Privacy Policy

• Account data — your name/company, email, and a securely hashed password (bcrypt). We never store your password in plain text.
• Connected-source credentials — when you link Google Analytics (or, in future, Meta/LinkedIn), we store the OAuth access/refresh tokens encrypted at rest (Fernet/AES). We never see or store your Google password.
• Analytics data — we fetch reporting metrics from your connected sources to render your dashboards. We request read-only scopes.
• Basic technical data — IP address and request metadata, used for security (rate limiting) and reliability.

To operate the product: authenticate you, render your dashboards, generate reports, and keep the service secure and reliable. We do not use your analytics data for advertising and we do not sell it.

We rely on infrastructure providers to run ArbFlow — hosting (Vercel, Render), a managed Postgres database (Neon), and the analytics APIs you connect (e.g. Google Analytics). Your data is processed by these providers only to deliver the service.

We keep your data while your account is active. You can delete your account at any time from Settings → Profile → Danger zone; this permanently removes your account and all connected-source credentials. You may also email us to request export or deletion.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. Contact us to exercise these rights; disconnecting a data source or deleting your account takes effect immediately.

Credentials are encrypted at rest, passwords are hashed, sign-in is rate-limited, and access to your workspace requires authentication. No system is perfectly secure, but we take reasonable measures to protect your data and continue to harden the platform.

We may update this policy as the product evolves. Material changes will be reflected by the "Last updated" date above.