Privacy policy

This policy explains what personal information Arcadia collects, how we use it, and the choices you have. Arcadia is operated by Iman Rahmani as a sole trader, based in Queensland, Australia. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988.

1. What we collect

When you sign up and use Arcadia, we collect:

• Account details, your email address, a hashed password, your display name and (optionally) grade level and timezone. If you sign in with Google or Apple, we receive your name, email address and an account identifier from them (with Apple you can choose to hide your real email).
• Plan content you create, subjects, tasks, deadlines, study sessions, focus timer runs, and chat messages you send to Arcad.
• Calendar data you choose to sync, event titles, times and locations from Google Calendar, Apple, Canvas or any .ics feed you add. We import; we don’t write back to your calendar.
• Files you upload, PDFs or notes you attach, so Arcad can answer questions from them.
• Billing information, handled by Stripe on the web and by Apple in the iOS app. We see your plan and status, but never your card number.
• Referral details, if you invite a friend or join with an invite link, we record who invited whom so we can apply rewards.
• Feedback you send, the message, its type and when it was sent. Your account email is included for follow-up only if you choose to let us contact you. The Arcadia team can read submissions.
• Usage and diagnostics, page views, feature usage, error reports and performance metrics. When something goes wrong, we may keep a short recording of the screen around the error so we can fix it. These recordings hide all text you see and everything you type.

2. How we use it

We use your information to:

• Run and improve the service you signed up for;
• Personalise your plan and give Arcad context about your schedule;
• Send you transactional email (verification, receipts, service updates);
• Detect abuse, prevent fraud and secure your account;
• Comply with legal obligations (tax records, lawful requests).

We don’t sell your data. We don’t use your content to train third-party AI models. We don’t add you to marketing lists you didn’t opt in to.

3. Third parties we share with

To run Arcadia, we send some data to service providers. Each of them processes data only on our instructions and under their own privacy terms:

• Cloudflare, hosting, edge database, R2 storage.
• Stripe, subscription payments and invoicing on the web.
• Apple and RevenueCat, subscriptions bought in the iOS app. Apple processes the payment; RevenueCat tells us which plan is active. Apple also handles Sign in with Apple if you use it.
• OpenAI, the AI that builds your study plan and powers Arcad. Only if you allow it (we ask before anything is sent, and you can change it in Settings), we send your first name, year level, school and state, your subjects, goals and ATAR target, your schedule, tasks and deadlines, your messages to Arcad (typed or spoken) and what it remembers, and notes or files you upload to make flashcards or summaries. We never send your email, password, phone number or payment details. Voice input is turned into text by Apple’s speech recognition; recordings never reach us or OpenAI. OpenAI does not train on data sent through their API. If you don’t allow it, Arcadia builds a basic plan without AI.
• Resend, transactional email delivery.
• Google, if you sign in with Google or connect Google Calendar. Calendar tokens are stored encrypted and used solely to read calendar events.
• PostHog, product analytics, so we can see which features help and where people get stuck.
• Sentry, error tracking and masked error recordings (described above), so we can fix crashes quickly.

4. Cookies and local storage

Arcadia uses a small number of cookies for authentication (keeping you signed in) and CSRF protection. We store some settings locally on your device (like your theme and notification preferences). We don’t use third-party advertising cookies.

5. Data retention

We keep your account data as long as your account is active. When you delete your account, we remove your content within 30 days, except for records we’re legally required to keep (like invoices, which are retained for 7 years under Australian tax law).

6. Your rights

You can, at any time:

• Access your data, email us and we’ll send you a full copy.
• Correct anything that’s wrong, edit it in-app or email us.
• Delete your account and content from Settings.
• Withdraw a consent you gave (e.g. disconnect Google).
• Complain to the Office of the Australian Information Commissioner if you think we’ve mishandled your data.

7. Security

Passwords are hashed with PBKDF2-SHA256. Sensitive tokens (like Google OAuth refresh tokens) are encrypted at rest with AES-GCM. All traffic between your device and Arcadia is over HTTPS. We take security seriously, but no service can promise perfect security, please keep your password safe and enable device-level protection.

If we ever discover a security incident that affects your data, we’ll notify you promptly and in line with our obligations under the Notifiable Data Breaches scheme.

8. Children

Arcadia is built for high-school students and is not intended for children under 13. If you’re 13 to 17, you need your parent or guardian’s permission to use Arcadia. We collect only what we need to run your study plan, we never sell it, and we don’t show ads. Parents and guardians can contact us to access or delete their child’s data. If we learn we’ve collected data from a child under 13, we’ll delete it.

9. Where your data is stored

Arcadia runs on Cloudflare’s global network, and several of the providers listed above (including OpenAI, Stripe, Apple, RevenueCat, PostHog, Sentry, Resend and Google) are based in the United States. This means your data may be processed outside Australia, including in the United States and the European Union. We only use providers that protect personal information to a standard comparable to the Australian Privacy Principles.

10. Changes and contact

We’ll update this policy when things change and mark the “last updated” date above. Material changes will be notified in-app or by email.

Privacy questions or requests? Email teamarcadiahq@gmail.com. We aim to respond within 30 days.