ARIA — Privacy Policy

Last updated: 31 July 2026 Effective date: 31 July 2026

This Privacy Policy explains how ARIA (“ARIA”, “the app”, “we”, “us”, “our”) handles your information. ARIA is a personal-finance, calendar, and task assistant for iPhone. It is built around a simple promise: your data lives on your device, and we never sell it.

ARIA is provided by Estuaire Studio, the business name under which Boris Alexander Legkow Orias operates as a sole trader in Quebec, Canada (“the developer”). Boris Alexander Legkow Orias is the enterprise responsible for your personal information under Quebec’s Law 25 (the Act respecting the protection of personal information in the private sector), the federal PIPEDA, and — for users in those regions — the EU/UK GDPR (as data controller) and the California CCPA/CPRA.

Quebec residents are covered by Law 25; other Canadian users and any personal information that crosses provincial or national borders are covered by PIPEDA. Where more than one law could apply, we apply the higher standard.

Plain-language summary. Almost everything you put into ARIA stays on your iPhone. If you turn on sync, your data is encrypted on your device with a key that stays in your iCloud Keychain — reachable by your own other devices, but never by us — so even we cannot read it. Some features are optional and only run when you switch them on: connecting a bank (Plaid) or importing your calendar (Google/Apple). AI features run on your device — on Apple’s models, or on an optional open-source model you can choose to download. We do not track you across apps or websites, we run no advertising SDKs, and we do not sell your data. This summary is for convenience only; the full text below governs.

1. Who this policy covers

This policy applies to everyone who uses the ARIA iOS app. It covers data you enter, data ARIA reads from services you choose to connect, and the limited data needed to run your account and subscription.

ARIA is intended for a general audience of adults. It is not directed to children, and we do not knowingly collect their data: not from a minor under 14 in Quebec (the age Law 25 keys parental consent to), under 16 in the EU/UK, or under 13 in the United States. See Section 11. (These are the ages at which specific privacy laws require parental consent for data collection — they are narrower than, and don’t change, the Terms of Use’s overall minimum age to use ARIA at all: 16, or 18 where required — see the Terms of Use §2.)

2. The data ARIA handles, and where it lives

ARIA is local-first. Unless a row below says data is “transmitted,” it is stored only on your device (in Apple’s SwiftData store and the iOS Keychain) and is never sent to us or anyone else.

Data Examples How ARIA gets it Where it goes
Financial records Account names & balances, transactions (merchant, amount, date, category), bills, budgets, goals, safety-net amounts, subscriptions You enter it; you import a CSV; or you link a bank via Plaid On device. If sync is on, included in the end-to-end-encrypted backup.
Bank data via Plaid Account balances, transaction history, account mask (last 4 digits) Only if you connect a bank in Plaid Link Fetched server-side by our backend and delivered to your device. See Section 5. Read-only — ARIA never moves money.
Calendar events Event titles, dates, times Apple Calendar (EventKit) and/or Google Calendar, read-only, only if you connect them; or you create events in ARIA On device. If sync is on, included in the encrypted backup.
Tasks & projects Task titles, due dates, tags, projects, steps You enter them, or add them by voice via Siri On device. If sync is on, included in the encrypted backup.
Your name First name You optionally provide it at sign-in On device; tied to your account if you use cloud sync.
Account identifier Apple user identifier (from Sign in with Apple) Sign in with Apple Sent to our backend to create and authenticate your account.
Email address — Not requested. Sign in with Apple can share your address (or an Apple private relay address), but ARIA asks Apple only for your name, so no address is ever sent to us. Nowhere. Your account record holds no email address. (If you write to us for support, we of course hold that message — see Section 14.)
Receipt photos A photo of a receipt Only if you scan a receipt Processed on device to read merchant/amount/date, then discarded. The image is never stored or transmitted.
Voice input What you say to ARIA — you can tap the mic to start and stop listening, or press and hold it and release when you’re done Microphone + on-device speech recognition Transcribed on your device (requiresOnDeviceRecognition), used to answer, then discarded. Not stored, not transmitted.
Face ID / biometrics Biometric match result Optional app lock Handled entirely by iOS (LocalAuthentication). ARIA never sees or stores biometric data.
Diagnostics (optional) Coarse, non-identifying usage events (e.g. “feature opened”) Only if you turn on “Usage analytics” (off by default) See Section 6. Contains no names, emails, or amounts.
Subscription/purchase state Whether you have ARIA+ App Store purchase via RevenueCat See Section 5.
Device settings Appearance, currency, language, ARIA’s personality, notification preferences You set them On device (UserDefaults / @AppStorage).

We do not collect: your email address (we never ask Apple for it — see the table above), your bank login credentials (those go directly to Plaid, never to ARIA), your precise location, your contacts, advertising identifiers, or any email content — ARIA never requests Gmail or any other email access.

Where the GDPR/UK GDPR applies, we rely on the following legal bases (Art. 6):

Purpose Legal basis
Run the app’s core features on your device (track money, bills, tasks, calendar) Performance of a contract (Art. 6(1)(b)) — you asked us to provide ARIA
Authenticate your account and sync your encrypted backup Performance of a contract (Art. 6(1)(b))
Connect a bank (Plaid) or import a calendar (Google/Apple) Consent (Art. 6(1)(a)) — these are off until you switch them on, and you can withdraw at any time
Process biometric app-lock Consent — and handled by iOS, never by us
Optional diagnostics Consent (off by default)
Manage your ARIA+ subscription Performance of a contract (Art. 6(1)(b))
Keep the service secure, prevent abuse, and meet legal obligations Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))

You can withdraw consent at any time by disconnecting the relevant integration in Settings or turning the feature off. Withdrawing consent does not affect processing that already happened.

Consent, and express consent for sensitive data. We ask for your consent through clear, specific, separate choices — each optional integration (Plaid, Google Calendar) and cloud sync are off until you turn them on. Because your financial information is sensitive, we ask for your express consent before you connect a bank or we process your financial data, and we use it only for the purposes you enabled.

4. On-device intelligence and AI

ARIA’s “intelligence” — the Life Score, proactive nudges, receipt reading, subscription detection, anomaly flags, and the voice assistant — runs on your device using Apple’s on-device Foundation Models, with deterministic on-device logic for scoring and pattern detection.

5. Third-party services we work with

ARIA uses a small number of providers. We share only what each feature needs, and only when you use that feature. Each provider is an independent controller or processor under its own privacy policy.

Plaid — bank connection (optional)

If you connect a bank, you do so through Plaid Link. You enter your bank credentials directly with Plaid — ARIA never sees or stores them. Plaid returns account and transaction data, which our backend retrieves on your behalf and delivers to your device. The Plaid access token is held server-side only; your device holds only an opaque item identifier. The connection is read-only; ARIA cannot and does not move money, make payments, or initiate transfers. Your use of Plaid is also governed by Plaid’s End User Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy. You can disconnect a bank at any time in Settings, which unlinks the item.

Google — Calendar (optional)

If you connect Google Calendar, ARIA requests read-only access (calendar.readonly) via Google OAuth. OAuth tokens are stored in your device Keychain. ARIA does not request any Gmail access — no email scope is ever requested, and no email content is read.

Limited Use disclosure. ARIA’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we access Google Calendar data only to provide and improve the in-app features you request (showing your events); we process this data on your device; we do not transfer it to others except as needed to provide these features, for security, or to comply with law; we do not use it for advertising; and we do not allow humans to read it except with your consent, for security, or as required by law.

Apple — accounts, calendar, purchases, intelligence

ARIA uses Apple frameworks: Sign in with Apple (account creation), EventKit (Apple Calendar), StoreKit (purchases), Speech (on-device transcription), LocalAuthentication (Face ID), ActivityKit (Live Activities), and Foundation Models (on-device intelligence). Apple’s handling of this data is governed by Apple’s Privacy Policy (https://www.apple.com/legal/privacy/).

RevenueCat — subscription management

ARIA+ subscriptions are processed through Apple’s App Store and managed using RevenueCat, which validates your App Store receipt and tells the app whether your subscription is active. RevenueCat receives a pseudonymous app user ID and purchase/receipt data; it does not receive your financial records, calendar, or email. See RevenueCat’s privacy policy: https://www.revenuecat.com/privacy.

Cloudflare — our backend and encrypted sync

Our account, sync, and Plaid backend runs on Cloudflare Workers, a global edge-computing network — our deployment is not pinned to a single country, so requests may be processed at any Cloudflare facility worldwide, including the United States. It stores your end-to-end-encrypted sync backup (which we cannot decrypt), your account record, and — server-side only — your Plaid access token. Cloudflare acts as our hosting processor.

We maintain a current list of sub-processors available on request at hello@estuaire.studio.

6. Analytics and tracking

7. How we share data

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We have not sold or shared personal information in the preceding 12 months.

We disclose data only:

8. Data retention

9. Your rights and choices

In-app controls (available to everyone):

EU/UK (GDPR) rights. You may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent at any time. Many of these are available directly in-app (export/delete). For anything else, email hello@estuaire.studio. We respond within 30 days (extendable by 60 days for complex requests). You also have the right to lodge a complaint with your supervisory authority. ARIA is offered on the App Store in Canada and the United States and is not marketed or targeted to the EU/UK; where these rights nonetheless apply to you, you can exercise them by writing to the Privacy Officer at the address at the top of this policy.

California (CCPA/CPRA) rights. You may request to know, delete, and correct your personal information, and to limit the use of sensitive personal information. We do not sell or share your personal information and do not discriminate against you for exercising your rights. We acknowledge requests within 10 business days and respond within 45 days (extendable by 45 days). Submit requests at hello@estuaire.studio.

Canada — Quebec (Law 25) & PIPEDA rights. You may:

We respond within 30 days. If we refuse a request, we explain why and tell you how to seek a review. You can also complain to a regulator: in Quebec, the Commission d’accès à l’information (CAI) — cai.gouv.qc.ca; elsewhere in Canada, the Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca, 1-800-282-1376. We make this policy publicly available and will provide a copy on request.

We verify requests using reasonable measures proportionate to the data involved. Because we hold no email address for you (see Section 2), the normal proof is control of the Apple Account you signed in with: signing in to ARIA and using the in-app export or delete controls does that by itself. For a request sent by email, we may ask you for details only the account holder would have — and we ask for the least we can, never for a bank credential or a government identifier.

10. Security

11. Children

ARIA is not directed to children. We do not knowingly collect personal information from a minor under 14 in Quebec (where Law 25 keys consent to a parent or tutor), under 16 in the EU/UK, or under 13 in the United States (COPPA). If you believe a child has provided us data, contact hello@estuaire.studio and we will delete it.

12. Communication outside Quebec / Canada, and international transfers

Our backend and service providers (Cloudflare, RevenueCat, Plaid, Google) are US-based companies, and Cloudflare’s network processes data at facilities worldwide (not pinned to a single country) — so some of your information (your account record; if you link a bank, a server-side access token; and your end-to-end-encrypted sync backup) is communicated outside Quebec and Canada.

Your synced content is end-to-end encrypted and unreadable in transit and at rest by us and our hosting provider.

13. Changes to this policy

We may update this policy as the app evolves or the law changes. We will post the updated version with a new “Last updated” date and, for material changes, provide in-app notice. Continued use after an update means you accept the revised policy.

14. Contact

Questions, requests, or complaints: Estuaire Studio · hello@estuaire.studio · https://estuaire.studio Boris Alexander Legkow Orias · 1 rue Boucher, Port-Cartier, QC G5B 2T9, Canada

ARIA is an informational tool. It is not a bank, money transmitter, or financial adviser, and it does not move money. See the Terms of Use for details.