Privacy Policy

1. What We Collect

• Account information: email address, display name, password (encrypted).
• Financial tracking data you enter: subscription names, amounts, billing cycles, renewal dates, categories — entered manually or imported via CSV bank statement upload.
• Payment information: processed entirely by Stripe. We never see or store your full card number. We store your Stripe customer ID and subscription status only.
• Usage data: basic analytics such as referral source, pages visited, and general usage patterns, including affiliate referral attribution (a cookie storing which affiliate link, if any, referred you — expires after 30 days).
• Affiliate payout information (if you're an affiliate): PayPal email or bank transfer details, visible only to you and to ARCA's administrator.

2. How We Use Your Information

To provide and improve the Service; to process payments and manage your subscription; to send renewal alerts and account-related emails; to calculate and pay affiliate commissions where applicable; and to comply with legal obligations.

3. Third-Party Processors

We share data with the following third parties strictly to operate the Service:

• Stripe — payment processing
• Supabase — database and authentication hosting
• Vercel — application hosting
• Resend — transactional email delivery (renewal alerts, account notifications)
• Anthropic — if you use the statement-scan feature, uploaded content may be processed by Anthropic's API to power that feature

We do not sell your personal data to third parties.

4. Data Retention & Deletion

We retain your data for as long as your account is active. You can delete your account at any time from Settings, which will delete or anonymize your personal data, subject to what we're legally required to retain (e.g., transaction records for tax/accounting purposes).

5. Your Rights

If you are located in the EU/EEA or another jurisdiction with data protection laws, you have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact us at [privacy email] to exercise these rights.

6. Cookies

We use essential cookies for authentication and session management, and a referral-tracking cookie for the affiliate program (expires after 30 days).

7. Data Security

We use industry-standard security practices, including encrypted connections (HTTPS), Row Level Security on our database, and restricted access to sensitive data such as affiliate payout details. No system is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

ARCA is not intended for anyone under 18. We do not knowingly collect data from minors.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify users of material changes via email or an in-app notice.

10. Contact

Questions about this Privacy Policy or your data: [privacy email]