Your data in Aria
Aria stores your documents, the PDFs you upload with them, reading position, pins, quiz answers, takeaways, chats, and model preferences on its server. Your library is associated with your sign-in account. It is not end-to-end encrypted.
Accounts and providers
Supabase handles sign-in, your email address, and authentication. Cloudflare hosts the application, the library database and uploaded PDFs. API keys you add are encrypted before storage; the server decrypts them only to make requests to the corresponding provider.
When you request a quiz, Aria sends source passages and, for grading, relevant answers to your selected AI provider. Chat sends your question and prior answered exchanges in that conversation. Saving text and takeaways does not itself send them to an AI provider. Uploading a PDF reads its text in your browser; Aria sends the PDF to your AI provider only if you choose to have AI read it.
OpenRouter routes requests to the model host it selects. Providers apply their own privacy and retention policies. Do not submit information you are not permitted to share with them. Your provider bills API usage to your account.
Export and deletion
Use Export my library while signed in to download documents, quizzes, attempts, and chats as JSON Lines. API keys and authentication tokens are excluded. PDFs aren’t in that file; download each from its document’s menu.
“Delete library data” removes documents and their PDFs, chats, quizzes, progress, takeaways, preferences, and saved AI keys from the active database. Your sign-in account remains. “Delete account”, on the web or in the mobile app, removes all of that and the sign-in account itself.
Daily usage records expire after seven days and are removed on subsequent usage checks. Short-lived request records prevent duplicate requests and abuse. Copies in database backups may remain until those backups expire. Deleting Aria data does not delete copies already processed by an AI provider.
Browser storage and logs
Aria uses authentication cookies and saves display preferences in your browser. Application error logs use categories rather than chat text or API keys. Hosting services may also record request metadata for operation and security.