Privacy Policy

ARCA is a product of Stratum Zero, Inc. ("we", "us"). This policy describes how we collect, use, and protect personal data you provide to us when you use the ARCA service at arca.app and related surfaces.

Four categories:

• Device identifier (device_id). A random ULID generated by your browser on first visit and stored in localStorage. We treat this as pseudonymous PII because it correlates your actions across sessions on one device. It is not linked to any identity you don't choose to provide.
• Email address. Only if you sign in. Used for the magic-link login flow and (in future) account recovery and incident notifications. Never shared with advertisers and never sold.
• Approximate country (CF-IPCountry). Derived from your IP at request time by our CDN (Cloudflare) and stored as a two-letter country code (e.g. RU) alongside each vote. We do NOT store your IP address with your votes. Country is used to power the "My Country" tab and the regional ranking funnel.
• Browser fingerprint (spam detection). When you vote, submit, report, or rate a card, we compute a one-way SHA-256 hash of a derivative of your browser configuration — canvas and audio rendering, screen metrics, timezone, declared languages, and hardware concurrency. The raw components never leave your browser; only the hash is sent and stored, alongside your device_id and the times we first and last saw it. We use it solely to detect bot farms — thousands of automated browsers share one fingerprint, honest users have one per browser — under the legitimate-interest basis of GDPR Article 6(1)(f). It is never used to track you across other sites and is included in your data export.

We do not currently collect: real name, postal address, phone number, age, gender, biometric data, payment information, or any data subject to special category protection under GDPR Article 9.

• Run the ranking. Your votes feed the Bradley-Terry score for each concept; your audition approvals feed the Wilson lower-bound; both decide what appears in the World Top and country leaderboards.
• Bind your activity across devices. When you sign in with email, we attach your prior device's $ARKS, streaks, and submissions to that email so they travel with you.
• Detect abuse. Submission patterns, voting cadence, and country distribution power anti-spam heuristics. We never share these patterns with third parties.
• Improve the product. Aggregated, de-identified telemetry (latency, error rates, screen flows) is used to find bugs and bottlenecks.

We do not sell your data. We do not run third-party advertising trackers. We do not share your personal data with any third party except as described below.

Limited set of infrastructure subprocessors, each contractually bound to GDPR-compatible terms:

• Hosting (Hetzner / future Neon / Upstash / Cloudflare). Run our servers, database, cache, and CDN. They process data only to deliver requests and do not analyse content.
• Email delivery (Resend, when configured). Sends magic-link login emails. Only your email address is shared.
• Error tracking (Sentry, when configured). Captures exception stack traces. We redact request bodies before send so personal data does not appear in reports.

We do not transfer data outside the EEA except where a subprocessor is registered there. Cloudflare and AWS data centres in EU regions are the default. If you sign in from outside the EEA, your email is processed where the email provider operates (Resend: United States).

• Votes / approvals. Retained indefinitely while the linked concept exists, because they are part of the ranking math. After you delete your account, your voter_user_id and voter_device_id columns are replaced with the sentinel __deleted__; the votes themselves are preserved without identity link.
• Submissions. Soft-deleted on account deletion. Visible to admins for the review window (rare cases where a submission contains third-party content flagged for follow-up).
• Email / sessions. Deleted immediately on account deletion or session expiry.
• GDPR audit log. Kept 3 years per Article 30 record-keeping obligations.

Under GDPR you have the right to access, rectify, erase, and port your personal data, plus the right to object to processing. ARCA implements these as follows:

• Access (Art. 15). Sign in and open your account menu → Export data. Returns a JSON file containing every record we hold for your account.
• Erasure (Art. 17). Account menu → Delete account. Tombstones your personal-data fields immediately; irreversible.
• Rectification (Art. 16). Email privacy@arca.app and we'll correct factual errors within 30 days.
• Restriction / objection (Art. 18, 21). Same email; we will pause processing during review.
• Complain to a supervisory authority. If you feel we have mishandled your data you can complain to the data-protection authority in your EU member state.

ARCA sets one functional cookie — sz_session — used to keep you signed in after a magic-link verification. HttpOnly, Secure (in production), SameSite=Lax, 30-day expiry. No tracking cookies. No third-party analytics cookies. No advertising cookies.

For questions about this policy: privacy@arca.app.