Privacy Policy

01 Who we are

Arcnode Network is a software studio established in Netherlands. It builds and operates a family of applications, websites, APIs, and services under the Arcnode brand, reachable at arcnode.dev.

For all matters relating to personal data, Arcnode Network acts as the data controller within the meaning of Article 4(7) GDPR. You can reach our privacy and compliance contact at legal@arcnode.dev.

02 Scope of this policy

This policy is a network-wide framework. It applies to every service operated under the Arcnode Network brand, including:

• The arcnode.dev website and all associated subdomains, including visit analytics, the contact form, and update sign-ups.
• The Arcnode account and identity provider (backboard.arcnode.dev), which handles sign-in, two-factor authentication, passkeys, and account management, and the Client Portal, status page, and community surfaces that rely on it.
• Linking a Discord account to your Arcnode account to earn a Verified badge, as described in section 3.5.
• Public surveys and market research published at arcnode.dev/surveys and arcnode.dev/s, described in detail in section 4.
• All current and future Arcnode Network applications, web tools, desktop applications, APIs, and SaaS products that adopt this framework.

This policy does not cover third-party websites or services linked from our products. Review their own privacy policies independently.

03 What data we collect and why

3.1 Website visit analytics

When a page on arcnode.dev is loaded, our infrastructure may record technical request data to understand how the website is used and to keep it secure and reliable. Where this data can identify a visitor, it is treated as personal data.

3.2 Update sign-ups (voluntary)

If you submit your email address to receive product updates, we store the address you provide together with limited metadata recorded at sign-up time for administrative record-keeping. Sign-ups made directly on the website may include the IP address and derived location; waitlist opt-ins collected through a survey store the consent record (exact wording, version and timestamp) and the source survey, but not an IP address. Email delivery is handled by Resend (see section 6). You may withdraw consent and unsubscribe at any time by contacting legal@arcnode.dev. Waitlist sign-ups made through a survey use double opt-in, and the resulting emails contain a direct unsubscribe link (see section 4.2).

3.3 Contact form submissions (voluntary)

When you use a contact form, your name, email address, and message are transmitted via Resend as an email to our team so we can respond. We retain that correspondence only for as long as needed to handle your enquiry, then delete it.

3.4 Your Arcnode account and sign-in

You use a single Arcnode account across the whole network. Sign-in and account management are handled by our identity provider at backboard.arcnode.dev. When you create or use an account, we process the data you submit to provide the Service. This may include:

• Content you create within a Service.
• Preferences and settings.
• Your name and email address.
• Sign-in credentials. If you set a password, it is stored only as a salted bcrypt hash and is never stored or transmitted in plain text. Some accounts, such as those created by linking Discord, have no password at all.
• If you enable two-factor authentication (2FA), a TOTP secret and a set of recovery codes. Recovery codes are stored only as hashes.
• If you register a passkey (WebAuthn), the passkey's public key, credential identifier, sign-in counter, supported transports, and an optional label you give it. The private key never leaves your device; we can never see it.

After you sign in, the identity provider issues a signed session that is verified by each Service using public keys, so your password, passkey, and 2FA secrets are never shared with the individual Services. All data is transmitted over HTTPS. We do not use your content for any purpose other than operating the Service for you.

3.5 Discord account linking

You may connect (link) your Discord account to your Arcnode account to earn a Verifiedbadge in our community server. Linking is optional and is never required to use the Platform. When you link through Discord's OAuth, Discord shares a limited profile with us, which we store together with the moment you linked:

Community role information (for example the Verified role) is maintained by our Discord bot and mirrored so that role-based access stays current. You can unlink Discord at any time; a moderator or administrator can also link, unlink, or moderate an account. Discord is listed as a processor in section 6.

3.6 Client portal data

The Arcnode Client Portal is a private, authenticated environment accessible only to invited clients and their team members. The following categories of personal data are processed within the portal:

04 Surveys and market research

Arcnode Network publishes surveys for market research and public engagement at arcnode.dev/surveys and on individual survey pages under arcnode.dev/s. You can complete a survey without creating an account. Surveys come in three visibility types:

• Public surveys: listed in the public survey directory and open to anyone.
• Unlisted surveys: not listed or indexed, but open to anyone who has the link.
• Invite-only surveys: accessible only with a personal invitation link sent by email.

4.1 Data we collect when you respond

4.2 Optional email subscriptions (separate consent)

Submitting a survey response never subscribes you to email. A survey may offer up to two separate, optional checkboxes, both unchecked by default:

• Arcnode Network waitlist: news about Arcnode Network products and launches.
• Survey-specific updates: messages about that survey only, such as published results or a follow-up study.

Both use double opt-in: after selecting a checkbox you receive a single confirmation email, and the subscription only becomes active once you confirm it. If you do not confirm, you receive nothing further. We record the exact consent wording, its version, the timestamp, and the survey and response it came from. Every subscription email contains a working unsubscribe link and supports one-click unsubscribe headers, and a token-based preferences page lets you manage the subscription without an account.

Delivery failures (bounces) and spam complaints reported by our email provider automatically suppress future email to the affected address. We do not use open or click tracking in these emails.

A survey may additionally offer an optional follow-up permission checkbox allowing us to contact you once about your answers. This is not a subscription and sends no recurring email.

4.3 Invitations

For invite-only surveys we process the email address (and optional name) of invitees in order to send and manage invitations. Invitation links are personal, expire, can be revoked, and have a limited number of uses. The link token is stored only as a cryptographic hash; opening a valid invitation places a short-lived, strictly necessary cookie (see the Cookie Policy) and removes the token from the address bar. A response submitted through an invitation is linked to that invitation.

4.4 Spam and abuse prevention

Because public surveys accept submissions without a login, we apply layered protection: rate limiting (IP addresses are used transiently as rate-limit keys and expire within the rate-limit window; they are not stored with your response, which never records an IP), Cloudflare Turnstile verification on submission, a honeypot field, and a minimum completion-time check. Turnstile is provided by Cloudflare and is listed as a processor in section 6.

4.5 Who runs each survey, and publication of results

Every survey displays its own privacy notice stating the purpose of the survey, who runs it (Arcnode Network or a named commissioning organisation), the retention period for responses, whether results may be published, and whether response data is shared with a third party. Where a survey is commissioned by another organisation, that organisation is named in the survey itself.

Published survey results contain only aggregated statistics compiled by an administrator. Raw responses are never published automatically, and free-text answers are only ever published after manual review and anonymisation.

Unfinished responses can, where the survey enables it, be kept temporarily in your own browser's local storage so you can continue later. This draft never leaves your device and is deleted when you submit or choose to start over. See the Cookie Policy for details.

05 Legal bases for processing (Art. 6)

Article 6 GDPR requires a lawful basis for every processing activity that involves personal data. The following bases apply across the network:

06 Third-party processors

We use the following processors, each of which handles personal data on our behalf under an Article 28 GDPR data-processing arrangement. We do not sell personal data to any of them.

07 International transfers

Some of our processors operate infrastructure outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V of the GDPR, such as the European Commission Standard Contractual Clauses and, where applicable, an adequacy decision.

File uploads are stored in Cloudflare R2 object storage in the EU (EEUR region). No international transfer of stored file objects occurs. Cloudflare's DPA and Standard Contractual Clauses govern any residual management-plane processing.

You may request information about the safeguards that apply to a specific transfer by contacting legal@arcnode.dev.

08 Data retention

Under Article 5(1)(e) GDPR, personal data must not be kept longer than necessary. The following retention periods apply:

09 Your rights

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights:

• Right of access (Art. 15): to confirm whether we process personal data about you and to receive a copy.
• Right to rectification (Art. 16): to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): to request deletion of your personal data, subject to any legal retention obligation.
• Right to restriction (Art. 18): to limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): to receive a copy of the data you provided in a structured, machine-readable format where processing is based on consent or contract.
• Right to object (Art. 21): to object to processing based on legitimate interests at any time. See section 5.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77): with a supervisory authority. See section 14.

To exercise any of these rights, contact legal@arcnode.dev. We will respond within one month as required by Article 12(3) GDPR. We may verify your identity before acting on a request.

10 Account deletion, export, and correction

You can ask us to export, correct, or permanently delete your account and associated personal data at any time. Send your request to legal@arcnode.dev from the email address linked to your account, or include enough information for us to verify your identity.

On a verified deletion request, we permanently remove your account and the personal data we hold about you within a reasonable time, except where we are legally required to retain specific records.

Client portal users may delete their account directly from Settings → Danger zone within the portal. Account deletion immediately deletes all associated personal data and R2 file uploads. Team membership records are also deleted; team projects and their content remain accessible to other team members.

Client portal users can also export their own data directly from Settings → Export your data. We email a secure link that is valid for 7 days and only works after you sign in; it lets you download a machine-readable zip archive of your profile, teams, projects, tasks, comments, form answers, and file list. To prevent abuse, an export can be requested once every 30 days, and the download link never stores a copy of your data.

Survey respondents can request access to, correction of, or deletion of their survey responses, consent records, and subscriptions by contacting legal@arcnode.dev, preferably from the email address used in the response so we can verify the request.

11 Cookies and analytics

We use only strictly necessary and privacy-respecting analytics cookies by default. The categories we use, their purposes, their retention periods, and how to manage your consent are described in full in our Cookie Policy. Analytics are processed in aggregated form and are not used to build advertising profiles.

12 Security measures

We apply technical and organisational measures including:

• HTTPS encryption for all data in transit between your device and our servers.
• Passwords stored only as salted bcrypt hashes, never in plain text.
• Optional two-factor authentication (TOTP) and passkeys (WebAuthn), giving phishing- resistant sign-in. A passkey's private key never leaves your device.
• A single sign-on session issued by our identity provider. The session is a signed token (RS256) that each Service verifies against the identity provider's public keys, so no shared secret is distributed to individual Services. The session cookie is httpOnly, Secure, and SameSite=Lax. Signing out and password or credential changes revoke existing sessions everywhere.
• Access to data restricted to authorised infrastructure components.
• Automatic account lockout after repeated failed sign-in attempts, and rate limiting on sensitive authentication endpoints such as sign-in, password reset, and account deletion.
• Security event logging for all authentication events in the client portal, including both successful and failed login attempts.
• Pre-signed upload URLs: file content transfers directly from the client's browser to Cloudflare R2. Arcnode's application servers never handle file content.
• Survey invitation, confirmation, and unsubscribe tokens are stored exclusively as keyed cryptographic hashes; the raw token exists only in the link sent to the recipient.
• Public survey submissions are protected by rate limiting, Cloudflare Turnstile verification, a honeypot field, and minimum completion-time checks.

No system is perfectly secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by Article 34 GDPR.

13 Children's privacy

Our products are not directed at children under the age of 16 within the EEA (Article 8 GDPR), or under 13 elsewhere. We do not knowingly collect personal data from children below these ages.

If you are a parent or guardian and believe your child has provided personal data to us, contact legal@arcnode.dev and we will delete it promptly.

14 Complaints

You have the right to lodge a complaint with a supervisory authority. In Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), reachable at autoriteitpersoonsgegevens.nl. You may also contact the supervisory authority in your country of residence. We would appreciate the chance to address your concern first, so please consider contacting legal@arcnode.dev before lodging a complaint.

15 Changes to this policy

We may update this policy when our practices change or when required by law. The effective date at the top reflects the most recent version. For material changes, we will provide notice on the website or within the relevant application.

Continued use of our website or applications after the effective date of a revised policy constitutes your acknowledgement of the changes.

16 Contact

For any privacy-related question, request, or complaint: