Privacy Policy

Arc Fitness (“Arc Fitness,” “we,” “our,” or “us”) is a fitness tracking app operated by Crown Haven Ventures LLC, a California limited liability company. This policy covers both the Arc iOS app and the arcfitness.app website, and describes what data we collect, how we use it, and your rights.

Data we collect

Cookies and tracking technologies

We keep this deliberately small. The site does not run an advertising cookie network, and we do not build a profile of you across other people’s websites. What is actually in place:

• A random ID in local storage: so a visit, a click, and a form submission can be counted as one person rather than three. It is a random value, not your name or email, and clearing your browser storage clears it.
• Vercel Web Analytics and Speed Insights: aggregate page view and performance measurement from our host. It does not use cookies to identify you.
• OpenAI ads measurement pixel: a third-party script that loads on this site and reports back when someone submits the plan form or taps through to the App Store, so we can tell whether an ad worked. We send it the fact that the event happened, not your name or email. OpenAI may use its own storage in your browser for this measurement.
• Essential storage: the password-protected internal dashboard sets a session cookie. It is required for that page to work and is not used for tracking.

The app itself does not use cookies. Some browsers send a “Do Not Track” signal; there is still no common standard for how to honor it, so we do not currently respond to it.

How we use your data

• Authentication: we send sign-in codes to your email address.
• Lifecycle email: after you sign up, or share your email on this site, we may send a short series of onboarding and check-in emails. Every one carries an unsubscribe link, and unsubscribing stops them while leaving your account and plan untouched.
• Notifications: Arc schedules reminders on your device: a first-workout nudge, an occasional check-in if you have been away, and rest timers during a session. We record when a reminder is scheduled and when you tap one, so the timing stays sensible and the two channels do not reach you at once. The Live Activity rest timer registers a device token so the timer can update while the app is closed. You can turn notifications off in iOS Settings at any time.
• App functionality: workout data powers core features: logging, history, progress tracking, and personal records.
• AI features: when you use AI-powered features (workout import, AI fill, plan generation, the Arc Coach), the relevant inputs are sent to our AI providers (Google Gemini and Anthropic Claude) for processing. Inputs may include pasted workout text, exercise names, training preferences, and coach messages. No personal identity data (email, address, phone) is included in AI requests, though your display name may appear in coach conversations.
• Service improvement: we may store AI inputs and the corresponding AI responses to monitor quality, debug issues, and improve our prompts and features over time. Stored entries are kept for up to 90 days and then deleted. This collection is enabled by default and can be disabled at any time in iOS Settings → Data & Privacy.
• Measuring our ads: we run ads to get Arc in front of people who might want it, and we measure whether they worked using the aggregate signals described in cookies and tracking technologies above. We do not upload your email or your workout data to any advertising platform.
• Legal and safety: we may use data to enforce our terms, investigate abuse or fraud, protect our rights and yours, and comply with the law.

Data storage and security

Your data is stored on Supabase (hosted on AWS). All data is encrypted in transit (TLS) and at rest. Access to production data is limited to the people who need it to run the service.

We use technical and organizational safeguards designed to protect your data, but no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

How long we keep data

• Account and workout data: kept while your account is open, so your history and progress stay intact. Deleted when you delete your account.
• AI inputs and responses: up to 90 days, then deleted.
• Email delivery records: which emails we sent you and whether they were delivered, opened, or clicked, kept up to 24 months so we can diagnose delivery problems and honor unsubscribes.
• Site analytics: kept against the random browser ID, not against your identity.
• Legal records: we may keep what we need to resolve disputes, meet tax or accounting obligations, or comply with the law.

Data sharing

We do not sell your data, and we do not share it for cross-context behavioral advertising. We share data only with:

• Supabase, database and authentication provider
• Google (Gemini API) and Anthropic (Claude API), workout suggestions and coach replies (workout names, history, and coach messages, no personal identity data)
• Resend, email delivery. Receives your email address and reports back delivery, open, and click events for the emails we send you
• RevenueCat and Apple, subscription billing and entitlement status for Arc Coach
• Vercel, site hosting and privacy-friendly page analytics
• OpenAI, ad measurement on this site, as described in cookies and tracking technologies above

We may also disclose data:

• To comply with the law, a subpoena, or another valid legal request, and to enforce our terms or protect the rights and safety of our users or the public
• To a buyer or successor, and to their advisors, in connection with a merger, acquisition, financing, or sale of all or part of the business. The data stays subject to this policy unless you are told otherwise and given a choice

Your rights

• Access: view all your data within the app.
• Correction: edit your profile and training data in the app, or contact us for anything you cannot change yourself.
• Deletion: delete your account from settings, as described below.
• Data portability: contact us to request an export of your data.
• Email opt-out: use the unsubscribe link in any lifecycle email. Sign-in codes and other service messages continue.
• No sale or sharing: we do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. This applies to Nevada residents under NRS Chapter 603A as well.

What deletion actually does. Deleting your account immediately and permanently removes your profile, workouts, sets, personal records, programs and templates, coach conversations, stored AI inputs, subscription record, and any plan you started on this site. It is not recoverable, so export first if you want a copy. Two things survive on purpose: the record that we sent email to your address and whether it was delivered, and your unsubscribe status, so a deleted account cannot start receiving email again. Routine encrypted backups age out on their normal cycle. To have the email records removed too, email us and we will do it.

State privacy rights. Depending on where you live, you may have additional rights under state privacy law, including the right to know what we collect, to get a copy, to correct it, to delete it, to appeal a decision we make on a request, and to be free from discrimination for exercising any of them. Email us to make a request. We may need to verify that the request is really coming from you before we act on it, and an authorized agent acting for you may need to show proof of that authority.

No profiling. We do not use your data for automated decision-making that produces legal or similarly significant effects for you. Building your training plan is automated, but it only ever changes what workout Arc suggests.

Where your data is processed

We are based in the United States and store data there. Our providers may process data in other countries. If you use Arc from outside the United States, you understand that your data will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

Children

Arc is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe a child has given us personal information, email us and we will delete it.

Changes

We may update this policy. We will change the date at the top, and if the changes are material we will tell you by email or by a notice in the app or on the site before they take effect.

Contact

For privacy questions or to make a request: hello@arcfitness.app

Crown Haven Ventures LLC, 400 Page St #303, San Francisco, CA 94102