see the information we hold about you, to correct it, to delete it, to receive a copy of it, or to withdraw consent. Ask through the support form and we will do it.

We will not treat you differently for asking.

Children's privacy

Aara is for adults. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18.

If you believe someone under 18 has given us information, tell us through the support form and we will remove it.

Security

We protect your information with the usual measures: encryption in transit, limits on who can reach what, and a separation between what we store and what we show. Passwords are not among them, because Aara does not use passwords.

No service is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you.

Changes to this policy

We update this policy when what we do changes. The date at the top is the version you are reading, and the same version is in the app.

When a change is significant we tell you in the app or by email before it takes effect.

Questions

Write to us through the support form at aara.space/support. A person reads every message and replies to your email, usually within two days.