Privacy Policy

Personal information you provide. We collect personal information you voluntarily provide when you register, including:

• Name
• Email address
• Username
• Password (stored encrypted)
• University / institution
• Bio and profile information
• Startup stage, skills, and experience

Sensitive information. We may process student data as necessary for the Services.

Information automatically collected. When you visit our Services, we automatically collect certain technical information such as your IP address, browser type, device characteristics, and usage data. This is used to maintain the security and operation of our Services.

We also collect information through essential browser storage (localStorage) for authentication purposes. See our Cookie Policy for details.

We process your information to:

• Create and manage your account
• Provide and improve the platform (profile matching, roadmap generation, goal tracking)
• Enable connections between founders
• Maintain security and prevent fraud
• Comply with legal obligations

We only process your information when we have a valid legal reason to do so under applicable law, including:

• Consent — when you have given us permission
• Contract performance — to provide the services you signed up for
• Legitimate interests — to improve and secure the platform
• Legal obligations — to comply with applicable laws

We do not sell your personal information. We may share information in the following situations:

• Service providers — Supabase (database and authentication), Railway (backend hosting), Vercel (frontend hosting)
• Other users — your public profile (name, bio, skills, position, university) is visible to other Arcus users in the Connect section
• Legal requirements — if required by law or to protect rights and safety

We use essential browser localStorage to keep you signed in. We do not use advertising or analytics tracking cookies. See our Cookie Policy for full details.

The Arcus platform includes an AI guidance feature (Arcus AI). Current AI responses are generated from curated content rather than a third-party AI API. If this changes, this policy will be updated accordingly.

Our servers are based in the United States. If you are accessing Arcus from outside the US, your information will be transferred to and processed in the United States. By using the Services, you consent to this transfer.

We retain your personal information for as long as your account is active. When you delete your account, all associated data — including your profile, roadmap progress, weekly goals, and connections — is permanently deleted. We may retain certain information as required by law.

We implement technical and organisational security measures including encrypted authentication tokens, Row Level Security (RLS) on all database tables, HTTPS-only communication, and secure server-side key management. However, no system is 100% secure and we cannot guarantee absolute security.

We do not knowingly collect data from children under 13. If you become aware that a child has provided us with personal information, please contact us at vepaul@arcusapp.io.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (via Settings → Delete Account)
• Object to or restrict processing of your data
• Data portability

To exercise any of these rights, contact us at vepaul@arcusapp.io.

Most browsers include a Do-Not-Track ("DNT") feature. Because there is no uniform standard for DNT signals, we do not currently respond to them. We do not use cross-site tracking, so this has no practical impact on your experience with Arcus.

If you are a California, Virginia, Colorado, Connecticut, or other US state resident, you may have additional rights under applicable state privacy laws (including CCPA/CPRA). These include the right to know what data we collect, the right to delete, and the right to opt out of the sale of personal information (we do not sell personal information). To submit a request, contact vepaul@arcusapp.io.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised date at the top of this page. We encourage you to review this notice periodically.

If you have questions or comments about this notice, contact us at:

You can review and update your profile information at any time from the Profile page. To permanently delete your account and all associated data, go to Profile → Danger Zone → Delete account.

For additional data requests, email vepaul@arcusapp.io.