Legal

Privacy Policy

Effective November 8, 2026 · All policies

Plain-words summary. We collect the minimum needed to run the site: your account details, your sessions, the content you create, and first-party, aggregate page counts. Reading the public articles requires no account at all. No ad networks, no third-party trackers, no selling data, no training AI on your work, and no cookies beyond the ones that make the product function. You can export or delete everything, any time.

Upcoming changes (effective November 22, 2026). Posted November 8, 2026. Until November 22 the policy below stays exactly as written. From November 22:

Product updates by email, only if you opt in. You'll be able to ask for occasional emails about new tools and features. It's off unless you turn it on, every one has a one-click unsubscribe, and we keep a record of when you opted in and the wording you saw. Without opting in you get only transactional email, as today.
Optional profile details: your role (for example architect, interior designer, student) and your firm's size, only if you choose to give them.
Where signups come from: besides the page you signed up from, the link that brought you — a ref tag or the referring site's name, never the full address.
Which features you use: the signed-in usage records will also note which features you use (for example importing, exporting, sharing) — never what you type, draw or upload. Same 90-day limit, still no IP address or location.
Crash reports: if a tool hits an error, it sends us the error message, the tool and page, and your browser version — never your work, and nothing while Local-only work is open. Deleted after 90 days.
Connected AI apps: we also keep a daily count of the requests each connection makes, for plan limits.
Email you send us (legal@, reply@) is kept in our mailbox provider, Google, which joins the Subprocessors page.
If the business changes hands: ArchOverflow is run today by its founder and will move to a company formed to operate it (before any paid plans). If that happens, or the business is ever sold or merged, your data moves with it and stays under this policy — and we'll tell you before it happens.

Questions: legal@archoverflow.com.

What we collect, and why

Account data

Your email address, and optionally a name, handle, and avatar. Used to sign you in, identify your work, and send you transactional email (sign-in links, email verification, and account notices). We send no marketing email. When you sign up we also record the time and the page you signed up from, so we understand which doors people arrive through, and which versions of the Terms and this policy were in force, as a record of what you agreed to — first-party only, tied to your account, deleted with it.

Every account has an address: archoverflow.com/u/<handle> for a person, archoverflow.com/f/<handle> for a firm. It is private by default: only you (or, for a firm, its members) can open it, and to anyone else it does not exist. If you turn on your public profile, anyone with the address can see your name, handle, avatar, bio, and the month you joined; a firm's owners or admins can likewise make its page show the firm's name, handle, and number of members. Profile pages are never indexed by search engines, and turning the setting off makes the page private again at once.

Reading the library

Public articles need no account. Member articles check your session server-side to serve the full text; beyond that, reading is counted only in the same aggregate, first-party page counts described under usage analytics below, plus a running total of views per article (one number per article, used to rank "popular" articles) — we keep no per-person reading history.

Display preferences

If you're signed in, your account remembers a few display choices so they follow you between devices: whether the decorative visual effects are on, which projects you've pinned to the top of your home page, which getting-started tips you've finished or dismissed, which tools' alpha or beta labels you've accepted (so they stay hidden), and in Bullpen, the task cards you've starred and the names of your own cards. Your browser keeps the same choices for when you're signed out. Stored with your account, deleted with it.

Working together in a shared scheme

While you have a scheme open that's shared through a project, the people on that project who also have it open see your name and which item you have selected, and you see theirs. We keep only the latest "has it open" record per person per scheme, it drops away about a minute after you leave, and it's deleted within a day.

View-only share links

No document is shared by link until someone on its project turns a link on. For each link we keep its code, which document or snapshot it shows, who turned it on or off and when, the view it opens with if the person sharing saved one (display settings such as filters, zoom, folded groups and a suggested light/dark theme — a theme suggestion is applied only when the visitor hasn't picked one, and is never stored for them), and a running count of how often it's been opened with the time of the last open — nothing about the people who open it (no account is needed, and no cookie is set for them). A staffing plan's link also has its PIN, shown to the people who can manage the link, and a count of wrong PINs entered; the PIN a visitor types is kept only in that browser tab, so a reload doesn't ask again. A live link to a Schedule also has a calendar-feed form (its milestones, for subscribing in a calendar app); calendar apps fetch it from their own servers, it works only while the live link is on, and its fetches don't add to the link's open count. Turned-off links stay recorded so they keep answering "turned off"; every link stops working when its document or project is deleted, and the records are erased with the owner's account.

Connected AI apps

You can connect an AI assistant of your choosing (for example Claude, ChatGPT or Microsoft Copilot) to your account from inside that app. Nothing is connected unless you sign in and press Allow on our approval screen — also when your organization set the assistant up (for example a Copilot Studio agent): what it then reads goes to that provider under your organization's agreement with it. For each connection we keep the app's name, when you connected it, when it last used its access, and its access tokens — stored only as one-way hashes, so even we can't read them. Access tokens last an hour and renew for at most 30 days of non-use. A connection can only read what you yourself can see. It can create schedules and Cartoon Set drawing sets in your projects (for example from a spreadsheet you hand it), change your schedules, wall assemblies, space programs and drawing sets, log time on your own timecard (entries, punches and its job codes, never billing a week), and propose changes to your Pinup decks (including placing images from your own file library, whose image names and sizes it can then read), only if you ticked "Let it make changes" when you approved it, and only where you are an editor; every change it makes is saved as a new version marked as made through that app, which you can roll back, and a deck proposal changes nothing on the pages until a person executes it in the deck's Queue. Any connection approved since November 5, 2026 can also send us a bug report or feature idea on your behalf, written from your conversation, when you tell it to; it is stored with your account like a report from the Bug / Idea buttons. It can never share, invite people, or delete schemes or projects. When you ask the assistant a question, what it reads from your account goes to that app and its AI provider, and their terms and privacy policy govern it from there — you choose that provider, we don't (see Subprocessors). Disconnect any app any time under Account → Connected AI apps; its access stops at once. Connections are listed in your data export and erased with your account.

Firm accounts

A firm (organization) account holds an office's shared projects. If you belong to a firm, its other members see your name, handle, role in the firm, and when you joined; the firm's owners and admins can change your role or remove you. Firm-owned projects are visible to the firm's members according to their roles (members work on the firm's shared projects; owners and admins see all of them), and to anyone added to a single project, who sees only that project. Your personal projects stay private to you and the people you share them with. When a firm invites someone, we store the email address the invite was sent to, the role offered, and who sent it; we send that address one transactional email about the invite (it holds no sign-in link or secret), the invite can be accepted only by a signed-in person with that verified email address, only that firm's owners and admins see pending invites (and whether the address already has an account), and the invite record is deleted once it's accepted, declined, or revoked, or after 30 days. Changes to a firm's members, roles, invites, and projects are logged so the firm can see who did what.

Timecards. You can keep your own timecard: when you worked, on which of your jobs and task codes, under which pay type (for example regular time, PTO or holiday), any notes you add, and what you billed each week. A timecard is private to you: it lives in your own project, and nobody else can open it, not other people on that project, not a firm, not through a share link (which can't be made for it), and not through anyone else's AI connection. We don't give employers access to it. It is included in your data export, and deleting it (or your account) deletes it on the usual schedule.

Staffing plans (Bullpen). A firm can keep staffing plans: the names and roles of the people on them (firm members, or placeholders like "Designer TBD"), a level or employee code if the firm adds one (for example "Level 2"), their normal weekly hours, the hours planned on each deadline and task (and which part of the job a task is for), and the dates someone is out. We store no reason or type for time off — only the dates — and no pay rates. A staffing plan lives only in a firm project and only that firm's active members can open it: not guest collaborators on the project, and not through an AI connection of anyone outside the firm. A firm's owners and admins, or a plan's author, can share a snapshot of a staffing plan by link: a frozen, view-only copy of the plan as it was when the snapshot was taken, including the names, roles, weekly hours and dates out in it, and the names and dates of the linked schedule's tasks for the following three months (for its report). Each such link has its own 4-digit PIN that the person opening it must enter before anything of the plan is shown; ten wrong PINs turn the link off for good. Anyone with both the link and its PIN can see the snapshot without an account. A live link to a staffing plan is never offered, and each link can be turned off at any time; pages already open close within a few minutes. A plan can be narrowed further, to the firm's owners and admins (and the plan's author), or to them plus members picked by name; everyone else in the firm then can't see it at all. Until a plan is saved to a firm project it stays only in your browser. Deleting the plan (or the project, or the firm) deletes it on the usual trash schedule.

Work you keep on your own computer

Work that isn't saved into a project stays in your browser, on your computer, and is never sent to us. You can also mark a scheme Local only, which blocks pushing it into a project until you deliberately unlock it, or keep it in a file on your computer that you choose (where your browser supports it), in which case even your browser keeps no copy. A project folder on your computer works the same way for a whole project: each tool you open it in writes its own work into that folder, and none of it is sent to us. One exception to know about: images in a Pinup deck are uploaded to our file store, so a deck that's Local only or in a project folder can't add images, and images it already had stay in our file store until you remove them. For this work we have no copy and no record — not its contents, not its name — so we cannot recover it: if your browser's data is cleared or the computer is lost, it is gone, and it won't appear when you sign in on another computer. Download a copy or keep it in a file to back it up. Such files hold your data only (what you entered and chose), as plain JSON. While Local-only work is open, a bug or idea report you send carries only what you type, the tool, and the page. This promise is about how our tools are built: the app itself is delivered from our servers like any website, and we commit to keeping Local-only work on your device.

Session data

When you sign in we set a session cookie (httpOnly, our domain only) and record the IP address, approximate country, and browser user-agent of the session, so you can see and revoke your active sessions and so we can detect abuse. When you ask for a sign-in link or code we also record the IP address it was requested from; that record is deleted with the link once it expires or is used (within 14 days).

Your content

The projects and documents you create — space programs, schedules, wall assemblies, palettes, sheet registers, decks, uploaded images. Stored to provide the product, processed only to render, save, version, back up, and export it for you and the people you share it with. We do not sell it, mine it, or use it to train AI models. We do not read it except with your permission (support), as strictly necessary for safety or debugging, or where law requires.

Tool-access and limit-increase requests, and bug & idea reports

Membership is open, so there is no waitlist for the library. Requests for the platform tools come from accounts: we store, with your account, your name, email address, the tools you pick, the reason you give, and the optional note about what you design, plus the network address, country, and browser the request came from to screen out spam. If you ask while signed out, the request travels with the sign-in email we send you and is filed only when you use that link (which creates your free account if you don't have one); unused, it is deleted with the expired link within 14 days. We use requests only to review them; they are deleted with your account (a request filed before November 6, 2026 without an account? ask us and we delete it). If you reach a plan limit and ask for an increase, we store which limit, its value at the time, the tool you were in, and the reason you give, alongside your account — included in your data export and deleted with your account. Bug and idea reports store what you write plus basic context (tool, page, browser — or, for one sent through a connected AI app, that app's name and the scheme it was about) so we can reproduce the problem.

Lookups you run against third-party services

Some tools offer optional, user-initiated lookups of public sources — for example the open-image search in Pinup, which queries Wikimedia Commons, and the map and place search in the climate tools and on a project's location setting. Opening one of these maps loads its map tiles from OpenStreetMap's tile servers, which receive your IP address and the map area being shown. Place search sends only the place you type, to OpenStreetMap's Nominatim address search, and only when you search. The tools never ask your browser for your device's location. These requests go straight from your browser to that service: we do not proxy, see, or log your search terms, and the service's own privacy policy governs the request. If you pick an image, we copy it into your file library and record its source link, license, and credit alongside it. We never send your content to these services.

Usage analytics and logs

We count page views first-party on our own infrastructure, as daily totals: for each day, how many views a page got, broken down by country and by the referring site's name (for example "google.com" — never the full address you came from) or the ref tag on a shared link. These totals contain no IP address, browser details, account, or session, and can't be traced back to a person; we keep them about 13 months to see trends. Separately, while you're signed in, the tools record which tool you opened and roughly how long it stayed open, tied to your account, so we know which tools to improve (no IP address or location is kept with these records). No analytics cookies, no fingerprinting, no cross-site tracking, no third-party analytics scripts — which is also why there is no cookie banner. Operational telemetry and server logs exist for reliability and security and roll off automatically (signed-in usage records after 90 days).

Cookies

Only first-party, functional cookies: the session cookie that keeps you signed in, and display-preference cookies you set yourself — the theme (light, dark, lights out) and whether the decorative visual effects are on. No analytics, advertising, or tracking cookies exist on the Services.

Working offline. When you're signed in, the tools keep a small signed license in your browser's storage (not a cookie): your account id, display name, plan, which tools you can use, and when it expires (up to 30 days). It never leaves your computer except to be renewed with us, and it's what lets the tools keep working when you have no connection; once it expires they wait for you to reconnect. Signing out deletes it. If you install a tool as an app, your browser also keeps a copy of the tool's own pages and code (not your work) so it opens without a connection.

Who we share data with

Only the service providers that run the product — our Subprocessors page lists each one, what it does, and where it processes data (currently: Cloudflare for hosting/storage/compute, Resend for transactional email). We run no AI features of our own, so we never send your content to an AI provider; it reaches one only when an AI app you connected yourself reads it on your behalf (above). Beyond that, we disclose data only if the law compels us to (and we will tell you unless legally barred), or to defend our rights in a dispute you are part of. Nobody else. We have never sold personal data and never will.

Where data lives

On Cloudflare's network, with primary storage in the United States. If you are in the EU/UK, using the Services transfers your data to the US; we rely on our providers' standard contractual clauses and equivalent safeguards for those transfers.

Upcoming change (effective November 18, 2026): a 14-day Trash. Posted November 4, 2026. Until November 18, the wording below stays in force: deleting a project, scheme, or uploaded image removes it at once, with no undo. Starting November 18, 2026, deleted projects and schemes will move to a "Recently deleted" list on your account page (and on the project's page) for 14 days, where the people who could delete them can restore them; after 14 days they are removed from the live database for good, together with their versions, snapshots, and share links. Deleted uploaded images will leave every document and stop counting against your storage at once, and stay restorable from your account's Storage page for the same 14 days before they are permanently deleted. Encrypted backups still expire 30 days after that. Your data export will include anything in Trash. Deleting your account is unchanged (its own 14-day grace window, then everything goes). Questions: legal@archoverflow.com.

Retention and deletion

Your content: kept while your account is open. Deleting a document or project removes it from the live database immediately.
Firm projects: a project owned by a firm belongs to the firm, not to the members who worked on it — it stays with the firm when a member leaves or deletes their account.
Images added by guest collaborators: when someone without tool access, added to a project, uploads an image into it, the image belongs to the project owner's account, not the uploader's — it counts against the owner's storage, shows (with the uploader's name) on the owner's Storage page, is deleted by the owner, and stays with the project when the uploader leaves it or deletes their account.
Firm invites: deleted once answered or revoked, or after 30 days (swept nightly).
Backups: encrypted nightly backups are kept for 30 days and then destroyed, so deleted data leaves backups within 30 days.
Account data: deleted or anonymized when you delete your account, except minimal records we must keep for legal or security reasons. If we close an account under the Terms (section 9), the same 14-day window applies before anything is deleted.
Deletion records: when an account is deleted, we keep one minimal record of the deletion itself — the email address, handle, request time, IP, and purge date — for 2 years, as proof the deletion was requested and carried out and to prevent abuse. This record is the lawful exception to deletion (defense of legal claims) and contains no content.
Usage telemetry: deleted after 90 days.
Connected AI apps: expired sign-in requests and dead tokens are deleted within a day; a connection itself lasts until you disconnect it or delete your account.
Aggregate page totals (no personal data): deleted after about 13 months (400 days).

Your rights

Wherever you live, we honor these: access (a copy of your data), portability (export in a usable format), correction, deletion, restriction or objection to processing. Access, portability, and deletion are self-service — one-click full export and account deletion (with a 14-day grace window) live on your account page; Your data explains exactly how each works. We make no automated decisions with legal effect and do no profiling. For anything not covered by the self-service tools, email legal@archoverflow.com from your account address — we respond within 30 days. EU/UK residents may also complain to their supervisory authority; California residents have the corresponding CCPA rights, and we do not "sell" or "share" personal information as the CCPA defines those terms.

Children

The Services are not directed at children and may not be used by anyone under 16. We do not knowingly collect children's data; if you believe we have, contact us and we will delete it.

Changes

If this policy changes materially in a way that reduces your privacy (for example, we start collecting something new or share data with someone new), we will notify account holders by email or in the product at least 14 days before the change takes effect. Some changes take effect as soon as they are posted: changes required by law or a regulator, changes that fix a security issue or a critical bug, and changes that only add choices you control (such as a new way for you to share your own work) without collecting or sharing anything you haven't chosen to. The current version always lives at this URL with its effective date above.

Contact

legal@archoverflow.com — privacy requests, questions, and complaints. Operator: ArchOverflow, United States (see Terms §1).