Arc privacy policy
The short version. Arc keeps what it needs to run your challenges: your email, the name you choose, your birth month and year, and what you log in each challenge. Your answers and ratings are encrypted and are never shown to your crew. Arc has no ads and no advertising or analytics tools inside the app, and we never sell your data.
Who we are
Arc is run by Sahara Health, a business registered in Poland under tax number NIP 6762560321 ("we", "us"). We are the controller of the personal data described here. Contact: hello@hisarc.com.
What we collect
- Your account: your email address (or the email Google shares when you sign in with Google), the name you choose, your birth month and year (to confirm you are 18 or older), your time zone, and a random install ID for your phone.
- What you log in a challenge: sessions you complete, your daily check-ins and ratings, and your answers. In the Pelvic Floor Challenge that includes ratings about your sexual health. In NoPo it includes whether you stayed off porn that day. In Dry November it includes whether you stayed off alcohol that day.
- Your crew activity: posts and replies you write, reactions, reports you send, and people you block.
- Purchases: what you bought, when, and its status (for example active, cancelled or refunded), as reported by Google Play. Google processes the payment; we never see your card details.
- Technical data: the app version, error details when a request fails, and the IP address that reaches our servers.
Health and sex-life data
Several challenges ask about your health and your sex life. Under the GDPR and UK GDPR this is special category data, and we process it only with your explicit consent (Article 9(2)(a)), which the app asks for before your first check-in. We use it only to run your challenge: your day, your streak, your progress and your coach lines. It is encrypted in our database with a key unique to your account. It is never shown to your crew, never used for advertising and never sold.
You can withdraw your consent at any time by deleting your account in the app (Passport → Delete account) or by emailing us. Without it, the app can't save new check-ins for these challenges.
What your crew sees
When you join a challenge you are placed in a crew with other men who started around the same time. Your crew sees the name you chose and that you are in that challenge. In the Pelvic Floor Challenge your crew can also see your progress (for example days done). In NoPo and Dry November your crew sees only your chosen name: never your answers, slips, scores or streaks. Your crew never sees your email, your answers or your ratings. You can hide yourself from crews in Passport.
Coach John, who posts in crews, is Arc's automated coach, not a real person.
Posts and moderation
Posts and replies you write are visible to your crew. Every post and reply is checked by an automated moderation service (OpenAI's moderation endpoint) before it is shown, to keep out abuse and sexual or violent content. Reports you send are reviewed by us. We may hide content, and ban accounts that break the terms.
Notifications
Arc plans its notifications on your phone. Their wording never names a challenge or describes your health, so a glance at your lock screen gives nothing away.
Why we use your data (legal bases)
- To provide Arc to you (your account, challenges, crews and purchases): performance of our contract with you.
- Health and sex-life data: your explicit consent.
- Moderation, security and preventing abuse: our legitimate interest in keeping Arc safe.
- Purchase records: our legal obligations under tax law.
Service providers
We use these providers, each only on our instructions: Vercel (hosting), Neon (database), Resend (sign-in emails), Google (Sign in with Google, Google Play billing), Stripe (payments on hisarc.com), Meta (ad measurement on hisarc.com, below), OpenAI (moderation of posts and replies) and Expo (delivering app updates). Our servers are in the United States. Where data leaves the EU or UK, we rely on the EU-US Data Privacy Framework or standard contractual clauses.
Our website and ads
On our website, hisarc.com (not in the app), we use the Meta pixel and Meta's Conversions API to learn which of our ads bring visits and purchases. When you visit from outside the UK, the EU and Switzerland, Meta receives the pages you open on hisarc.com, when you start a checkout or buy, your IP address and browser, Meta's own cookies (_fbp, _fbc) and, when you buy, a scrambled (hashed) copy of your email. We do this on our legitimate interest in measuring our advertising. Visitors from the UK, the EU and Switzerland are not measured. Nothing you log in the app is ever sent to Meta. You can control ad tracking in your Facebook and Instagram ad settings.
What we don't do
- No ads in the app, and no advertising or analytics SDKs inside it.
- We never sell or rent your personal data.
- We never send your health, sex-life or habit data to advertisers.
How long we keep it
We keep your account and challenge data while your account exists. When you delete your account, we erase it at once, including your answers, check-ins, posts and points; copies in database backups expire within 7 days. We keep purchase records for as long as tax law requires (in Poland, up to 5 years after the end of the tax year).
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to processing, restrict it, or ask for it in a portable format. You can delete your account yourself in the app (see how to delete your account). For anything else, email hello@hisarc.com from the address on your account. We answer within 30 days. You can also complain to a data protection authority, for example the Polish UODO or the UK ICO.
Consumer health data (US)
Under US state consumer health data laws, such as Washington's My Health My Data Act, your check-ins, ratings and answers are consumer health data. We collect them to run your challenges, as described above, only with your consent. We share them only with the service providers listed above, to run Arc, and never sell them. You have the right to confirm whether we hold your consumer health data, to get a copy of it, to have it deleted, and to withdraw your consent, by deleting your account in the app or by emailing hello@hisarc.com. If we refuse a request, you can appeal by replying to our answer, and we will respond within 45 days.
Children
Arc is for adults. You must be 18 or older to create an account, and we delete an account as soon as we learn it belongs to someone under 18.
Changes
If we change this policy in a way that matters, we will tell you in the app before the change takes effect.