Legal
Privacy Policy
What we collect, and why
Account data
Your email address, and optionally a name, handle, and avatar. Used to sign you in, identify your work, and send you transactional email (sign-in links, email verification, and account notices). We send no marketing email.
Session data
When you sign in we set a session cookie (httpOnly, our domain only) and record the IP address and browser user-agent of the session, so you can see and revoke your active sessions and so we can detect abuse.
Your content
The projects and documents you create — space programs, schedules, wall assemblies, palettes, sheet registers, decks, uploaded images. Stored to provide the product, processed only to render, save, version, back up, and export it for you and the people you share it with. We do not sell it, mine it, or use it to train AI models. We do not read it except with your permission (support), as strictly necessary for safety or debugging, or where law requires.
Waitlist, and bug & idea reports
If you join the waitlist we store the name, email, and note you submit, to send your invite. Bug and idea reports store what you write plus basic context (tool, page, browser) so we can reproduce the problem.
Lookups you run against third-party services
Some tools offer optional, user-initiated lookups of public sources — for example the open-image search in Pinup, which queries Wikimedia Commons. These requests go straight from your browser to that service: we do not proxy, see, or log your search terms, and the service's own privacy policy governs the request. If you pick an image, we copy it into your file library and record its source link, license, and credit alongside it. We never send your content to these services.
Usage analytics and logs
We count page views first-party on our own infrastructure: hostname, path, country, and response status. No analytics cookies, no fingerprinting, no cross-site tracking, no third-party analytics scripts — which is also why there is no cookie banner. Operational telemetry and server logs exist for reliability and security and roll off automatically (usage telemetry after 90 days).
Cookies
Exactly two kinds, both first-party and functional: the session cookie that keeps you signed in, and a theme preference cookie. No advertising or tracking cookies exist on the Services.
Who we share data with
Only the service providers that run the product — our Subprocessors page lists each one, what it does, and where it processes data (currently: Cloudflare for hosting/storage/compute, Resend for transactional email). Content you make is sent to an AI provider only when you yourself invoke an AI feature, under no-training terms. Beyond that, we disclose data only if the law compels us to (and we will tell you unless legally barred), or to defend our rights in a dispute you are part of. Nobody else. We have never sold personal data and never will.
Where data lives
On Cloudflare's network, with primary storage in the United States. If you are in the EU/UK, using the Services transfers your data to the US; we rely on our providers' standard contractual clauses and equivalent safeguards for those transfers.
Retention and deletion
- Your content: kept while your account is open. Deleting a document or project removes it from the live database immediately.
- Backups: encrypted nightly backups are kept for 30 days and then destroyed, so deleted data leaves backups within 30 days.
- Account data: deleted or anonymized when you delete your account, except minimal records we must keep for legal or security reasons.
- Deletion records: when an account is deleted, we keep one minimal record of the deletion itself — the email address, handle, request time, IP, and purge date — for 2 years, as proof the deletion was requested and carried out and to prevent abuse. This record is the lawful exception to deletion (defense of legal claims) and contains no content.
- Usage telemetry: deleted after 90 days.
Your rights
Wherever you live, we honor these: access (a copy of your data), portability (export in a usable format), correction, deletion, restriction or objection to processing. Access, portability, and deletion are self-service — one-click full export and account deletion (with a 14-day grace window) live on your account page; Your data explains exactly how each works. We make no automated decisions with legal effect and do no profiling. For anything not covered by the self-service tools, email legal@archoverflow.com from your account address — we respond within 30 days. EU/UK residents may also complain to their supervisory authority; California residents have the corresponding CCPA rights, and we do not "sell" or "share" personal information as the CCPA defines those terms.
Children
The Services are not directed at children and may not be used by anyone under 16. We do not knowingly collect children's data; if you believe we have, contact us and we will delete it.
Changes
If this policy changes materially we will notify account holders by email or in the product at least 14 days before the change takes effect. The current version always lives at this URL with its effective date above.
Contact
legal@archoverflow.com — privacy requests, questions, and complaints. Operator: Kyle Bigart, United States (see Terms §1).