Privacy policy

This policy explains how [Company legal name], [registered address] (“Aria”, “we”), handles personal data about people who visit the website and who have an Aria account. For personal data inside the applications you run on Aria, you are the controller and Aria is your processor: see the data processing agreement.

What we collect

• Account: your name, email address, a hash of your password (never the password itself), whether you verified your email, which version of the terms you accepted and when, and, if you turn it on, your two-factor secret (encrypted) and hashed recovery codes.
• Sessions and security: for each sign-in, the IP address, browser or app, and when it was last used; failed sign-in counts used to slow down password guessing.
• Projects: project and workspace names, configuration (such as aria.yaml), the servers we run for you, deploy history and logs, usage metrics (CPU, memory, disk), and an activity log of actions taken in each project. Environment variables and credentials are stored encrypted.
• Billing: your plan, payment status and invoices. Card details go directly to Stripe; we receive only a reference and the last digits.
• Email: the codes and notices we send you, and whether they were delivered.
• Connected services: if you connect GitHub, the repositories and installation you choose.

Why we use it, and on what basis

• To provide the service you signed up for: your account, servers, deploys, billing and support (performance of a contract).
• To keep Aria and other customers safe: sign-in protection, abuse prevention, the human check at sign-up, security logs (legitimate interests).
• To meet legal obligations, such as keeping invoices and answering lawful requests (legal obligation).
• To email you about your account, security and billing. We don’t send marketing email without your consent.

Cookies and storage in your browser

The website sets one cookie, aria_session, which keeps you signed in. It is essential, so there is no cookie banner. The site also keeps small values in your browser’s storage (whether you looked signed in, a sign-up or password reset in progress, resend countdowns). There is no analytics or advertising tracking, and fonts are served from Aria’s own site. On the sign-up and password reset pages, a Cloudflare Turnstile check may run to tell people from bots.

Who we share it with

We use a small number of providers (“sub-processors”) to run Aria, listed on the sub-processors page. Some are outside the UK and the European Economic Area; transfers are protected by [Standard Contractual Clauses / adequacy decisions: to be confirmed]. We don’t sell personal data.

How long we keep it

• Account data: while your account exists. Deleting your account removes it, along with projects only you use.
• Sessions: signed out after 30 days without use, and at most 90 days after signing in.
• Activity logs in shared projects: kept for the project, with your email removed once your account is deleted.
• Invoices and payment records: [period required by law, e.g. 6 or 10 years].
• Backups of Aria’s own database: [retention period], after which deleted data is gone from backups too.

Your rights

You can see and download your data (Security and privacy → Download your data), correct it, and delete your account yourself. You can also ask us to restrict or stop processing, or object to it, at [privacy contact]. You have the right to complain to a data protection authority, such as [the ICO in the UK / your local authority in the EU].

Security

Passwords are hashed; secrets and credentials are encrypted at rest; codes and tokens are stored only as hashes; two-factor authentication is available for every account and required for Aria staff. Access to production systems is limited to the people who need it.

Changes

When this policy changes in a way that matters, we email you and ask you to accept the new version.