◆ Arc

Privacy Policy

Effective date: June 3, 2026
Last updated: June 4, 2026

This Privacy Policy ("Policy") describes how Joswin P Satheesh, sole proprietor, operating under the laws of the Republic of India ("Arc," "we," "us," or "our"), collects, uses, shares, and protects personal information about users ("you," "your") of the Arc mobile application and related services (collectively, the "Service").

By using Arc, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, do not use the Service.

Grievance contact (DPDP Act 2023): Joswin P Satheesh, Grievance Officer · Email: arc.app.contact@gmail.com · Postal: Kottayam, Kerala, India (full address available on written request). We acknowledge grievances within 7 days and respond substantively within 30 days.

1. Scope and Applicability

This Policy applies to all users of Arc globally. Additional jurisdiction-specific provisions appear in Section 15 (Regional Privacy Rights). If you are located in India, the European Union, United Kingdom, California, Brazil, or Canada, please review those provisions in addition to the rest of this Policy.

2. Information We Collect

2.1 Information You Provide During Onboarding

2.2 Information You Generate Through Use

2.3 Information Collected Automatically

2.4 Information Collected If You Choose to Sign In (Optional)

Arc is anonymous by default. If you choose to sign in — an optional step that lets your data follow you to a new device or reinstall — we collect the following from your authentication provider:

You can use Arc fully without ever signing in. Signing in is offered only as a means to back up your identity, streak, and history across devices, and to recover your account if you reinstall the app.

2.5 Information We Do NOT Collect

3. How We Use Information

We process the information above only for the following purposes:

4. Legal Bases for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

5. Artificial Intelligence Processing

Arc uses one third-party AI service to generate personalised content. You should know how this works.

5.1 What AI service we use

We currently use Google Gemini (model: gemini-2.5-flash-lite) via Google's Generative Language API. All AI calls are proxied through our Supabase Edge Functions; the AI provider never sees your IP, device ID, or any identifier we don't explicitly send.

5.2 What we send to the AI provider

When generating content, we send only the following minimal context:

5.3 What we never send

We do not send your anonymous user ID, your email address, your IP address, your push token, your timezone, your device information, your subscription status, your name, or any payment data to the AI provider.

5.4 AI provider's data practices

Google contractually agrees, under its Generative Language API terms, that data sent via the API is not used to train Google's foundation models. See Google Gemini API Additional Terms.

5.5 Storing AI output

AI-generated content (your daily action texts, milestone messages, weekly insights) is stored in our database alongside the rest of your data so you can revisit it. It is deleted when your account is deleted.

6. How We Share Information

6.1 Service Providers (Data Processors)

We share personal data with the following third-party processors solely to operate the Service. Each is contractually bound to use your data only for the purposes we authorise:

6.2 Legal and Regulatory Disclosures

We may disclose personal data when we believe disclosure is necessary to:

6.3 Business Transfers

If Arc is acquired, merged with another entity, or its assets are transferred, your personal data may transfer to the new owner. We will notify you via in-app notice at least 30 days before your data becomes subject to a different privacy policy.

6.4 What We Never Do

7. International Data Transfers

Arc's primary infrastructure is hosted by Supabase in the European Union, with Edge Functions running in the same region. AI calls to Google Gemini and push notifications via Expo Push / FCM are processed in the United States. If you access the Service from outside these regions, your data is transferred to and stored in them.

For users in the EEA, UK, and Switzerland: we rely on Standard Contractual Clauses (Module 2 — Controller-to-Processor) approved by the European Commission for transfers to processors outside the EEA. A copy of these safeguards is available on request at arc.app.contact@gmail.com.

8. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

How to exercise these rights: Email us at arc.app.contact@gmail.com with the subject "Privacy Rights Request." We will respond within 30 days (extendable to 60 days for complex requests).

You can also reset all your data inside the app: Profile → Become someone else. This wipes your identity, streak, action history, and all check-ins. Because the Service is anonymous by default, this effectively deletes your personal data from your perspective; the anonymous user record on the server is purged within 30 days unless retention is required by law.

9. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Policy:

10. Children's Privacy

Arc is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.

If we become aware that we have inadvertently collected data from a child under 13, we will delete the data immediately. If you believe a child has provided us with personal information, please contact us at arc.app.contact@gmail.com.

For users between 13 and the age of legal majority in their jurisdiction (typically 18), the Service should only be used with parental or guardian consent and supervision. Where required by applicable law (e.g. GDPR-K in some EU member states which sets the digital age of consent above 13), parental consent is required before processing personal data.

11. Security

We implement reasonable technical and organisational safeguards to protect your personal data:

No security measures are perfect. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities within 72 hours (or as required by applicable law).

12. Cookies and Local Storage

The Arc mobile application does not use cookies. We use the following local storage technologies on your device:

You can clear all of this by uninstalling the app or by clearing app data in your device settings.

13. Third-Party Services and Links

The Service may link to third-party websites — including AI provider terms (Google), Supabase, Expo, and Google Play. We are not responsible for the privacy practices of those websites. Please review their privacy policies separately.

14. Changes to This Policy

We may update this Policy from time to time. When we do:

Previous versions are available upon request.

15. Regional Privacy Rights

15.1 India (DPDP Act 2023)

If you are in India, your personal data is processed in accordance with the Digital Personal Data Protection Act 2023. You have the right to:

Grievance Officer: Joswin P Satheesh. We acknowledge grievances within 7 days and substantively respond within 30 days. If your grievance is not resolved, you may approach the Data Protection Board of India under Section 27 of the DPDP Act 2023.

15.2 European Economic Area, United Kingdom, and Switzerland

In addition to the rights described in Section 8, you have the right to lodge a complaint with your local supervisory authority. For EU residents, see the EDPB member directory. For UK residents, see the Information Commissioner's Office.

EU/UK Representative: Arc currently does not have an appointed EU/UK Representative under GDPR Article 27. If you are an EU or UK resident and require a local point of contact, please email arc.app.contact@gmail.com. We will appoint a representative if our user base in those jurisdictions makes it legally required.

15.3 California (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Categories of personal information collected in the past 12 months (per CCPA definitions): identifiers (anonymous user ID, push token), internet activity (action completion patterns), inferences (energy averages, completion rates), commercial information (subscription status). We do not collect categories listed in subdivisions (a)(9) or (10) of CCPA (biometric, sensitive personal information).

To exercise these rights: email arc.app.contact@gmail.com with subject "California Privacy Rights Request."

15.4 Brazil (LGPD)

If you are a Brazilian resident, you have rights under Lei Geral de Proteção de Dados including the rights described in Section 8. You may file complaints with the Autoridade Nacional de Proteção de Dados (ANPD).

15.5 Canada (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act, including access to your personal information and the ability to challenge its accuracy. Complaints may be filed with the Office of the Privacy Commissioner of Canada.

15.6 Australia (Privacy Act 1988)

If you are an Australian resident, you have rights under the Australian Privacy Principles. Complaints may be made to the Office of the Australian Information Commissioner.

15.7 South Africa (POPIA)

If you are a South African resident, you have rights under the Protection of Personal Information Act 4 of 2013, including the right to lodge a complaint with the Information Regulator.

15.8 Other Jurisdictions

Users in jurisdictions not listed retain the rights described in Section 8 and any additional rights granted by local law.

16. Do Not Track Signals

Arc is a mobile application and does not engage in cross-site tracking. Mobile platforms (Android) provide their own privacy controls (App permissions, OS-level notification controls) which Arc respects.

17. Contact Information

For privacy-related questions, complaints, or to exercise your rights:

We aim to respond to all privacy inquiries within 7 business days, and formal rights requests within the timeframes specified in applicable law.

© 2026 Arc — Joswin P Satheesh. All rights reserved.

Home Terms of Service Contact