Privacy Policy
Publishing note: fill the bracketed details (legal entity, address, hosting regions) and have a privacy lawyer review before commercial launch in the EU/UK, South Africa, and North America.
This Privacy Policy explains what personal information Arcus Habits collects, why, how we protect it, and the choices and rights you have. It applies to the Arcus Habits mobile app and related services (the “Service”).
1. Who we are
The controller responsible for your personal information is:
- RX Studios
- Email: privacy@arcushabits.com
- Our registered address, Information Officer (POPIA) and, where applicable, EU/UK representative details are available on request at the email above.
2. A quick summary
- Arcus Habits is a social habit-tracker. You take live camera photos as proof of your habits and share them with the small “circles” of people you choose.
- We collect your account details, those photos, captions, comments, habit activity, and device/push information — to make the Service work.
- We do not sell your personal information, and we do not use it for advertising or cross-app tracking.
- You can export or delete all of your data from inside the app at any time.
- You must be at least 16 years old to use Arcus Habits.
3. What we collect and why
| Data | Examples | Why (lawful basis) |
|---|---|---|
| Account | Email, password (hashed by our auth provider) or Apple/Google identifier; display name | Create and secure your account (contract) |
| Age | Date of birth (to confirm you meet the minimum age) | Legal obligation / legitimate interest |
| Proof photos & avatars | The live photos you capture; your profile picture | Core feature (contract) |
| Your content | Captions, comments | Core feature (contract) |
| Habit activity | Habits, schedules, timezones, windows, streaks, goals, history | Core feature (contract) |
| Social graph | Circles you’re in, invites | Core feature (contract) |
| Device & technical | Device identifier, device public key, platform, push token, timestamps | Deliver reminders, secure captures (contract / legitimate interest) |
| Safety | Reports you file, blocks you set, moderation outcomes | Keep the Service safe (legitimate interest / legal obligation) |
We do not collect your location, contacts, health data, or microphone audio. We do not use analytics or advertising SDKs.
4. How your information is shared
We share personal information only with:
- Other members of your circles — they can see your proof photos, captions, comments, display name, and avatar. This is the point of the Service; choose your circles accordingly.
- Service providers acting on our instructions: Supabase (database, auth, photo storage); Expo / Apple Push / Google FCM (notifications); Railway (hosting). See our sub-processors.
- Authorities — where required by law, or to protect rights, safety, and security.
We do not sell your personal information and do not “share” it for cross-context behavioural advertising as defined by US state privacy laws.
5. International transfers
Your information may be processed in countries other than your own, where our service providers operate. Where data leaves your country (e.g. the EEA, UK, or South Africa) we rely on appropriate safeguards such as Standard Contractual Clauses and our providers’ data-processing agreements. Contact us for a copy.
6. How long we keep it
We keep your personal information for as long as your account is active. When you delete your account, we delete your personal data and photos promptly (see section 8), except where we must retain limited records for legal, security, or fraud-prevention reasons. Backups are purged on a rolling cycle of [30] days.
7. Your rights
Depending on where you live, you have some or all of these rights: access, correction, deletion, portability, objection/restriction, and withdrawing consent. You also have the right to complain to your data-protection regulator.
- In the app: edit your profile, “Download my data”, and “Delete account” from the Profile screen.
- By email: privacy@arcushabits.com — we respond within 30 days (or as your law requires).
Region notes — EEA/UK (GDPR): complain to your supervisory authority (in Italy, the Garante). California (CCPA/CPRA): rights to know, delete, correct, and opt out of “sale”/“sharing” — we do neither; we honour Global Privacy Control where applicable. South Africa (POPIA): contact our Information Officer or the Information Regulator. Canada (PIPEDA/Quebec Law 25), Australia (APPs), and New Zealand (Privacy Act 2020): access, correction, and complaint rights to the relevant regulator.
8. Deleting your account
Open Profile → Delete account. This permanently deletes your account, habits, streaks, comments, captions, and every photo you have posted (from both our database and photo storage). It cannot be undone. You can also request deletion at our deletion page or by emailing privacy@arcushabits.com.
9. Security
We protect your information with encryption in transit (HTTPS), private photo storage with time-limited signed access, row-level security in our database, verified authentication tokens, and least-privilege access to keys. No system is perfectly secure; if a breach affects you, we will notify you and the relevant regulator as required by law.
10. Children
Arcus Habits is not directed to children. You must be at least 16 to use it, and we enforce an age gate at sign-up. We do not knowingly collect personal information from anyone under 16. If we learn we have, we delete it.
11. Changes to this policy
We may update this policy. We will post the new version here and, for material changes, notify you in the app or by email.
12. Contact
Questions or requests: privacy@arcushabits.com. Support: support@arcushabits.com.