Privacy Policy
The short version: Auris cannot read your conversations, does not require a phone number, and writes down the metadata it does need in order to work.
No phone number. No email. No name on our servers. Your identity is a random Auris ID created on your device. The display name you pick is sent to your contacts inside end-to-end encryption. The server receives it only inside encrypted content.
Conversation transport is end-to-end encrypted. Messages, photos, voice notes, calls, captions, reactions and receipts are encrypted on your device with keys only you and your contact hold. Capable sessions include an ML-KEM post-quantum key contribution, subject to the limits in the security overview. The Auris server routes ciphertext it cannot read; explicitly enabled cloud captions are the separate Apple boundary described below.
No ads, no trackers, no analytics SDKs, no selling data. Ever.
What the server stores, and for how long
- Your Auris ID and public keys. The directory entry that lets contacts find and encrypt to you. The active row ages out after 45 days without registration; an ID-to-signing-key tombstone remains.
- A push token (Apple's opaque device token), keyed to your Auris ID so we can wake your phone for calls and messages. Deleted when unused for 45 days.
- Undelivered messages. Encrypted blobs queued while you're offline. Deleted the moment they're delivered, or after the retention window you choose in Settings, whichever comes first. Message sizes are padded so length reveals less.
- Undelivered attachments. Encrypted, padded blobs with the same delete-on-delivery rule; one that is never downloaded expires after the sender's retention window.
- No content or contact upload. There is no message or call content, display-name database, contact list, persistent call log, or precise-location field. The service still processes the routing, timing, IP, queue/push, lookup/presence and short-lived call-attempt metadata described below. Server logs contain operational counts and error codes. Not content, names, or full identifiers.
What the server can observe
Honesty matters more than marketing here: any server you connect to sees your IP address and connection timing while you're connected. Registered sockets can be associated with an Auris ID; anonymous send sockets omit that account label but remain traffic-correlatable. Call setup exposes the caller/callee Auris-ID edge to the signaling service, while blinded room identifiers reduce reuse and intermediary leakage. Auris does not write IP addresses to its application or access logs, but the live network view and the service's routing records still exist. The complete field-by-field account is the server view page of the documentation.
Calls
- Calls connect directly between you and your contact when possible. Route quality varies by network; a direct connection means your contact's network sees your IP, as with any peer-to-peer app. Turn on “Hide my IP from contacts” to always route through a relay instead.
- When a relay is needed or chosen, it carries encrypted packets. Call media is protected by transport encryption plus an extra end-to-end frame-encryption layer keyed from your message session. A relay cannot read the media, but it observes endpoint IPs, timing, duration and traffic volume.
- An incoming name can be resolved from your contacts after a valid per-attempt MAC hint, before the full ratchet-carried caller proof arrives. Legacy routing hints alone do not authorize that display. Stronger proof is required for durable attribution and incoming direct-path admission; the ordinary push does not contain the plaintext name.
Third parties
- Apple push notifications wake your device. The remote message title and body are always the fixed generic “Auris” / “New message”; display names and message text never enter APNs. If you select sender-aware notifications and a message uses the authenticated legacy delivery route, an opaque sender Auris ID may be sent only as the per-conversation thread/collapse grouping value. The preferred sealed-sender and anonymous-queue wakes do not include it. Apple always sees the recipient device token, the Auris app, push type, timing and volume. Sender names and previews are assembled locally after end-to-end decryption.
- Call pushes also carry room and per-attempt routing information; a first-contact fallback can include the caller’s opaque Auris ID. A blinded room does not eliminate timing or relationship correlation.
- Fallback DNS-over-HTTPS resolution shares the requested hostname, IP address and timing with the resolver. Optional relay operators observe connection metadata; inner transport is intended to protect application capabilities from a TLS-terminating front.
- Cloudflare TURN may relay call packets, encrypted end-to-end as above. It sees IPs and traffic volume, not content.
- Apple speech recognition, only if you turn it on. Live captions run on-device. If your language has no on-device model and you explicitly enable “Cloud captions”, your caption audio goes to Apple's servers (like Siri dictation), and the app says so on screen while it is happening. A contact can never switch this on for you. Captions a contact starts always stay on-device.
Optional, off-by-default telemetry
If you opt in to “Improve call quality”, the app sends anonymous network metrics: round-trip time, packet loss, bitrate, and a coarse device/OS class. No IDs, no room names, no content, without an explicit account field, but still subject to IP and timing correlation, kept in server memory for at most 24 hours. Off by default, and you can turn it off again at any time.
On your device
- Operational state is encrypted at rest under a device-bound, non-syncing Keychain key and excluded from backups. Chat history is separately encrypted and can require Face ID, an Auris passphrase, or both, with no device-passcode fallback.
- Optional app screen lock (using device authentication, including its permitted passcode fallback), screenshot notices, disappearing messages and a blanked app-switcher snapshot are there if you want them.
- Local controls delete one message, clear one chat, delete a contact together with its chat, or clear everything. Completion is commit-checked. This is logical deletion from the active store. Not a guarantee of immediate physical erasure from device snapshots or flash wear levelling.
- Deleting the app removes its container files, but iOS Keychain retention across uninstall and reinstall must not be treated as secure erasure. Use the explicit local clear/reset controls for the documented behaviour. Auris holds no server-side decryption key and offers no plaintext-history recovery service.
Your controls
- Retention of undelivered messages, local-history protection and deletion, notification detail, relay routing, captions and telemetry all live in Settings, in plain language.
- The active directory entry and push tokens expire after 45 days without registration. A tombstone retaining the ID-to-signing-key binding remains to prevent re-claiming that ID. Undelivered ciphertext follows the 1–7 day retention window. You may also ask support to remove your server directory entry sooner; local history deletion stays an on-device control.
Changes and contact
If this policy changes, the change ships with an app update and is recorded here with a new effective date. Silent changes would defeat the point. For questions or deletion requests, use the support contact published with the app.
For the deeper technical account behind these claims, protocols, threat model, and what an attacker in each position can and cannot do, read the security overview, the threat model and the technical page.
Reviewed · Review scope and versions