Privacy Policy

Name: Arc
Author: Aneesh Hegde

Effective 25 October 2026

Arc exists to move your files between your devices, and it doesn’t need to know much about you to do that. This policy explains what we collect, why, who we share it with, and the choices you have. The first lines of each section sum it up; the full text is what counts.

Who we are

Arc is made by Aneesh Hegde, an individual developer in Bangalore, India, who is responsible for your data.

Arc (the apps for iPhone, iPad, Android, Mac and Windows, and the website at arctransfer.co) is provided by Aneesh Hegde, an individual based in Bangalore, Karnataka, India (“we”, “us”). We decide how and why your personal data is used, which makes us the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the controller under the EU and UK GDPR.

You can reach us about anything in this policy at support@arctransfer.co.

Your files

Files and messages you send go straight from one device to the other, end-to-end encrypted. They are never uploaded to our servers, and we can't see them.

When you send something with Arc, it goes directly from the sending device to the receiving one: over your local network when both are on it, or over the internet when they aren’t. Every transfer is end-to-end encrypted with keys that are created on your devices and never leave them.

When a direct connection isn’t possible, the encrypted data passes through a relay server, run either by a networking provider or by us. A relay only forwards data it can’t decrypt and doesn’t keep it. Like any server, it sees the IP addresses of the two devices and how much data passes between them.

We never receive the contents, names, folder paths or file types of what you send. We do record that a transfer happened, with its size, file count, how the devices connected and how fast it went (see What we collect). Your chat history with each device is kept only on your devices.

What we collect

Your name and email, details about your devices so they can find each other, your plan, and usage and crash data that helps us fix and improve Arc.

Account: Your name, email address and a unique account ID. With Google sign-in, we receive only your name and email from Google. With an email and password, the password is handled by Firebase Authentication and we never see it.
Profile: The name you show, and the colour picked for your profile picture.
Devices: Each device’s name, type, model, operating system, Arc version and a device ID (on Android, the Android ID).
Connections: Each device’s public encryption key, local network addresses and push notification token, so your devices and friends can find it and wake it for a transfer. On a local network, Arc also announces the device’s name and your account ID to other devices nearby.
Friends: The email address of anyone you invite, until they accept or decline. Once connected, friends see your name, email, profile picture and device names.
Plan: Your plan, whether you’re on a free trial, and how much of your daily and relay allowance you’ve used. Purchase and renewal status comes from the App Store or Google Play through RevenueCat. We never see your card or bank details.
Usage: The main screens you open, and events such as signing in, sending an invite, a transfer starting and finishing (with its size, file count, connection type and speed), and viewing or choosing a plan.
Errors: Error reports and crash logs, with your device type, operating system and app version.
Location: The country and city your IP address points to, worked out by our analytics provider.
Support: Anything you tell us when you email us.
Website: Standard server logs kept by our host, Vercel, such as IP addresses and pages requested. We also count visits with PostHog: the pages you view, the site that sent you, how far you scroll, and your rough location, device and browser type. This is anonymous, uses no cookies, and goes through our own domain, so nothing loads from other sites.

When you’re signed in, usage and error data is linked to your account, so we can help when something goes wrong. We don’t record your screen or track you across other apps and websites.

Permissions on your device

Arc asks for access to things like your photos, files, local network and notifications only so it can send and save files and tell you when they arrive. What you pick stays on your device unless you send it. You can change these permissions in your device’s settings at any time.

How we use it

To run Arc, keep it secure, fix problems and make it better. We don't sell your data or use it for advertising.

To create your account and keep your devices and friends in one list.
To connect devices and wake them up to receive a transfer.
To apply your plan, its limits and any purchase or promo code across your devices.
To find and fix bugs and crashes, and to understand which features are used, so we can improve them.
To protect Arc and its users from abuse, fraud and attacks.
To reply when you contact us, and to tell you about important changes to Arc or these terms.
To meet our legal obligations.

Arc shows no ads and has no advertising tools in it. We don’t sell your personal data, share it for advertising, or use it to train AI models.

Legal bases (EU and UK)

We use your data to perform our agreement with you (running your account, transfers and plan); for our legitimate interests in keeping Arc secure, fixing problems and improving it, which we balance against your rights; to comply with the law; and with your consent where the law requires it, which you can withdraw at any time.

Where it's stored

Your account and device data is stored in Jakarta, Indonesia. Usage and crash data is stored in the United States.

Our database and server functions run on Google Cloud in Jakarta, Indonesia (the asia-southeast2 region). Usage analytics and crash reports are stored by PostHog in the United States. Sign-in, push notifications, purchases and relays are handled by providers that may process data in other countries, including the United States.

This may be outside the country you live in. Where the law requires it, such as for data from the EU or UK, these transfers rely on safeguards like the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep it

For as long as you have an account. Delete it, and your data is gone within 30 days.

We keep your account, device and plan data for as long as you have an Arc account. Invites are kept until they’re accepted or declined. Support emails are kept for as long as we need them to help you.

When you delete your account, we delete your account, devices, friend connections and invites straight away, and your usage and crash data, and any copies in backups, within 30 days. Records of purchases are kept by Apple or Google and by RevenueCat for as long as tax and accounting law requires.

Security

Transfers are end-to-end encrypted, and your device keys are kept in your device's secure storage.

Every transfer is end-to-end encrypted, and each device’s private key is kept in its secure storage, such as the iOS Keychain or the Android Keystore. Data travelling to our providers is encrypted in transit, and access to it is limited. No system is perfectly secure, though. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

Your rights

You can see, correct, export or delete your data. Delete your account in Arc's settings, or email us.

Wherever you live, you can:

Delete your account in Arc’s settings, which also unlinks all your devices.
Change your name in Arc’s settings.
Ask us for a copy of your data, or to correct or delete it, by emailing support@arctransfer.co.

We’ll answer within 30 days, and may need to confirm it’s you first. Using these rights is free. Depending on where you live, you also have these:

India: Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of your data and how it’s used, have it corrected, completed, updated or erased, withdraw your consent, and nominate someone to exercise your rights if you die or can no longer do so. If you’re unhappy with how we handle a complaint, you can take it to the Data Protection Board of India.
EU, EEA and UK: You can object to our use of your data based on legitimate interests, restrict it, and receive it in a portable format. You can complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.
United States: We don’t sell your personal information or share it for cross-context behavioural advertising, and we don’t use sensitive personal information to infer things about you. Depending on your state, including California, you can know what we collect, and access, correct and delete it. You can use an authorised agent, and we won’t treat you differently for using your rights.

Children

Arc is for people 13 and older. Under 18, you need a parent or guardian's permission.

You must be at least 13 to use Arc. If you’re under 18, or under the age of majority where you live, you may use Arc only with the permission of a parent or guardian, who agrees to this policy for you. We don’t knowingly collect data from children under 13, and we don’t track or target children with advertising. If you believe a child under 13 has an account, email support@arctransfer.co and we will delete it.

Changes to this policy

If anything important changes, we'll tell you before it takes effect.

We’ll post any change to this policy here and update the date at the top. If a change materially affects how we use your data, we’ll also tell you in Arc or by email before it takes effect.

Contact and grievances

Email support@arctransfer.co. Aneesh Hegde handles every privacy question and complaint.

For any question, request or complaint about your data, write to our Grievance Officer:

Name: Aneesh Hegde
Email: support@arctransfer.co
Location: Bangalore, Karnataka, India

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.