Privacy policy

Arcova is a dongle, an app and an account that goes with them. This policy says what we record when you use them, why we record it, who else can see it, how long we keep it, and what you can ask us to do with it.

Who we are

The controller of your personal data is {{LEGAL_NAME}}, kennitala {{KENNITALA}}, {{ADDRESS}}.

You can write to us about anything on this page at {{PRIVACY_EMAIL}}.

{{DPO_STATEMENT}}

What this covers

This policy covers:

• the Arcova app on your phone
• the Arcova dongle, including the firmware running on it
• this website
• email you send to us

It does not cover Apple, Google or the app stores, who handle your data on their own terms. There is more about them below.

What we collect

We collect what the product needs to work. Nothing here is bought from data brokers, and nothing is inferred about you beyond what you did in the app.

Your account

When you create an account we store your name, your email address, and the language you chose. If you sign in with a password, we store a hash of it and never the password itself. If you sign in with Apple or Google, we store the identifier they give us instead.

We also store the codes we email you to verify your address or reset your password, and the time and outcome of sign-in attempts.

Your listening

When you listen through the dongle, the app records when the session started, when it ended, how long it ran, and which dongle was connected. It also stores the daily goal you set and the history and streaks built from those sessions.

No audio is recorded and no audio is uploaded. The dongle processes sound as it passes through and keeps none of it. Neither the app nor the API receives a recording of what you listened to or of anything around you.

Your dongle

To connect to the dongle, update it and support it, the app handles its serial number, its Bluetooth identifiers, its firmware version, and events such as connecting, disconnecting and applying an update. Along with those we receive your phone's operating system and version and the version of the Arcova app.

Email you send us

If you email us, we keep your message, your address and our reply so we can answer you and pick the thread up later.

This website

This website sets no cookies, runs no analytics and has no forms. Nothing you do here is tied to your Arcova account.

Our host records ordinary server logs, including the IP address a request came from, the time, the page and the browser's user agent. We use them to keep the site up and to investigate abuse. They are kept {{LOG_RETENTION}}.

Crash reports

When the app crashes or hits an error, it sends a report to Sentry so we can find the fault. A report contains a stack trace, the app version, and details of the device and operating system. It does not contain your listening records or the contents of what you played.

Why we use it, and our legal basis

• Your account, the content library and your listening records. We process these to give you the service you signed up for. The legal basis is performance of a contract with you, Article 6(1)(b) GDPR.
• Crash reports, error logs and security. We process these to keep the app working and to protect the service against abuse. The legal basis is our legitimate interests, Article 6(1)(f) GDPR, in a product that works and is not attacked. We have weighed those interests against your rights, and you can object at any time.
• Firmware updates. We check your dongle's version so we can offer it the right update, on the same contractual basis as the rest of the service.
• Records we must keep. Where a law requires us to keep something, for example accounting records, the legal basis is a legal obligation, Article 6(1)(c) GDPR.
• Anything to do with buying a dongle. {{PURCHASE_FLOW}}
• Anything that rests on your consent. {{CONSENT_ITEMS}} Where we rely on consent, you can withdraw it at any time, and withdrawing it does not make what we did before unlawful.

Who else sees it

We do not sell your personal data. We do not use it for advertising, and we do not share it with advertisers.

These companies process data for us or alongside us:

• Scaleway, our hosting provider. The API, the database and the audio files sit in their Paris region, fr-par, in France.
• Google Workspace, for the email we send you, such as verification codes and account notices. Region {{GOOGLE_REGION}}.
• Sentry, for crash reports. Region {{SENTRY_REGION}}.
• Apple and Google, when you use Sign in with Apple or Google sign-in. They act as independent controllers for what happens on their side, under their own privacy policies. We receive only the identifier and, where you allow it, the email address.
• The App Store and Google Play, which distribute the app and tell us nothing about you beyond aggregate download and crash figures.

We also disclose data where a law or a valid order from an authority requires it, and to professional advisers bound by confidentiality.

Leaving the EEA

{{TRANSFER_MECHANISM}}

How long we keep it

• Your account and your listening records: until you delete your account, then {{DELETION_GRACE}}.
• Crash reports: {{SENTRY_RETENTION}}.
• Email you send us: {{SUPPORT_RETENTION}}.
• Website server logs: {{LOG_RETENTION}}.
• Backups: {{BACKUP_RETENTION}}. A deleted account stays in backups until the backups holding it age out, and we do not restore it from them.

Where a law makes us keep a record for longer, we keep that record and nothing more.

Deleting your account

You can delete your account yourself, in the app. Open Settings, choose Delete account, and type DELETE to confirm. You may be asked to sign in again first.

Deleting removes your name, your email address, your sign-in credentials, your listening sessions, your goal and your history. We send a confirmation email to the address on the account. It cannot be undone, and we cannot bring the account back afterwards.

If you cannot reach the app, or your account has no email address on it, write to {{PRIVACY_EMAIL}} and we will do it for you once we can establish that the account is yours.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• erase your data
• restrict what we do with it while a question about it is open
• hand your data over in a portable, machine-readable form
• stop processing that rests on our legitimate interests, by objecting to it
• withdraw a consent you gave

Write to {{PRIVACY_EMAIL}} to use any of these. We answer within one month. If a request is complicated we may take longer, and we will tell you within that first month if so. We may need to confirm who you are before we act.

If you think we have handled your data badly, you can complain to Persónuvernd, the Icelandic Data Protection Authority, at personuvernd.is, or to the supervisory authority where you live or work. You can complain without asking us first, though we would rather you gave us the chance to fix it.

Children

Arcova is not directed at children. You need to be at least {{MIN_AGE}} to hold an account. We do not knowingly collect data from anyone younger. If you believe a child has an account, write to {{PRIVACY_EMAIL}} and we will remove it.

Security

Traffic between the app, the dongle and our API is encrypted in transit. Passwords are stored as hashes, never in readable form. Access to production systems is limited to the people who need it and is protected by individual accounts.

No system is perfect, and we do not promise that ours cannot be broken into. If a breach affects your data and is likely to put your rights at risk, we will tell you and Persónuvernd as the law requires.

Changes to this policy

When we change this policy, we change the date at the top. If a change materially affects what we do with your data, we will tell you in the app or by email before it takes effect.

Contact

Questions, requests and complaints about your data go to {{PRIVACY_EMAIL}}, or by post to {{ADDRESS}}.