Privacy policy

Who runs Arc

Arc is run by Keelan Devlin Treloar. Questions, corrections or complaints go to keelan@shuhari-group.com and reach a person, not a queue.

What Arc collects

Three kinds of thing, and the second is the large one.

Also a small log of which steps you took inside Arc (front door seen, preview run, signed up, intake sent, first check-in, back on day 7 and day 30, paywall seen, subscribed), one line each with the date, for the funnel counts described under Cookies. If you delete your account the lines stay with your account removed from them.

• Account details: your name, your email address, and a hashed version of your password. Arc never stores your actual password.
• Health and training information you enter: age, sex, height, weight, injury history, current niggles, a pain score and what aggravates it, any medical conditions or medications you choose to tell it, gut and fuelling notes, sleep, stress, heart rate figures, VO2 max, mobility measurements, your daily feel and soreness scores, and the sessions and lifts you log.
• Check-in photos: the live photo you take to prove a session happened.
• The streak warning, if you turn it on: the push address your phone or browser issues for Arc, and the time zone you set the hour in. Nothing else about the device. Added 16 September 2026.

Photos are deleted after 24 hours

Check-in photos are taken with the camera inside the app. There is no gallery upload, on purpose. The photo is stored on Arc's own server and is automatically deleted within 24 hours of being taken, file and all. The record that you checked in survives so your streak stays intact, but the image is gone.

A check-in photo is shown to the other athletes in your squad on the day it is taken, first name only, and only once they have checked in themselves that day. Each photo is its own tile, with how many of that day's sessions you had done when you took it (for example 1/3). No time, pace, weight or result is ever shown with it. It is never used for anything else and never sent to any third party. Nobody, including Arc, can see it after the 24 hours.

When you set a personal best you can choose to put it on your own check-in photo and save the image to share. Arc never does this for you, and the image is made on your phone.

A result photo is different, and it is your choice. When you log a race or a time trial you can add a photo of the result or the watch. It is stored on Arc's server, shown only to you on that result, never to your squad or anyone else, and kept until you remove the result or delete your account. The Account screen has a switch to keep none at all, and turning it off removes every result photo already stored.

If your camera will not open, a session can be checked in without a photo. That completion is kept as part of your training record, feeds your plan, and is shown to your cohort as done, with no photo. It earns nothing and does not count toward your streak until a photo is added the same day.

Cookies

Arc sets five cookies and no others. arc_session keeps you signed in on this device for 30 days and holds nothing but a random token. arc_preview holds the answers you gave the plan preview on the front door for 30 days, so the intake is already filled in when you sign up. arc_squad remembers a squad invite link you opened before signing in, so you land in that squad after. arc_v is a random visitor id and arc_src the link you arrived on (a source tag or the referring site), which together let Arc count how many people who saw the front door went on to sign up. Those counts are kept on Arc's own server and read only by the person who runs it. None of the five is used for advertising, and nothing about you is sent to any analytics company.

The waitlist

If you leave your email on the front door, Arc keeps it, your first name if you gave one, and the preview answers, until a place opens or you ask for it to be removed. The invite comes from Keelan over whatever channel he has for you; Arc sends no email. If you arrived on a squad's invite link, the squad is noted with it, so you can be put with the people who invited you.

Notifications

Arc has no email. Everything it needs to tell you arrives as a notification on a device you have allowed, or on the Today screen inside the app: that your block is in, that next week is set, that your trial ends in seven days, tomorrow, or today, and the reminders described below. Your coach's own account receives a notification when you request a block, join the waitlist, raise a flag or ask to join a squad, with your first name and nothing else.

The streak warning

If you turn the warning on, Arc sends one notification a day, at the hour you set, only on days your streak is still open. To do that it stores the push address your phone or browser issues for Arc and the time zone you chose. The push service (Apple, Google or Mozilla, depending on the device) carries the message encrypted and never sees your name or your sessions. The address is deleted the moment you turn the warning off on that device, the moment the service reports it dead, or with your account.

Arc does not collect your location

This is deliberate. When you connect Strava or Garmin, Arc asks for and keeps aggregate numbers only: session count, distance, moving time, average pace, sleep and VO2 max. It does not request, store or have access to your GPS routes.

Who your information is shared with

Arc does not sell your data and does not run advertising. It is shared only with the services needed to run the app:

• Anthropic, if AI-assisted programming is used for your block. Your training profile, including injury history and anything you entered as a medical note, is sent as part of the brief. Your name, your email address and your photos are never sent.
• Stripe, for payments. Stripe receives your name, email and a customer reference. Arc never sees or stores your card details.
• Strava and Garmin, if you connect them, to fetch your own activity and sleep data.
• Google Cloud, which hosts the server the app runs on.
• Your coach, being Keelan, who can see your training profile and your answers in order to write your block. That includes any medical note you enter.

Where it is kept and for how long

Arc runs on a single server in the United States and stores everything in one database on that machine. Backups are kept for a limited period so the data can be restored if something breaks.

Your information is kept for as long as your account exists. Check-in photos are the exception and go within 24 hours regardless. A result photo stays only as long as you choose.

Deleting your account

You can delete your account from the Account screen inside the app, at any time, without asking anyone. It removes your profile, your training programme, your check-ins, your logged sessions, your synced statistics, every photo of yours still on disk (check-in and result), and your account itself. It cannot be undone.

If you would rather someone did it for you, email keelan@shuhari-group.com.

Your rights

Depending on where you live you may have the right to see the information Arc holds about you, to have it corrected, to have it deleted, or to get a copy of it. Deletion is built into the app. For anything else, email keelan@shuhari-group.com and it will be handled.

Arc is not intended for anyone under 18 and does not knowingly collect information from children.

Security, honestly stated

Arc runs over HTTPS, stores passwords hashed, keeps the database off the public internet, and rate limits sign-in attempts. It is also a small beta application built by one person, so it should not be treated as though it carries bank-grade protection. Do not put anything in the medical notes field you would not be comfortable having on a small server.

Changes

If this policy changes in a way that matters, you will be told inside the app rather than left to notice. The date at the top of this page is when it was last updated.

Questions

Email keelan@shuhari-group.com.