Privacy Policy

We collect only what we need to run your account and the modules:

• Account details: your email address, the username you choose, and the sign-in method you use (Google, GitHub or email and password).
• Learning data: your progress, quiz results, the specs you write and the project description you give us.
• Purchase status: whether you’ve paid, your founding seat number and order references. We never see or store your card details.
• Messages: anything you send us through the contact form or by email.
• Usage data: pages viewed and actions taken, but only if you accept analytics cookies (see below).

We use your data to give you access to the workspace, keep track of your progress, process your purchase and refunds, send account emails (verification, password reset, receipts and important changes), answer your messages and prevent abuse.

With your consent, we use analytics to understand which parts of the site and modules work and which don’t. We never sell your data or use it for advertising.

We rely on a small number of providers, each handling only what its job needs:

• Firebase Authentication (Google): sign-in and passwords. Passwords are stored and hashed by Firebase; ArcLab never sees them.
• Supabase: the database that holds your account and learning data.
• Lemon Squeezy: payments, tax and receipts, as Merchant of Record.
• Resend: sending account and support emails.
• Upstash: short-lived rate-limit counters keyed by IP address, to stop abuse.
• Vercel: hosting, plus anonymous performance metrics.
• PostHog, Google Tag Manager and Microsoft Clarity: product analytics, loaded only after you accept analytics cookies.

Two cookies are essential: __session, which keeps you signed in across this site and your workspace, and arclab_session, a marker with no personal data that tells our pages a session exists, so a leftover one can be cleared when you sign out. Your analytics choice is stored in an arclab_consent cookie shared by arclab.systems and app.arclab.systems, so you only choose once. It lasts 180 days, holds only “accepted” or “rejected”, and a copy is also kept in your browser’s local storage.

Analytics cookies are off until you accept them in the banner. You can change your choice at any time from “Cookie settings” at the bottom of every page.

All traffic is encrypted over HTTPS, access to production data is limited to the people who run ArcLab, and sessions expire automatically.

We keep your account data while your account exists. If you ask us to delete it, we remove your profile and learning data; Lemon Squeezy keeps payment records for as long as tax law requires.

You can ask for a copy of your data, a correction, or deletion of your account at any time. Email hello@arclab.systems from your account address and we’ll handle it. If you’re in the EU or UK, you can also complain to your local data protection authority.