How Aurbit handles your data.

1. Who we are

Aurbit (“we”, “us”) operates the Aurbit mobile apps for iPhone and Android and the website at aurbit.space. This policy explains what we collect, why we collect it, and the choices you have. It covers the apps and this website. It does not cover third-party stores, SMS carriers, or sites we link to.

If you live in India, we handle personal data in line with the Digital Personal Data Protection Act, 2023, and the rules made under it. If you live in the UK, the EEA, or somewhere else with its own privacy law, you can still use the rights described below, and any extra rights that law gives you, by writing to privacy@aurbit.space.

Questions about a bug, a missing code, or how a feature works go to Support. Privacy requests go to the address above so they are not mixed in with general mail.

2. Information we collect

Account and profile

You sign in with a mobile number. We store it in international format (for example +91…) together with:

• a one-way hash of that number, used to match you with people who already have you saved;
• the name, handle, pronouns, and short bio you choose;
• up to five vibe tags from the list in the app;
• a profile photo, if you add one;
• your aura total, stage, referral code, and whether someone referred you;
• privacy settings (who can see your photo, aura, and details; Nearby; anonymous drops; stage; contacts) and notification switches (aura, reminders, social).

We send a one-time code by SMS to prove the number is yours. The code is stored only as a keyed hash, expires in minutes, and is single use. We keep a log that a code was requested, sent, verified, or blocked — not the code itself.

Aura and social graph

When someone gives or drains aura we store the amount, the channel (orbit, nearby, tap, contact, referral, system, or inactivity), an optional reason and note, whether the drop was anonymous, and the receiver’s aura afterwards. We also store connections (who is in whose orbit and how you met), blocks, reports, and referral rewards.

A note is visible to the person who received it. If you send anonymously, and they allow anonymous aura, they see the note and the amount without your name. We still keep the sender on our side so we can enforce limits, investigate reports, and stop abuse. Staff do not browse notes for curiosity; they see them when a report, a safety review, or a legal request requires it.

Device and session

Each signed-in device has a session. We store a device id you generate, a device name, platform (iOS, Android, or web), app version, push token if you allow notifications, IP address, user agent, and when the session was last used. Sessions are how the app stays signed in. We do not use the push token for advertising.

Photos

If you upload an avatar we re-encode it, crop it square, and strip embedded metadata, including location, before it is stored. The public image address does not include your phone number.

This website

aurbit.space is a marketing and legal site. The phone field on the home page checks that a 10-digit Indian mobile number looks complete, then confirms it in your browser. We do not transmit or store that number from the website. The site does not set advertising cookies and does not load a third-party analytics tracker. Your browser will request the page, the logo, the fonts from Google Fonts, and this text. That request includes the usual technical data a web server sees, such as IP address and user agent, in host logs kept for security and debugging.

3. Contacts

Contact sync is off until you turn it on. When you do, the app hashes each number in your address book on the device, the same way we hash account numbers, and uploads those hashes plus an optional short label you already use (such as Family, School, or College). We do not receive the contact’s name, email, photo, or the raw phone number from your address book.

We compare the hashes with hashes of Aurbit accounts and store a match only when both people are on Aurbit: your account, their account, and the label if you sent one. Labels matter because family contacts can only receive positive aura. Turning contacts off deletes every match tied to you. Deleting your account does the same.

Hashing is not the same as encryption that we can reverse. A hash cannot be turned back into a phone number by us. Someone who already knows a number could hash it and test whether it matches, which is why we only run the comparison to find people you chose to sync, and we rate-limit how often a sync can run.

4. Nearby and Tap

Nearby shows people who are in the same place as you and who also have Nearby on. While it is on, the app sends an approximate position so we can answer “who is around”. That position lives in a short-lived cache, on the order of two minutes, and is dropped when it expires, when you turn Nearby off, when you go idle, or when you delete the account. It is not written into your profile record and it is not kept as a location history.

You can hide from Nearby without deleting your account. Other people still cannot see you there once the presence is removed. Tap is a separate, in-the-moment exchange between two phones; we record the aura and the connection, not a map of where the tap happened.

5. How we use information, and why

We use personal data to:

• create and protect your account, send one-time codes, and keep you signed in;
• show your orbit, aura, stage, history, and vibe match, including live updates while the app is open;
• deliver aura you send or receive, including anonymous drops when the receiver allows them;
• match hashed contacts, run Nearby, and complete Tap;
• apply the product rules you can read in the terms: daily limits, cooldowns, first-meet and family positive-only sends, referral rewards, and inactivity decay;
• send pushes you have switched on (aura received, a nudge when you have been away, a warning before decay, and the decay itself);
• investigate reports, blocks, spam, fake accounts, underage use, and other abuse, and keep the service reliable;
• answer support mail and meet legal duties.

Where the law asks for a legal ground, we rely on the contract of providing Aurbit (running the account and the features you use), our legitimate interests in safety, fraud prevention, and understanding whether the product works (balanced against your rights), consent where we ask for it (contact sync, Nearby, notifications, and optional profile fields), and legal obligation when a law requires us to keep or disclose something.

We do not sell personal information. We do not use your contacts, notes, or aura history to build advertising profiles, and the app does not show third-party ads. Aura is not a payment instrument; we do not collect card or bank details to give or receive it.

6. Who we share it with

Other people on Aurbit see what your privacy settings allow. That can include your handle, name, photo, tags, bio, aura, and stage. Anonymous senders are shown to the receiver as “Someone”. People you have blocked lose access to your profile and cannot send you aura.

We use processors who handle data only on our instructions:

• SMS providers (such as MSG91 for India, or Twilio) to deliver one-time codes and invite texts;
• cloud hosting for the database and cache that run the app;
• object storage (Cloudflare R2) for profile photos;
• Google Firebase Cloud Messaging, and Apple’s push service, to deliver notifications to devices that registered a token;
• Google Fonts on this website, which serves the typefaces.

We share information with authorities when the law requires it, or when we believe it is needed to prevent serious harm, and with professional advisers under confidentiality. If Aurbit is involved in a merger or a sale of the product, the buyer would have to honour this policy or ask for your consent where the law requires it. We will say so on this page if that happens.

Servers may sit outside the country you live in. When we transfer personal data we use contracts and technical measures (access control, encryption in transit, hashed secrets) appropriate to the transfer. You can ask privacy@aurbit.space for a summary of those safeguards.

7. How long we keep it

• Account data stays while the account is open.
• One-time-code logs are deleted after 90 days.
• Sessions that have been signed out or have expired are deleted after 30 days. An active app that is opened at least once a year can stay signed in; that window is a product setting and can change.
• Nearby positions expire in about two minutes and are not kept as history.
• Profile photos are deleted when you replace them, remove them, or delete the account.
• Reports and safety records are kept long enough to resolve the case and to prevent the same abuse from returning.
• Host and security logs are kept for a limited period and then deleted or aggregated.

When you delete your account

Deletion is irreversible. We erase the profile fields, photo, orbit connections, contact matches, blocks you created, and invites you sent, and we sign out every device. The phone number and handle can be used again on a new account. Aura you already gave other people stays on their totals, without your name, photo, or number attached, because taking it back would rewrite their history. A minimal audit record of the deletion itself may remain for security.

8. Your choices and rights

Inside the app you can:

• edit your name, handle, pronouns, bio, tags, and photo;
• choose who sees your photo, aura, and details;
• turn Nearby, anonymous drops, stage display, and contact sync on or off;
• switch aura, reminder, and social notifications off;
• block someone, report a person or a drop, and sign out a device;
• delete the account from the profile settings by confirming the deletion.

You can also email privacy@aurbit.space to access the personal data we hold, correct it, delete it, withdraw consent (which does not undo processing that already happened lawfully), ask us to stop a particular use, or raise a grievance. We will acknowledge the request and respond within the time the applicable law requires, and we aim to answer within 30 days. We may need to confirm that the request comes from the account holder, usually from the phone number on the account.

If you are in India and you are not satisfied with our response, you may complain to the Data Protection Board of India once that route is open to you. If you are in the UK or the EEA, you may complain to your local supervisory authority. We would like the chance to fix the problem first.

9. Children

Aurbit is not directed at children under 13, and we do not knowingly create accounts for them. If we learn an account belongs to a child under 13 we will delete it. If you are under 18, use Aurbit only with a parent or guardian’s permission.

Indian law treats anyone under 18 as a child for data-protection purposes and restricts tracking, targeted advertising, and certain processing. We do not run targeted advertising. People can report an account as underage. We review those reports and may remove the account, restrict features, or ask for proof of age or parental permission where the law requires it. Write to privacy@aurbit.space if you believe a child has an account.

10. Security

We protect accounts with one-time codes, short-lived access tokens, rotating refresh tokens, and the ability to revoke a session immediately. Contact matching uses hashes rather than raw address-book numbers. Photos are stripped of location metadata. Traffic to the app is encrypted in transit.

No service can promise perfect security. If we learn of a breach that is likely to affect you, we will tell you and the authorities when the law says we must. Please keep your phone and SMS access private; anyone who can read your texts can request a code.

11. Changes to this policy

We will update the date at the top when this policy changes. If a change materially reduces your rights or starts a new use of data you would not expect, we will tell you in the app or by a message to the account before it takes effect, where the law requires notice. The current version is always at aurbit.space/privacy.

12. Contact and grievances

Aurbit’s contact for privacy requests and grievances:

• Email: privacy@aurbit.space
• Support: support@aurbit.space or the support page
• Legal notices: legal@aurbit.space

Please include your handle or the phone number on the account, and say what you want us to do. Do not send copies of identity documents unless we specifically ask for them.