Privacy Policy
1. Controller
The controller responsible for processing your data within the meaning of the GDPR (DSGVO) is:
Email: support@tryarcapp.com
2. This website
This site uses no cookies and no marketing tracking. We only count how
often pages are viewed and the App Store link is tapped – together with the origin (such as “Instagram”,
taken from the link parameter ?src=), the name of the referring website and the device type
(e.g. iPhone or Instagram browser). In doing so, no IP address, no device identifier and nothing on
your device is stored; individual people cannot be identified from this. The data is stored at Supabase
(database region Ireland) and passed on to PostHog for analysis (see “Usage statistics” under
section 3). The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in knowing which
channels lead to ARC. There is no consent banner because nothing is stored on or read from your device.
Fonts and images also come exclusively from our own server – the fonts DM Sans and Instrument Serif are not loaded from Google or any other provider.
The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel automatically processes technical access data in server logs (IP address, time, page requested, amount of data transferred, browser and operating system identifier), as is usual for any web server. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in the secure, trouble-free operation of the site. These logs are not merged with other data sources and are not used to recognize individual people.
3. The ARC app
If you install the app, we additionally process the following data – solely to provide the features you use.
Account and sign-in
You can sign in anonymously or via “Sign in with Apple”, Google or email. Your profile, progress and settings are stored in our database at Supabase, located in the EU region eu-west-1 (Ireland). If you use a third-party login, we only receive a user ID from Apple or Google and – if you allow it – your email address. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Personalization, core quests and evening review
The information you provide during onboarding and in the questionnaire (such as name, goal, age group, wake-up and bedtime, how much time you spend on your phone, free-text answers) and your evening reviews are stored and used to build your plan and your core quests. Legal basis: performance of a contract, Art. 6(1)(b) GDPR; for the AI processing see section 5.
Proof: photos, screenshots, camera and text
A photo or screenshot you use to prove a core quest stays on your device. For checking, it is downsized and sent once to the AI service described in section 5, which decides solely whether the task was recognizably completed. You choose a screenshot yourself via Apple's picker – ARC gets no access to your photo library, only to that one image. We do not store photos and screenshots on our servers, do not publish them, do not show them in any feed and do not use them for advertising.
With the camera counter (push-ups, squats), the app analyzes the camera image directly on the device. No image is stored or transmitted – only the counted number. Text proofs and timer, breathing and focus exercises stay on your device and in your account.
Voice input
If you dictate an answer, ARC uses Apple's speech recognition – preferably directly on the device, without audio leaving your iPhone. If your device has no offline model for your language, Apple's own server-side recognition takes over; the processing is then done by Apple under Apple's privacy terms. No audio data is transmitted to us; only the recognized text ends up in the answer field.
App lock, focus and sleep mode
The lock runs entirely through Apple's Screen Time framework (Screen Time / Family Controls) on your device. We don't learn which apps and websites you lock – Apple technically doesn't pass this selection on to us. Focus sessions and sleep mode windows are counted on the device (for example for “Time taken back”).
Instagram without Reels
If you open “Instagram without Reels” in ARC, the app loads the website instagram.com in an embedded browser window and hides Reels and suggestions there. Sign-in, password, cookies and content go directly between you and Meta; they stay in the memory of this window on your device. ARC does not read any credentials, messages or content. Meta's privacy terms apply to the processing at Instagram.
On the device: notifications, widgets, sharing, sensors
Reminders are scheduled locally on your device; there is no push server that stores a device identifier. Widgets and Live Activities read their data from the app's storage on your iPhone. Share cards are created on the device, and you decide where to send them. For small effects (shaking, tilting, flipping the phone), the app reads the orientation sensor – the values stay on the device.
School holidays
If you enter your federal state (Bundesland), the app queries the holiday dates from the open interface OpenHolidays API (openholidaysapi.org, a non-profit project with servers in the EU). Only country and federal state are transmitted – and, as with any network request, your IP address. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. Without that information, the query doesn't happen.
Usage statistics
To improve ARC, we store, linked to your account, which steps you reach in the app – such as which onboarding screen was shown, whether the purchase page appeared and whether a purchase was started, completed or canceled, plus the app version and language. Subscription events (trial week, purchase, renewal, cancellation) are reported to us by RevenueCat. This data sits in our database at Supabase. It is analyzed with PostHog (PostHog Inc., servers in Frankfurt am Main): our server sends the same events there, linked only to a random user ID, plus your onboarding answers on age group, goal and how you heard about ARC. Not included are names, email addresses, photos, chat messages, texts you write, and IP addresses; there is no analytics SDK built into the app. The data is not used for advertising and not sold. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in understanding where the app gets stuck. If you delete your account, we delete it at Supabase and at PostHog as well.
No advertising, no third-party tracking
ARC shows no advertising, contains no advertising SDK, no analytics SDK and no third-party crash reporting. PostHog analyzes the usage statistics only on our behalf. We do not sell data.
5. AI check – what exactly happens
To create your plan and your core quests and to check proof photos and screenshots, the content needed in each case is sent to an AI model: AI models from Groq, Inc. (GroqCloud; text models and an image model, e.g. Llama, GPT-OSS and Qwen). Requests do not go directly from your device to the AI provider but through our secured server (a Supabase Edge Function) – so the access key is never in the app.
Only the content needed for the respective request is transmitted: the proof image or your answers for personalization, plus progress and phase. Not transmitted are your name, email address, your user ID, chat messages or data from leagues and challenges. According to the provider, the content is not used to train models and is only held for the duration of processing.
The legal basis is your consent, Art. 6(1)(a) GDPR, which you give during onboarding. You can withdraw it at any time – the AI-assisted features (plan, photo check) can then no longer be used, and you confirm tasks yourself. The AI's verdict has no legal effect for you; it only decides whether a task counts as proven in the app.
6. Subscriptions
Subscriptions are taken out and billed through the Apple App Store. We never see payment details – they run exclusively through Apple. To manage the subscription status (is your subscription running, has it expired, was it refunded) we use RevenueCat, Inc., 1 Letterman Drive, San Francisco, CA 94129, USA. RevenueCat receives a pseudonymous user ID and the purchase receipts from Apple, no payment methods and no real names. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
If you redeem an invite code, we store the code, the time and your pseudonymous user ID (also for failed attempts, to detect abuse) and pass the unlock on to RevenueCat with the same ID. Legal basis: performance of a contract, Art. 6(1)(b) GDPR; the data is deleted with your account.
7. Recipients of your data
- Other ARC users – only what is described in section 4, and only within the circle described
- Supabase, Inc. – database, sign-in, real-time delivery, server functions (Ireland region)
- Groq, Inc. (Mountain View, CA, USA) – AI check of proof images and creation of tasks
- RevenueCat, Inc. – management of subscription status
- Apple Inc. – app delivery, payments, speech recognition (when not possible on the device) and, only if you use Apple sign-in, the sign-in
- Google Ireland Ltd. – only if you sign in with Google
- OpenHolidays API – retrieval of school holidays, only if you enter a federal state
- PostHog Inc. (San Francisco, CA, USA) – analysis of usage statistics, servers in Frankfurt am Main
- Vercel Inc. – hosting of this website
Data processing agreements under Art. 28 GDPR are in place with these service providers, insofar as they work on our behalf.
8. Transfers to the US
Groq, PostHog, RevenueCat, Supabase and Vercel are US companies. This means data is transferred to a third country. The basis for this is the EU Commission's standard contractual clauses under Art. 46(2)(c) GDPR or – where the respective provider is certified – the EU-US Data Privacy Framework under Art. 45 GDPR. Despite these safeguards, it cannot be completely ruled out that US authorities access data; we want to point that out to you openly.
9. Storage period and deletion
We store your data for as long as your account exists. You can delete your account, including all server and device data, at any time in the app: Settings → Delete account (in older versions: Profile → Delete account). Deletion is irreversible and happens immediately. Some data disappears earlier:
- Profile, friends, leagues
- until you delete your account. Removed friends disappear from your list immediately.
- Chat messages
- until you delete them or your account is deleted. Your messages and your one-to-one chats disappear with your account.
- Challenges
- 30 days after a challenge ends, it is deleted along with all values.
- Reports
- until the review is complete and for as long as necessary to detect repeated abuse. If someone deletes their account, the report remains without any connection to that account.
- Spam limits
- after one day.
- Website logs
- after the short retention periods of the host, Vercel.
10. Your rights
You have the right at any time to:
- access to your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure of your data (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on our legitimate interest (Art. 21 GDPR)
- withdraw any consent you have given, at any time and without giving reasons (Art. 7(3) GDPR)
You can also lodge a complaint with a data protection supervisory authority – the authority responsible is the one at your place of residence or at our registered office. For all requests, an email to support@tryarcapp.com is enough.
11. Children and teens
ARC is aimed at people aged 13 and over. The app is not intended for younger children; if we notice that an account belongs to a child under 13, we delete it.
Between 13 and 16 there is a special rule, and only for the AI processing from section 5: this one processing is based on your consent, and under Art. 8 GDPR in Germany a consent is only effective on its own from the age of 16. If you are younger, a parent or another legal guardian must consent.
Because many of our users are minors, the shared features are deliberately built narrowly: there is no public feed and no search by name. You can only be found by username if you have saved your profile yourself, and only with an exact entry. Only friends can write to you, not strangers from the league. Reporting and blocking work with a long press. Don't share an address, phone number or photos of yourself in chat with people you don't know.
We do not check age by ID or anything similar – that would itself be an intrusion into your data. If a parent wants us to delete or restrict an account, an email to support@tryarcapp.com is enough.
12. Changes to this policy
If something changes in the app that is relevant to data protection, we update this text and adjust the date above. The current version is always available here and in the app.