Privacy Notice

This page explains how Arclify handles personal data when you install and use the app, create an account, start a trial, or purchase a subscription.

1. Who is responsible for your data?

2. What data Arclify collects

Depending on how you use the app, Arclify may process:

• Account & identifiers
  • Email address (for account login and support)
  • User ID (internal identifier)
  • Optional profile fields you provide (e.g., display name)
• App usage & habit data
  • Routines/habits you configure (e.g., training, focus, reading, evenings)
  • Your check-ins, completion history, streaks, XP, weekly review inputs
  • App settings (e.g., notification preferences if you enable them)
• Purchase and subscription data
  • Subscription plan selection (season vs monthly)
  • Trial start/end status
  • Purchase status (active/canceled/renewed)
  • Note: Payments are processed by the app stores. Arclify does not receive your full card details.
• Device and technical data
  • App version, device type/OS version
  • Diagnostics data (e.g., crash reports) where available
  • Approximate region/timezone information (to schedule seasons and notifications correctly)
• Support communications
  • If you contact support, I receive the content of your message and your contact details.
• Website analytics (marketing site)
  • On the Arclify website I record event-level activity with no identifier attached: one row per page view, link/redirect click (e.g. "Open App Store"), email signup, or scroll/stay signal, plus a coarse traffic-source label, and on the self-assessment page also your country (country level only), whether you arrived in an in-app browser, and which headline you were shown. I only ever read it as counts.
  • This on-site analytics is not tied to you personally: it stores no cookies or identifiers on your device and uses no persistent or per-visitor ID. As with any web request, my server (and my hosting/CDN provider) briefly receives technical connection data such as your IP address; I do not store it alongside the analytics counts and I do not use it to single you out or follow you across sites.
  • When you arrive through one of my ad links (for example arclifyapp.com/start), my edge worker keeps a click log (stored with Cloudflare, my hosting/CDN provider), used for campaign measurement and diagnostics. Each entry records which link was used, the time, the referring page, your browser's user-agent string, your country (country-level only, derived at my CDN provider's edge - never the IP address itself), and, if you arrived from a Meta ad, the ad-click ID (fbclid) that Meta appended to the link. The fbclid is an identifier Meta can match to its own record of your ad click; it is not linked to any Arclify account. This log contains no name, email, or account data, and entries are deleted automatically after three months.
  • If you submit one of the website email forms, it is protected by a bot/spam check (Cloudflare Turnstile).
• Website self-assessment
  • If you take the self-assessment on the website, the answers you tap and the resulting pattern label are recorded. If you then submit your email address to receive your result, those answers and that label are stored together with your email address, so I can send you the right result and keep what follows relevant to what you described. That record also stores which headline you were shown and which ad link or campaign you arrived through. When you ask for your result, you are also asking for a few short follow-up emails from me, about two a week. There are five at most, and then they stop. They include Arclify offers, and every one has a one-click unsubscribe.
  • These are your own answers about how your week tends to go. They are not health data, and they are not linked to any Arclify app account.
  • If you leave the assessment without submitting your email address, nothing from it is stored against you: the page counts only that the page was opened, and that an assessment was started and finished (recording your country at country level, whether you arrived in an in-app browser, and which headline you were shown), with no identifier attached.
• Advertising (Meta pixel)
  • To run and measure my Meta (Facebook/Instagram) ads, the website can load the Meta pixel. When active, it sends Meta a limited set of website interaction events - that a page was viewed, and that the "Open App Store" button was tapped - together with the standard technical data your browser sends with any request (IP address, browser/user-agent) and a Meta cookie identifier, plus the ad click ID (fbclid) if you arrived from an ad.
  • It does not send Meta your account, email, habit, or in-app data. The data it does send is used to measure and optimise my ads and to build advertising audiences - including retargeting and lookalike audiences - and Meta also uses it for its own advertising purposes (see section 4).
  • In the EU/EEA and the UK the pixel is off by default. It loads, and data is shared with Meta, only if you accept the marketing-cookies banner; if you decline, no pixel loads and nothing is sent to Meta. In other regions the pixel loads by default and you can opt out at any time (see section 8a).

I do not intentionally collect special categories of data (such as health information, religion, political opinions, etc.). Please do not store sensitive personal details in free-text fields.

3. Why Arclify uses your data and on what legal basis

• Providing the app and core functionality
  • Creating and maintaining your account
  • Saving your season data and progress
  • Delivering features you use (tasks, XP, streaks, weekly review)
  • Legal basis: performance of a contract (GDPR Art. 6(1)(b))
• Subscriptions, trials, and access control
  • Enabling your 7-day trial
  • Checking purchase status to unlock paid features
  • Handling renewals/cancellations and entitlement status
  • Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and legal obligation where required (GDPR Art. 6(1)(c))
• App security and abuse prevention
  • Protecting accounts and preventing misuse
  • Maintaining service reliability
  • Legal basis: legitimate interests (GDPR Art. 6(1)(f))
• Analytics and product improvement
  • Understanding which features work and where users drop off
  • Fixing bugs and improving stability
  • Measuring website and campaign performance (see "Website analytics" above)
  • Legal basis: legitimate interests (GDPR Art. 6(1)(f))
  • Because this on-site website analytics does not store or read information on your device, my position is that it does not require cookie consent under the ePrivacy rules. (The Meta pixel below is different - it does store/read on your device, so it is consent-based.)
• Advertising (Meta pixel)
  • Running, measuring and optimising my Meta ad campaigns, and building advertising audiences (including retargeting and lookalike audiences), using the Meta pixel. Meta also uses the data for its own advertising purposes (see section 4).
  • Legal basis (EU/EEA and UK): your consent (GDPR Art. 6(1)(a)), given through the marketing-cookies banner and withdrawable at any time. Because the pixel stores and reads information on your device, it requires consent - which is why the banner exists.
  • Outside the EU/EEA and UK the pixel operates under applicable local rules, and you can opt out at any time (section 8a).
• Spam and bot prevention (website)
  • Protecting the website email signup forms from automated abuse using Cloudflare Turnstile
  • Legal basis: legitimate interests (GDPR Art. 6(1)(f))
• Email communications
  • Transactional emails (account, security, purchase-related)
  • Legal basis: contract (GDPR Art. 6(1)(b))
  • Optional marketing/nurture emails (if you explicitly sign up on the website, or ask for your self-assessment result by email)
  • Legal basis: consent (GDPR Art. 6(1)(a))
  • Using your website self-assessment answers to decide which of these emails you are sent, so what you receive matches the pattern you described rather than being the same for everyone
  • Legal basis: consent (GDPR Art. 6(1)(a))
  • You can unsubscribe from marketing emails anytime.
  • Your opt-in is recorded when you ask for your result, with the moment and the version of the wording you saw, and you can withdraw it with the unsubscribe link in every email.

4. Who can access your data (recipients)

I don't sell or rent your data.

Your data may be handled by trusted third parties needed to operate Arclify.

Processors (they process data on my instructions and are bound by data-processing agreements):

• Supabase (backend and database - storing your account and season data; also receives the website analytics events)
• Resend (email delivery - for transactional and marketing emails)
• RevenueCat (subscription and entitlement management)
• Cloudflare (website hosting/delivery, the ad-link click log, and bot/spam protection on the website email forms via Turnstile)

Independent controller: Apple acts as an independent controller - the seller/merchant of record - for App Store payment, billing, and subscription processing, under Apple's own privacy policy, not on my instructions.

Joint controller (advertising): where the Meta pixel is active (see sections 2 and 8a), Meta Platforms Ireland Limited acts as a joint controller with me for the collection and transmission of the pixel data, under Meta's Privacy Policy and Meta's controller addendum. In plain terms: I am responsible for asking for your consent and for what happens on this website; Meta is responsible for what it does with the data once it receives it. Meta processes this data in the United States, so for EU/EEA and UK users it involves a transfer to the US, made under the EU Standard Contractual Clauses / UK Addendum and, where Meta is certified, the EU-US Data Privacy Framework. For EU/EEA and UK users this sharing and transfer happen only if you accept the marketing-cookies banner.

Some providers may be located outside the EU/EEA/UK (for example, in the United States). When that happens, I rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified.

5. How long Arclify keeps your data

• Account and season data: kept while your account is active.
• Subscription records: retained as needed for accounting/legal obligations.
• Support communications: kept as long as needed to resolve issues and maintain a support history.
• Marketing email list (website): kept until you unsubscribe or request deletion. If you unsubscribe, your self-assessment answers and your pattern label are erased and your email address is kept only as a do-not-contact record, so that I do not email you again.
• Self-assessment entries not on the follow-up emails: if you asked for your result before the follow-up emails existed, or were never signed up to them, your answers, pattern label and the campaign details stored with them are erased after 30 days, and your email address is deleted after 12 months. This does not apply if you unsubscribed (the bullet above covers that) or if you went on to create an Arclify account.
• Website analytics: kept as event-level rows (for example, one row per page view or click) that carry no identifier and are not linked to any individual.
• Ad-link click log: entries are deleted automatically after three months (see "Website analytics" in section 2).

5a. Deleting your account

You can permanently delete your account at any time from inside the app (in the app settings, and also from the paywall screen - so you can delete your account even if your subscription has expired). This permanently deletes your account and the personal data associated with it - it is a full deletion, not a deactivation.

You can also ask me to delete your data by email. If you delete your account or request deletion, I will delete or anonymize your personal data unless I must keep certain data to comply with legal obligations (e.g., accounting records).

6. Is providing your data mandatory?

• To use Arclify, you must provide an email address to create an account.
• Habit/routine data is required for the core experience (otherwise the app can't function as designed).
• Marketing email signup is optional.

7. Your privacy rights

If you are in the EU/EEA or the UK, you have the following rights regarding your personal data:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to withdraw consent (for marketing emails or other consent-based processing)
• Right to object (in certain cases, including direct marketing)

To exercise these rights, email: [email protected].

Wherever you live, and regardless of which laws apply to you, I will honour requests to access, correct, or delete your personal data, and you can unsubscribe from marketing at any time.

You also have the right to complain to your data protection authority - for example: Hungary (NAIH), the UK (Information Commissioner's Office, ICO), Australia (OAIC), or Canada (OPC); if you are in the EU/EEA you may use your local supervisory authority. If you are a California resident, you have rights under the CCPA/CPRA, including the right to opt out of the "sale" or "sharing" of your personal information. I do not sell your personal information for money. However, when the Meta pixel is active, the resulting data flow to Meta may count as "sharing" for cross-context behavioural advertising under California law. You can opt out at any time using the "Your Privacy Choices" link in the site footer, which stops the pixel loading on future visits.

8. How Arclify protects your data

• Reputable providers with appropriate security practices
• Access controls (limited to me as the solo developer)
• Strong authentication and protected accounts/devices

No online service is 100% secure, but I aim to minimise unnecessary risk.

8a. Cookies and tracking technologies

My on-site website analytics stores nothing on your device and uses no cookie or per-visitor identifier, so it does not build a profile of you and needs no consent. As with any internet request, my servers and my hosting/CDN provider (Cloudflare) briefly receive technical connection data such as your IP address; I do not store it alongside the analytics counts or use it to identify you.

To run and measure my Meta (Facebook/Instagram) ads, the website can also load the Meta pixel - an advertising/marketing technology. When active it sets a Meta cookie (for example _fbp) and sends Meta a limited set of interaction events plus standard technical data (see "Advertising (Meta pixel)" in section 2). This is a marketing cookie and needs your consent under the ePrivacy rules:

• EU/EEA and UK: the pixel is off by default. You are shown a marketing-cookies banner that names Meta; the pixel loads only if you choose "Accept." If you choose "Decline," no Meta cookie is set and nothing is sent to Meta. You can change your choice any time via the "Your Privacy Choices" link in the footer.
• Other regions (e.g. US, Canada, Australia): the pixel loads by default. You can opt out any time via the "Your Privacy Choices" link in the footer, which stops it loading on future visits. California residents: see section 7.

Your banner choice itself is remembered in your browser as a single local-storage entry (arclify_consent_v1) holding only your accept/decline decision; it is strictly necessary to honour your choice and needs no consent.

The other third-party technology the website loads is Cloudflare Turnstile, a privacy-friendly bot/spam check that runs only on the email signup forms. To protect the site and those forms from abuse, Cloudflare may set a strictly-necessary security cookie (for example, its bot-management cookie); strictly-necessary security cookies do not require consent.

Fonts are served from the Arclify website itself, so no third-party font provider receives your data. Inside the app, only the technical storage needed to keep you signed in and run the app is used.

9. Children

Arclify is not intended for children under 16. If you believe a child has provided personal data, contact me and I'll address it.

10. Updates to this notice

I may update this notice as the app evolves. I will update the "Last updated" date below, and for major changes I may notify users.

Last updated: 9 August 2026