Legal

Privacy Policy

Last updated: August 10, 2026

This Privacy Policy explains what information Aurum (“we,” “us,” or “our”) collects, how we use it, and the choices you have. We keep it deliberately minimal — we collect only what we need to run the Service, and we do not sell your personal information.

1.Information we collect

Account information

When you create an account, we collect your email address and a password. Passwords are never stored in plain text — they are cryptographically hashed. If you sign in with Google, we receive your email address and basic profile information, including your name, from Google, and Google receives your IP address and browser information whenever a sign-in page loads. As you use the Service we also keep records on your account — whether your email address has been verified, your subscription status and Stripe customer reference, and a record of which introductory emails we have sent you and whether you have unsubscribed.

Payment information

Subscription payments are processed by Stripe. We do not collect or store your full card number, CVC, or bank details — Stripe handles that directly. We retain limited billing records (such as your subscription status, plan, and a Stripe customer reference) needed to manage your subscription.

Usage & technical data

The Aurum application itself does not store your IP address. Your address is held briefly in memory to rate-limit sign-in attempts and password-reset requests — a defence against someone trying to guess your password or flood your inbox — and is discarded within minutes. It is never written to disk, never linked to your account, and never used to build a profile of you.

Our hosting provider (Railway) and other infrastructure providers keep their own connection logs, which typically include IP addresses and access times, under their own policies. We run no analytics software, advertising tags, session recording, or third-party tracking of any kind on the Service.

Cookies

We use a single essential session cookie to keep you logged in. It is not used for advertising, and we do not run third-party advertising or cross-site tracking. Without this cookie, you could not stay signed in.

Third-party content

Some pages load resources hosted by third parties — Google’s sign-in library on our sign-in pages, and Google Fonts on parts of the Service. Because your browser requests those files directly, Google receives your IP address and browser information when such a page loads, whether or not you sign in with Google. This is not advertising and sets no advertising cookie, but it is a disclosure to Google and we say so here.

2.How we use your information

to create and secure your account and authenticate your sign-ins;
to provide, maintain, and improve the Service;
to process subscriptions and payments through Stripe;
to communicate with you about your account, security, and important service changes;
to send you a short series of introductory emails about the Service in your first two weeks, which you can stop at any time;
to send members new research papers by email as they are published;
to detect, prevent, and address fraud, abuse, and technical issues; and
to comply with legal obligations.

3.How we share information

We do not sell your personal information. We share it only in these limited cases:

Service providers who help us operate the Service — for example Stripe (payments), our hosting provider (Railway), Resend (delivery of the emails we send you), Google (sign-in and web fonts), and market-data providers — and who are permitted to use your data only to provide services to us;
Legal & safety reasons, when required by law or to protect our rights, users, or the public; and
Business transfers, such as a merger, acquisition, or sale of assets, in which case we will notify you of any change in how your information is handled.

4.Data retention

We keep your account and billing information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.

5.Security

We protect your information with measures including cryptographic password hashing, encrypted connections (HTTPS/TLS), and not storing card data on our servers. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.

6.Your rights & choices

You may access or update your account information, or request that we delete your account and associated personal data, by contacting us at support@aurumterminal.net. Depending on where you live (for example, under the GDPR or CCPA), you may have additional rights such as access, correction, deletion, and portability, and the right not to be discriminated against for exercising them. We will honor valid requests as required by applicable law. You can stop our introductory and other non-essential emails at any time using the unsubscribe link at the bottom of those messages, or by emailing us; we will still send you essential account, security, and billing messages.

7.Children

The Service is not directed to and may not be used by anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

8.International users

The Service is operated from the United States and hosted on infrastructure that may be located in the United States. If you access the Service from outside the U.S., you understand your information may be processed in the U.S., where data-protection laws may differ from those in your country.

If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with your local data-protection supervisory authority.

9.Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide reasonable notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

10.Contact

The person responsible for your information under this policy — the “data controller” for the purposes of the GDPR and equivalent laws — is Logan Brendsel, an individual based in the United States, operating Aurum Terminal.

Questions or requests about your privacy, including access, correction, or deletion, go to support@aurumterminal.net and reach him directly.

See also our Risk Disclaimer and Terms of Service.