Privacy Policy

Last updated: July 2026

1. Who We Are

SuperArc is a product of Syntave Inc., based in San Francisco, California. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our task and workflow management platform.

Contact: superarc.app@gmail.com

Registered address: [LEGAL REGISTERED ADDRESS REQUIRED]

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, avatar image URL.
• User-generated content: tasks, notes, projects, habits, workspace details, tags, comments, and any other data you create or upload within SuperArc.
• OAuth credentials (Google Calendar): if you opt in, we store access and refresh tokens to sync your tasks with Google Calendar. These tokens are stored in our database and used solely for synchronization.
• Communication data: if you contact us, we may retain records of that correspondence.

2.2 Information Collected Automatically

• Usage data: page views, feature interactions, session duration. We use Cloudflare Web Analytics, which collects anonymous, privacy-friendly usage statistics without cookies.
• Device and browser data: IP address (used temporarily for rate-limiting, not stored), browser type, operating system, and user-agent string.
• Error data: when an error occurs, we use Sentry to capture stack traces, error messages, performance data, and in some cases session replays (limited to 10% of sessions, 100% on error). These may include DOM snapshots of the page at the time of error.
• Push notification subscriptions: if you enable push notifications, we store your browser endpoint and encryption keys to deliver notifications.

3. How We Use Your Information

• To provide, maintain, and improve SuperArc.
• To authenticate your account and keep it secure.
• To communicate with you about your account, including security, billing, and product updates.
• To send notifications you have opted into (in-app, email, push).
• To detect, prevent, and address technical issues, abuse, or fraud.
• To understand usage patterns and improve platform performance and user experience.
• To synchronize your tasks with Google Calendar if you have opted into that integration.

We do not use your data to train artificial intelligence models. SuperArc does not currently employ any AI or machine learning inference systems.

4. Legal Basis for Processing (EEA and UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

• Contract performance: to provide SuperArc to you under our Terms of Service.
• Legitimate interests: for security, fraud prevention, and product improvement, where those interests do not override your rights.
• Consent: for optional features like Google Calendar sync and push notifications.

5. Data Sharing and Service Providers

We do not sell your personal information. We share data only with trusted service providers who help us operate the platform, under strict contractual obligations:

When you use Google Calendar sync, your task titles, descriptions, and dates are sent to Google's servers. You can disconnect this integration at any time from your Settings page.

6. International Data Transfers

Your data is processed in the United States and Japan. If you are in the EEA, UK, or other region with data transfer restrictions, we rely on Standard Contractual Clauses or equivalent safeguards for transfers to our service providers.

7. Data Retention

We retain your personal data for as long as your account is active. Specifically:

• Account data: retained until account deletion.
• Content: tasks, notes, projects, habits, and comments are retained until account deletion.
• OAuth tokens: retained until you disconnect the integration or delete your account.
• Error logs: retained by Sentry according to their retention policy (typically 90 days).
• Activity log entries: retained as part of workspace history, even after a member leaves, to preserve audit trail.
• Backups: database backups may retain data for a limited period after deletion, after which they are rotated.

Upon account deletion request, we remove or anonymize your personal data from our active systems. Full removal from backups occurs within 90 days during the normal backup rotation cycle.

Note: As of July 2026, a self-service account deletion feature is not yet available in the application. To request account deletion, please contact us at superarc.app@gmail.com.

8. Data Security

We implement reasonable security measures to protect your data, including:

• Encryption in transit via TLS 1.3 for all connections.
• Encryption at rest using AES-256, provided by our hosting and database infrastructure.
• Row-level security in our database to isolate user data.
• Rate limiting on authentication endpoints to prevent abuse.

However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

Important: SuperArc does not implement end-to-end encryption. Our service providers (including Supabase) can technically access the data stored in their systems. We rely on contractual and technical controls to protect your data.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Correction: update inaccurate or incomplete data.
• Deletion: request deletion of your data.
• Portability: request a machine-readable copy of your data.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: for processing based on consent (e.g., Google Calendar sync).

To exercise these rights, contact us at superarc.app@gmail.com. We will respond within the timeframe required by applicable law.

For California residents: You have the right to request disclosure of information we collect, the sources, purpose, and third parties with whom we share it. We do not sell your personal information. You may also request deletion.

10. Cookies and Tracking

We use essential cookies required for authentication and session management. We do not use advertising or tracking cookies. For details, see our Cookie Policy.

11. Children's Privacy

SuperArc is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification.

13. Contact

For privacy-related inquiries, data requests, or concerns:

Email: superarc.app@gmail.com

Syntave Inc.
[REGISTERED ADDRESS REQUIRED]
San Francisco, CA, United States

14. Governing Law

[GOVERNING LAW TO BE CONFIRMED BY LEGAL COUNSEL]