Loading…
How Arqo, Inc. collects, uses, stores, and shares your data. The plain-English commitments live at our data policy.
Arqo is operated by Arqo, Inc., a Delaware corporation. For privacy questions or to exercise your rights, contact privacy@tryarqo.com.
Account information. Email address and an authentication identifier when you create an account. If you sign in with a third-party provider, we receive whatever that provider returns (typically email and a stable user ID).
Content you create. The screenplays, scene notes, character bibles, and other writing you save in Arqo. We treat this as your private work product.
Usage telemetry. Anonymized event data (which features you used, error reports, performance timings, funnel events such as signup completion and export starts). Used to fix bugs and improve the product. Sentry is our error tracker; we configure it to scrub form values and request bodies. PostHog is our product-analytics processor; we send only event names, identifiers, and counts, never the contents of your scripts.
Usage statistics. When you are signed in, Arqo records which parts of the app you use and for how long, for example the Library, Learn or the editor, and never what you write. We keep this in Arqo's own database to keep the product working and to improve it, under our legitimate interest. It uses no cookies and stores nothing on your device. It is not shared, not sold and not used for ads. We keep it for 13 months. You can turn it off at any time in Settings, under Privacy.
Payment information. When you subscribe on our website, Paddle (our merchant of record) collects your payment details and billing address. We never see your card number. Paddle returns us a customer reference, the price you paid, and your country for tax purposes. When you buy inside the iOS app, Apple collects your payment details instead, and we receive a transaction identifier, the product you bought, and whether your subscription is active, through RevenueCat (see Section 5). We never see your Apple payment method.
Cookies. Strictly necessary cookies for authentication, session management, and remembering your analytics choice. Optional analytics cookies are off until you turn them on: we ask once, via a banner, and we do not treat silence or dismissal as a yes. The banner lets you allow everything or choose what you allow, category by category, and saving that panel with nothing ticked means no analytics cookies and nothing sent to analytics companies. Signed-in usage statistics are separate: see "Usage statistics" above. You can change your answer at any time in "Your analytics choice" above.
Feedback you submit. When you use the in-app feedback widget, we store the message you typed, the category you chose, the page URL, your browser user agent, and viewport size in our Supabase database. We also email a copy to our team inbox. Feedback is kept for 24 months so we can spot recurring issues across releases, then deleted automatically. It is never shared with third parties beyond the email and database vendors listed in Section 5. You can request earlier deletion at any time by emailing privacy@tryarqo.com.
Push notifications. If you turn on push notifications, we store a device record: the push endpoint or device token your browser or phone issues, the platform, and when we last saw it. That token is what lets us reach your device and nothing else. It carries no script content. Delivery runs through the push service your device belongs to (Google, Apple, or Mozilla), which necessarily sees the token and the message. You can turn push off at any time in Settings or in your browser or OS; we delete device records after 90 days without contact, or once a device stops accepting delivery.
Microphone, camera, and photos (iOS app). Used only when you open a feature that needs them and have granted permission. Dictation turns your speech into text with Apple’s speech recognition, which may process the audio on Apple’s servers under Apple’s privacy policy. We receive only the text that ends up in your script. Self-tapes you record in Perform are saved to the photo library on your device and are not uploaded to Arqo. The camera also scans the verification code on a printed receipt.
We use the data above to:
We do not use your scripts to train AI models, ours or anyone else’s. We do not sell your data to anyone for any reason.
For users in the EU/UK, we process your data on these legal bases:
We share data only with vendors needed to run the service. Where a vendor processes data on our behalf, we put a data processing agreement in place, and our subprocessors page shows where each one stands. Apple, and any provider you connect with your own key, act under their own terms instead.
The current list, with what each vendor receives and where they process it, lives on our subprocessors page. We may also disclose data when required by law, to protect our rights, or in connection with a corporate transaction (sale, merger). In a corporate transaction, your privacy rights carry over.
Our primary data centers are in the United States. If you’re in the EU/UK and your data is transferred to the US, the transfer is governed by the EU Standard Contractual Clauses or an equivalent mechanism in our agreements with each processor.
Active accounts: for as long as you keep your account.
After account deletion: we delete your scripts, account record, and AI usage data within 30 days. Backups containing your data cycle out within 90 days.
Billing records: Paddle retains transaction records for 7 years (tax obligation). We retain a minimal ledger of plan changes for the same period. For App Store purchases, Apple keeps its own transaction records.
Feedback and push devices: feedback is deleted after 24 months. Push device records are deleted after 90 days without contact, or once a device stops accepting delivery.
Depending on where you live (GDPR for EU/UK, CCPA for California, similar laws elsewhere), you have rights to:
Most rights you can exercise yourself: export your scripts from the app, delete your account from Settings, and turn analytics on or off at any time in "Your analytics choice" above. For anything else, email privacy@tryarqo.com and we’ll respond within 30 days.
Data in transit is encrypted with TLS. Data at rest is encrypted at the storage layer. Authentication uses secure session cookies with HttpOnly, Secure, and SameSite flags. We rotate secrets, run automated security checks on every deploy, and log access to sensitive infrastructure.
No system is perfectly secure. If you discover a vulnerability, please email security@tryarqo.com, we’ll respond within 72 hours.
Arqo is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we’ll delete it.
We’ll update this policy as the service changes. Material changes get at least 30 days’ notice via email and an in-app notice. The “last updated” date at the top reflects the most recent revision.
Arqo, Inc., Delaware. privacy@tryarqo.com for privacy questions and rights requests. hello@tryarqo.com for everything else.