Privacy Policy

Information Arc handles

• Account and connection information. This may include your email address, Google authorization details, granted scopes, and encrypted OAuth tokens needed to maintain your connection.
• Gmail information. With your permission, Arc reads a bounded portion of Gmail data needed to identify and present relevant threads or messages. Arc requests the Gmail read-only scope and does not use that access to send, delete, archive, or modify Gmail messages.
• Arc product information. Arc may retain product states such as saved references, handled status, carry horizons, entitlement status, and feedback you choose to submit.
• Transaction information. Stripe processes checkout and payment information. Arc may receive transaction identifiers, subscription state, plan, and related entitlement information, but Arc does not receive or store complete payment-card numbers.
• Technical information. Hosting and application systems may process request metadata, timestamps, diagnostic events, and security logs needed to operate and protect the service.

How Arc uses information

Arc uses information to:

• authenticate and maintain a connection you request;
• produce your Arc pass and display privacy-bounded product cards;
• save product state and provide features associated with your plan;
• process purchases, prevent abuse, troubleshoot failures, and secure the service;
• respond to support, privacy, or legal requests; and
• improve Arc using feedback and privacy-bounded operational information.

Google user data and Limited Use

Arc’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve the user-facing features you request. Arc does not sell Google user data, use it for advertising, or transfer it for advertising, creditworthiness, lending, or other unrelated purposes.

Human access to Google user data is prohibited except when you give specific consent, when needed for security or abuse investigation, when required by law, or when the data has been aggregated and anonymized for internal operations.

Google API Services User Data Policy

AI processing

When an AI-assisted Arc feature is explicitly enabled, Arc may send bounded, redacted signals to a configured AI provider to propose classifications or language. Arc remains responsible for the product decision and limits those signals to what the feature requires. Arc does not use Gmail data to train a general-purpose advertising model.

Service providers and disclosures

Arc relies on service providers for functions such as hosting, databases, authentication, AI processing when enabled, payments, security, and diagnostics. These providers may process information on Arc’s behalf under their own contractual and security obligations. Current core providers may include Google, Vercel, Stripe, OpenAI, and hosted database infrastructure.

Arc may also disclose information when you direct us to, to protect users or the service, in connection with a business reorganization subject to appropriate safeguards, or when legally required. Arc does not sell personal information.

Retention, disconnection, and deletion

Arc retains information only for as long as reasonably needed to provide the service, maintain security and records, comply with law, and resolve disputes. Retention may vary by record type and by the features you use.

Disconnecting Gmail through Arc deletes the encrypted Google OAuth token row Arc stores for the connected account. It does not delete or modify Gmail messages. Other Arc product records may remain unless they expire under the product’s stated horizon or you request their deletion.

To request access, correction, or deletion of Arc-held information, contact ej3434@gmail.com. We may need to verify the request before acting on it.

Security

Arc uses reasonable administrative, technical, and organizational measures designed to protect information, including encrypted storage for Google OAuth tokens. No method of transmission or storage can be guaranteed completely secure.

Children

Arc is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy as Arc changes. We will post the updated policy here and revise its effective date. Material changes may also be communicated through the service or by another reasonable method.

Contact

Questions or privacy requests: ej3434@gmail.com