Privacy Policy

Last updated: October 27, 2026

Arc90 is a local-first habit, focus, and wellness tracker. Contact the developer at michael28gh@gmail.com with privacy questions or requests.

Local Records

Goals, profile details, habits, logs, journals, health entries, settings, and chat history are stored in browser or app storage. Proof photos use an on-device database. Local storage is not a cloud backup. Clearing site data, removing the app, or losing your device may lose your records. Exports and content you choose to share can leave the app. This version no longer accepts personal AI provider keys and removes the legacy AI key field from app records when loaded or imported.

Optional Account Sign-In

Basic tracking does not require an account. If you request an email sign-in code, your email is sent to Supabase Authentication. Supabase stores the account and manages code verification and sessions. The app keeps access and refresh tokens in session storage, with an in-memory fallback if storage is unavailable. Tokens are not included in app backups. Signing out clears the local session; it does not delete the server account. Contact the developer to request account deletion.

Hosting And Optional Analytics

Vercel hosts the website and API endpoints. Requests expose technical information such as an IP address and request details to hosting infrastructure, independently of optional analytics.

On the production website, Vercel Web Analytics counts page views. It sets no cookie and keeps no identifier for you, which is why it runs without asking. It sends page views, not app feature events or habit, journal, health, or AI content (the anonymous usage counts below go to Arc90's own server, not to Vercel Analytics). Query strings and URL fragments are removed from page-view URLs, except a short source tag from a social-media link (such as "tiktok") that says where a visit came from. Vercel can derive aggregate visit information such as device, browser, and approximate location from requests. See Vercel's analytics privacy information.

Local and native builds do not load this analytics integration; the iPhone app asks its own question about anonymous usage. Essential device storage for app records and your preference is separate from analytics consent.

Anonymous Usage

Arc90 counts a few moments to learn whether it helps people keep going: finishing setup, the first rep kept, a day with at least one rep, coming back after a quiet stretch, the day-90 choice, seeing or using the Premium offer, a confirmed purchase or restore, a change of reminder rhythm, and deleting an account. Nothing is counted until you allow it: in the app, with its one-time question or the switch in You, Data & privacy; on the website, with "Allow" in the usage-counts notice (your choice is saved locally; "Privacy choices" changes it).

Each moment is sent with a random code made on your device for this install, the day, the platform (iPhone or web), and at most two coarse details from a fixed list: the week your 90-day arc started, which part of the arc you are in (such as days 8 to 14), which Premium screen was shown, or the reminder rhythm you chose. It never includes your name, email, account, habits, tasks, notes, journal, check-ins, health or sleep data, AI messages, or anything you type. Arc90 stores no IP address with it. Counts are kept on Supabase for up to 13 months and are read only in aggregate, such as how many people who started in a week were still keeping reps a week and a month later.

Withdrawing (the same switch, or "Privacy choices" on the website) stops sending at once and deletes the code and anything waiting to be sent on your device, so a later yes starts as a new install. Counts already received carry no name or email, and once the code is gone from your device they can no longer be connected to that install.

Email Updates

When you check the email consent box and submit your address, Arc90 sends your email, consent flag, consent timestamp, and signup source to Supabase. Signup does not purchase or reserve a subscription price. The current signup endpoint saves subscriptions; it does not send newsletters. To withdraw email consent or request removal, email michael28gh@gmail.com.

Push Reminders

If you enable web push notifications, the app sends a browser push endpoint and delivery keys, a generated client identifier, reminder mode, time, and timezone offset to an API backed by Supabase. These support generic scheduled reminders delivered through your browser's push service. Turning reminders off requests deletion of the registration; this needs a working network connection. Browser notification permission can also be revoked.

Payments

When web checkout is available, Stripe processes payment and billing details. Arc90 does not receive full card numbers. Stripe webhooks store purchase verification records in Supabase, including checkout email, Stripe customer and subscription identifiers, subscription status, and billing-period details. These allow the app to check Premium access. Payment availability depends on server configuration.

Optional AI Coaching

Live chat requires a verified account. When you send a message, the app sends recent conversation messages to the Arc90 server, which checks your session with Supabase and forwards the conversation to OpenAI. Profile fields, habit records and imported Health measurements are not automatically added to this request. Information you type or paste into chat is included, so avoid sharing sensitive details you do not want processed by the provider. The AI provider credential stays on the server, not in the app.

The server uses an Upstash counter keyed by a hash of your account identifier to limit daily requests. The counter expires after 24 hours and does not contain chat text. Conversation history stays in local app storage until cleared; requests also pass through hosting and provider infrastructure under those services' retention practices. Clearing local chat does not erase information already processed by a provider.

Apple Health In The Native App

The native iOS integration requests permission to read steps, weight, sleep, resting heart rate, heart rate variability, VO2 max, water intake, active energy, exercise time, walking/running distance, flights climbed, blood oxygen, and respiratory rate. It does not request write access. Imported measurements are stored locally and are not attached to analytics, push reminders, or AI requests automatically. Measurements you type or paste into chat are sent as described above.

You can change Health access in Apple's Health or Settings app. Revoking access does not remove records already imported into Arc90. Exports you choose to create may include health records. Arc90's current integrations do not send HealthKit measurements to advertising services.

Retention And Requests

You control locally stored records and exported copies. If you signed in, you can delete your account from You › Account › Delete account; this removes your sign-in and the records tied to it on our servers. Records stored on your device stay until you use Start over. Server-side email, reminder, and entitlement records do not currently have an automatic expiry schedule. Contact michael28gh@gmail.com to request access, correction, deletion, or withdrawal of email consent. We may need information to identify the relevant record. Deleting a purchase record can affect restoration; deleting app data does not cancel a subscription. Payment and infrastructure providers may retain their own records under their policies and applicable obligations.

Depending on your location and applicable law, you may have additional privacy rights, including making a complaint to a data protection authority. Contact us to raise a request. This policy does not claim certification under a privacy law.

Service Providers And Changes

The current integrations are Vercel (hosting and optional analytics), Supabase (authentication and database), Stripe (web payments), OpenAI (live chat), Upstash (request quotas), browser push services, and Apple Health on supported native devices. Processing may take place outside your country. No advertising pixel is included in the current site code. If you believe a child has submitted personal information, contact us to request review and removal.

Changes to this page will be reflected in its update date. Review the data flows above before using an optional connected feature.