Arctelia - Privacy Policy

Arctelia is operated by Arc & Bearing LLC ("we," "us," and "our"). If you have questions about this policy, contact us at hello@arctelia.app.

1. What We Collect

1.1 Account Information

When you sign up with an email address, we collect that address and a password, stored as a hash. We never see or store your actual password. If you sign in with Google, we receive your email address and display name from Google. If you sign in with Apple, we receive your name and either your email address or, if you choose "Hide My Email," a private relay address that Apple forwards to you. Apple shares your name only the first time you sign in.

1.2 Content You Create

Everything you enter into Arctelia — session logs, notes, evidence of intent, artifacts, photographs and captures, audio recordings, scribble boards, writing documents, characters and scenes, threads, map pins, and other content — is stored on our servers. This is the core of the service. We need it to show you your work and provide continuity features.

1.3 Location Data

Location reaches Arctelia in three ways, and you control each of them:

• When you ask for it. Features such as Scout, map pins, saved locations, your home location, and live conditions use the coordinates your device or browser provides at that moment. We never track your location in the background, on either platform.
• Inside photographs.A photo you upload or take in the app may carry location metadata written by your camera. We keep that metadata with the artifact and use it as the capture's location. If you do not want this, turn off location for your camera or remove location before sharing; most photo pickers offer this.
• Cached environmental data. Weather, tides, stream flow, and similar results fetched for a location are cached for a short time so the next request is faster. The cache holds coordinates and results only, not your identity.

1.4 Device and Usage Information

We collect the basic technical information needed to operate the service: browser or device type, IP address, and pages or screens requested. We use this to diagnose problems and prevent abuse.

On the website we also keep our own count of page views: the page, the site you arrived from, any campaign tag in the link you followed, your device type and country, and a one-way code derived from your IP address and browser that changes every day, so it cannot follow you across days and is never matched to an account. We use this to see which pages work and where visitors give up. It sets no cookie, and it is switched off when your browser sends Do Not Track or Global Privacy Control. We do not use third-party analytics or advertising trackers, on the web or in the app.

1.5 Payment Information

Subscription payments are processed by Stripe. We do not see or store your card number. Stripe provides us with a transaction record, your billing email, and the last four digits of your card for display purposes. Stripe's privacy policy governs their handling of your payment data.

1.6 The iPhone and iPad App

The Arctelia app asks for device permissions only when a feature needs them, and each one can be declined in Settings:

• Camera to photograph and measure your work during a session.
• Microphone to record voice notes.
• Photo library to add pictures to your work and, if you choose, to save a capture to your library. The app never reads your library without you picking a photo.
• Motion to help you hold the camera square to the work when your device has no depth sensor. Motion data stays on the device.
• Location while using the app to tag captures and show field conditions for where you are.

Field conditions in the app come from Apple Weather, so your coordinates are sent to Apple to fetch the forecast, and from the same environmental sources the web uses (section 3.3). The app stores your content in the same account as the web app. It contains no advertising or analytics software and does not track you across other apps or websites.

2. How We Use Your Data

Your data is used to provide Arctelia's services to you. Specifically:

• Storing and displaying your content within your workspace, project logs, and, only where you choose, the public Gallery
• Generating AI guidance and summaries by sending relevant portions of your entries, artifacts, and project context to the AI providers in section 3.2
• Checking uploaded images automatically so the shared Gallery stays safe (section 4)
• Fetching environmental data such as weather, tides, stream flow, species observations, and solar position for locations you provide
• Sending account-related communications such as password resets, billing confirmations, and terms or policy updates
• Sending optional practice digests if you opt in to email notifications

We do not use your data for advertising. We do not sell, license, trade, or otherwise provide your personal information or content to third parties for commercial purposes. This is a core commitment.

3. Who Receives Your Data

3.1 Infrastructure Providers

Arctelia runs on the following services, which process your data as part of operating the platform:

3.2 AI Providers

When you request AI guidance, when the system generates a summary from your entries, or when the automatic checks in section 4 run, relevant data is sent to one or more of the following providers:

This processing occurs on a per-request basis. We do not provide your content to AI providers for the purpose of training their models, and we use these providers under API terms that prohibit training on inputs. We do not train models of our own on your content. Each provider's data handling is governed by their own terms of service and privacy policies.

3.3 Location and Place Data Sources

When you use location-aware features, we send coordinates, or the area of a map you are viewing, to public and commercial data services to fetch context. These services receive location only. They do not receive your account information or your content. The full list, with what each one provides, is on the Acknowledgements page. In summary:

• Weather, water, and sky: Open-Meteo, NOAA (tides and charts), USGS (stream flow, statistics, and elevation); solar position is computed locally
• Wildlife and habitat: iNaturalist, eBird, and public range datasets that involve no request from you
• Site context for design crafts: FEMA flood data, the US Census and FCC, the EPA, OpenStreetMap, Walk Score, TomTom traffic, Foursquare and Google Places, Recreation.gov, and Wikivoyage and Wikidata
• Map tiles drawn in your browser or on your device: MapTiler, CARTO, Esri ArcGIS, and OpenStreetMap, which see the area you are viewing

3.4 AI Assistants You Connect

You can connect an AI assistant such as Claude to your Arctelia account through our connector. This happens only when you approve it on a consent screen that names the assistant and lists what it may do: read your orbits, entries, summaries, and threads, and, if you allow it, create entries and threads. A connected assistant cannot delete entries, change billing, or change account settings. You can revoke a connection at any time from your profile, and every connection is revoked when you sign out everywhere or delete your account.

3.5 No Other Third Parties

We do not share your data with advertisers, data brokers, marketing platforms, or other third parties beyond those listed above. If this ever changes, we will update this policy and notify you before any new sharing begins.

4. AI Processing - What Gets Sent and When

AI guidance is central to Arctelia, so this section explains the specifics.

When you ask. When you submit a session log or request guidance, the system may send the following to an AI provider:

• The current entry, including notes, evidence of intent, motion, and craft context
• Project summary and phase context
• Recent entries from the same project for continuity
• Structured session data such as craft log fields and conditions
• Image artifacts as time-limited signed links for vision analysis
• Audio artifacts for transcription
• Coarse location context at the city or region level, not precise coordinates

Automatically. Two checks run on their own, because they cannot wait for a button:

• Image safety.Every image you upload is sent, as a link that expires in one minute, to OpenAI's moderation model so that nothing unlawful or harmful reaches the shared Gallery. Images that fail are held for review. Text, audio, and other files are not sent for moderation.
• Capture notes. Photographs you take as session captures are sent, with your craft, the session title, and a place name, to OpenAI for a short description that tags the capture and makes it searchable in your own library.

Nothing else runs on your content in the background, and none of it trains anything. The AI providers listed above process your data under their API terms, which prohibit using API inputs for model training. We select providers whose terms include this protection. However, we cannot guarantee the internal practices of third-party providers.

5. Cookies and Local Storage

Arctelia uses cookies and browser local storage strictly for authentication and session management. We use:

• Authentication cookies set by Supabase to keep you logged in
• Local storage for UI preferences and draft state so you do not lose work if your browser closes

The iOS app keeps your sign-in in the device keychain and keeps unsent writing on the device until it can be saved. We do not use advertising cookies, social media tracking pixels, or third-party analytics cookies, and our own page-view count (section 1.4) sets no cookie at all. We do not participate in cross-site tracking.

6. Data Retention

While your account is active: All your data is retained and available to you.

If you cancel your subscription: Your account reverts to the free tier. Your data is retained but access to paid features is suspended. You can resubscribe at any time and your data will be there.

If you delete your account:You can request deletion from the web app or from the iOS app. Your account is paused immediately, connected assistants and subscription renewals are stopped, and deletion is scheduled for 30 days later. During those 30 days you can sign back in and cancel the request. After that, your entries, artifacts, projects, scribble boards, writing, saved locations, and all associated content are permanently removed and your login is deleted. We keep a hashed, unreadable record of your billing identifiers, with no personal details, for tax and fraud requirements. Stripe retains its own transaction records under Stripe's policy.

Exports: An export you request is a private archive that expires and is deleted after 7 days.

AI-generated guidance: Guidance text generated for your sessions is stored alongside your entries. It is deleted when the associated entry or account is deleted.

Backups: Automated database backups may retain deleted data for up to 30 additional days beyond the deletion date, after which it is purged.

7. Data Security

We use industry-standard measures to protect your data:

• All data is transmitted over HTTPS using TLS encryption in transit
• Passwords are hashed and cannot be read by us
• Database access is controlled through Row Level Security so queries return only data belonging to the authenticated user
• File storage for images, audio, and video uses signed links with time-limited access
• Sensitive account actions such as deletion require you to confirm your identity again
• Administrative access to production data is restricted to the platform operator

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify affected users by email within 72 hours of confirmation.

8. Your Rights and Controls

Regardless of where you live, we believe you should have control over your data. You can:

• Access your data through the application and through the Compile and Export features
• Correct your data by editing entries, projects, and account information
• Delete individual entries, projects, or your entire account, from the web or from the Account screen in the iOS app
• Export your data as an archive from your profile
• Choose, per project, whether finished work appears in the public Gallery; the default is private, and any single artifact can be kept out
• Disconnect any AI assistant you connected
• Opt out of optional practice digest emails at any time

If you are located in the European Union, you may also have rights under the GDPR including the right to data portability, the right to restrict processing, and the right to object to processing. To exercise any of these rights, contact us at hello@arctelia.app and we will respond within 30 days.

If you are a California resident, you have rights under the CCPA including the right to know what personal information is collected and the right to request deletion. We do not sell personal information. To exercise your rights, contact us at hello@arctelia.app.

9. Children

Arctelia is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Separately, our service is intended only for users who are at least 16 years old under our account rules. If we learn that a child under 13 has provided personal information, or that a user under 16 has created an account in violation of our terms, we will delete the account and associated data. If you believe this has happened, contact us at hello@arctelia.app.

10. International Data Transfers

Arctelia's infrastructure is hosted in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. By using Arctelia, you consent to this transfer. We rely on standard contractual protections and the data handling commitments of our infrastructure providers to safeguard data transferred internationally.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top and notify registered users by email. Continued use of Arctelia after changes take effect constitutes acceptance of the updated policy. We will not retroactively reduce your privacy protections without your explicit consent.

12. Contact

If you have questions about this policy, want to exercise your data rights, or need to report a concern:

Email: hello@arctelia.app

13. Governing Law

This policy is governed by the laws of the Commonwealth of Massachusetts, United States, consistent with the Terms and Conditions.