Privacy Policy

Effective 15 October 2026

AuraCoLiving ("we", "us") runs a marketplace where people list and find rooms, flats and flatmates. This policy explains what personal data we collect, why, who can see it, and the rights you have under India's Digital Personal Data Protection Act, 2023. The short version: we collect only what the service needs, we never sell your data, and nobody sees your phone number unless you agree.

1. What we collect

When you sign in

• Email address, from your email sign-up or your Google account. If you use Google, we also receive your name and profile picture from Google. We do not get your Google password or access to anything else in your Google account.
• Full name and mobile number (required before you post a listing or contact an owner) and company (optional).
• A password, only if you choose to set one. It is stored only as a one-way secure hash by our sign-in provider, so nobody, including us, can read it.

Optional profile details

• Age, gender, city of work, team, office area, smoking/drinking and food preferences, usual wake and sleep times, and monthly budget. You choose what to fill in.

When you list a property

• Property details (type, rent, costs, rules, amenities, description), photos, and its locality and city. These are public so renters can find the listing.
• Your contact number for the listing and the full street address. These are private (see section 3).
• Before a listing goes live, every photo is checked for people, explicit content, weapons and whether it shows a property. Photos are stored privately until they pass, and photos that break these rules are deleted.

Ratings

• After a contact request is accepted, the renter and owner can rate each other (stars and an optional short comment), and the person rated can reply once. If the owner marks the request as rented, the rating is labelled "Stayed here".

Chat

• The messages you send in a chat, with the time they were sent, and whether you chose to share your number in that chat.

Alerts

• Searches you save for alerts (the filters and a name). Owners only ever see a total count of people searching in a city, shown once at least 3 people are, never who.

When you report a listing

• The reason and any details you give. The listing owner is not told who reported it.

When you request contact

• The listing you asked about, your optional message, and the status of the request.

Technical data

• Our providers keep standard security logs (such as IP address and time of sign-in) to protect accounts and prevent abuse.
• Your browser stores a few preferences on your device only: theme, last city searched and saved homes. We use no advertising or tracking cookies.
• We count visits with Vercel Web Analytics, which uses no cookies and doesn't identify you. It records the page visited, the referring website, and your country, device type and browser, so we can see which pages are useful. Visitors can't be tracked across days or other websites.
• If you tap "Use current location", your device's coordinates are sent to OpenStreetMap's lookup service to find your locality. We do not store the coordinates.

2. Why we use it

• To create and secure your account, and to email you about contact requests, messages and your listings (you can turn these emails off in your profile).
• To show your listings to renters and to run contact requests between renters and owners.
• To keep the platform safe and lawful: checking photos before they are published, reviewing reported listings, and preventing spam, fake listings, scraping and abuse (for example, limiting how many contact requests one person can send per day).
• To reply when you contact us.

We rely on your consent, which you give by ticking the box when you complete your account (confirming you are 18 or older), and when you choose to share details such as your number. We record the date and the version of this policy you agreed to. You can withdraw consent at any time (see section 6).

3. Who can see what

• Everyone: listing details, photos, locality and city.
• An owner, when you request their contact: your name, company and message. You are told this before you send the request.
• Both sides, only after the owner accepts: a private chat. Your mobile number is shown to the other person only if you tap "Share my number" in that chat, and you can stop sharing at any time. The full address is shown to the renter once the owner shares their number.
• Chat messages: only the two people in the conversation. Our team reads a conversation only if one of you reports it, to review the report.
• Everyone: ratings and comments renters give about a listing and its owner, shown with the renter's first name and last initial, and the owner's reply. Averages appear only after 3 ratings.
• Only owners a renter contacts: the ratings other owners gave that renter. Renter ratings are never shown publicly.
• Ratings stay hidden from everyone until both people have rated, or 14 days pass, so neither side can retaliate.
• Only you: your profile details, your mobile number (until you choose to share it in a chat), and your request history.
• Our team: may access data only to run the service, verify listings, or handle a complaint or legal request.

We do not sell, rent or trade personal data, and we do not use it for advertising.

4. Service providers

We use these providers to run AuraCoLiving. They process data only on our instructions:

• Supabase: database, sign-in and photo storage. Our database is hosted in Mumbai, India.
• Vercel: website hosting and privacy-friendly visit counts (no cookies).
• Resend: delivery of account and notification emails.
• Cloudflare Turnstile: protects sign-in from bots. It checks your browser and IP address for automated activity when you sign in; it does not track you across other websites.
• Google: sign-in, only if you choose "Continue with Google".
• OpenStreetMap (Nominatim): address lookup, only if you tap "Use current location".
• jsDelivr and Google Fonts: deliver website code and fonts, so they see your IP address when pages load.

Some of these providers may process data outside India. We choose providers with strong security practices.

5. How long we keep it

• Account and profile data: while your account is active.
• Listings: while active; listings you mark as occupied stay hidden from search and are kept for your records until you delete them or your account.
• When you delete a listing, it disappears from AuraCoLiving immediately and its photos are deleted. We keep a hidden copy of its details for 180 days to respond to lawful requests, then delete it. If the listing has ratings, the hidden copy is kept as long as those ratings are, because they belong to the owner's and renters' track record.
• Contact requests: while either person's account is active.
• Saved searches (alerts): stop after 90 days and are deleted 30 days later, or straight away when you delete them or your account.
• Chats: deleted 12 months after the last message in the conversation, or straight away if either person deletes their account. Reported conversations may be kept longer while a complaint or legal request is open.
• Ratings: while both accounts are active. If either person deletes their account, ratings between them are deleted. We may hide ratings that break our Terms of Use.
• When you delete your account, your profile, listings, photos, contact details, messages and requests are removed from AuraCoLiving immediately.
• Legal retention: Indian law requires us to keep basic records after an account is closed (IT Intermediary Guidelines Rules 2021 and DPDP Rules 2025). We therefore keep a minimal record (your name, email, mobile, company, the dates your account existed, the type, area, rent, contact number and address of your listings, and who you exchanged contact requests with and when) in a locked archive that is not visible on the site. It is used only to respond to lawful requests from authorities or to investigate fraud, and is permanently deleted after one year.

6. Your rights

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you: use Download my data on your profile page, or email us.
• Correct or update it. Most of it you can edit yourself on your profile page.
• Erase it by deleting your account on your profile page, or by emailing us (subject to the legal retention described in section 5).
• Withdraw consent at any time. This stops future processing but does not undo processing already done.
• Nominate someone to exercise these rights if you die or become unable to. Email the Grievance Officer from your account's email address with the nominee's name, relationship to you and contact details; we confirm it in writing.
• Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

To use any of these rights, email theauracoliving@gmail.com from the email address on your account. We reply within 30 days.

7. Security

All traffic is encrypted (HTTPS). Database access rules make sure each person can only read and change their own private data, and phone numbers can only be revealed one request at a time, with the owner's consent. No system is perfectly secure; if a breach affects your data, we will inform you and the Data Protection Board as the law requires.

8. Children

AuraCoLiving is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will delete the account.

9. Changes

If we change this policy in a meaningful way, we will update the date above and tell signed-in users on the site before the change applies.

10. Contact and grievances

Grievance Officer: Aditya Bansal
AuraCoLiving, Chandigarh, India
theauracoliving@gmail.com

We acknowledge privacy complaints within 24 hours and resolve them within 15 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.