ArcLedger Privacy Policy

Publisher: ArcanEdge LLC · Applies to: this website and ArcLedger, signed STANDARD edition for Windows · Version: Version 1.1. Effective date: October 30, 2026

What ArcLedger Stores Locally

ArcLedger stores client names, projects, work issues, timers, review decisions, billing settings, statements, feature flags, recognition rules, and audit history in the user's local data store. The desktop application uses an authoritative SQLite V2 database under the Electron userData directory. Supported legacy JSON data may be migrated into SQLite; JSON remains available for compatible export and recovery, but it is not the current desktop source of truth.

At startup, ArcLedger creates a local SQLite backup if one does not already exist for that day. It also makes a safety backup before importing data. You can make manual JSON backups and exports. These copies stay local unless you choose to copy or share them.

Standard builds may also store Project Baselines, Agentic Impact actual/report revisions, private Business Economics profiles, Estimate drafts and immutable revisions, acceptance/conversion/actual records, and rebuildable local numeric calibration. Private economics, cost floors, margins, internal explanations, and calibration details are not part of client proposal projections.

Work Log presents the complete local human-plus-agent audit history. When the configured on-device model is available, Review may automatically generate and persist a client-facing summary. The verified work facts, generated text, model label, and facts hash remain local. If the facts change, the summary is marked out of date and must be refreshed before billing approval.

Local Tracking Signals

While it runs, ArcLedger uses local signals to record and classify work. The desktop collector reads the foreground application, process name and window title, and the titles of open windows that match a watch rule. It uses them on the device to match activity to clients. Raw titles are not stored automatically: a title is kept only when you turn it into a rule or label. ArcLedger may also count changed files under a watched project folder, by project and coarse file category, and read git output counts (commits and lines), without storing file paths, names or contents. Trusted local agents may report runtime and coarse status. Presence alone is not billable human activity, and billing remains subject to your review.

What ArcLedger Does Not Store

Normal tracking does not capture or store screenshots, screen recordings, DOM/page content, keystrokes, clipboard data, or raw browser URLs. Strict metadata mode rejects those fields in the service layer.

Local Vision is a separate optional feature. After explicit persistent consent, it may capture one foreground image in memory and send it only to a model on the local loopback interface. ArcLedger discards the image pixels and may persist only sanitized derived text. Captured pixels are not durably stored or sent to a remote service.

Browser Extension Metadata

The browser extension may send tab titles and tab-group names to the local desktop bridge so the user can pick or attribute the right local work surface. Those labels are transient unless the user explicitly saves a recognition rule such as a tab-group-to-client mapping. Browser presence, including an open or pinned group, is not billable by itself. Human billability requires active same-client focus or stronger non-conflicting evidence and remains subject to human Review.

On-device AI

Managed Local AI is on by default.

• On first launch, ArcLedger downloads its pinned runtime and model files, verifies them, and runs them on the device, on the loopback interface only. The network section below describes those downloads.
• Review summaries run through this on-device runtime. The same local runtime may draft a client-safe Estimate proposal summary from allowlisted public facts.
• Images, prompts, and generated private reasoning are not sent to a cloud AI service.
• Settings → Local AI turns managed Local AI off.

Local Vision, described above, is separate and needs its own explicit consent.

Subscription Service (ArcLedger Pro)

ArcLedger Free makes no subscription connection. Connecting Pro from Settings → Subscription uses the account page and automatic licence refresh described below. Manual import of a signed licence file is also supported when ArcanEdge support supplies one.

On your computer. ArcLedger keeps its signed licence receipt, the last verified entitlement, and the computer's activation credential outside the editable business data, protected with Windows secure storage. ArcLedger never stores payment-card data.

What the desktop app sends to ArcanEdge's subscription service:

• when you connect: a random workspace identifier, a one-way hash of a new activation credential that ArcLedger creates on your computer, and the ArcLedger version;
• while connecting, and about once a day afterwards: that activation credential, the workspace identifier and the ArcLedger version, to receive a fresh signed licence.

It never sends client names, projects, work logs, timers, screenshots, file contents, rates, statements, proposal text, private economics or billing evidence.

The account page in your browser. To connect a computer, you sign in on ArcanEdge's account page with an email link.

• The email address you enter goes to Firebase Authentication, a Google service, which emails you a one-time sign-in link and keeps a sign-in account for that address: the address, an account identifier and sign-in times.
• The subscription service receives a Google-signed proof of that sign-in, which includes the address, and uses the address to look up your subscriptions with Paddle.
• The page itself loads Google's Firebase sign-in software from gstatic.com.
• It keeps the address in your browser only between asking for a link and using it, and keeps the sign-in for that browser tab only.

What ArcanEdge's subscription service stores:

• your Paddle customer and subscription identifiers;
• the subscription's price, status, billing periods, payment and refund states, and their Paddle identifiers and times;
• for each connected computer: the workspace identifier, a hash of its activation credential, the ArcLedger version, and when it was connected, last refreshed and released;
• a record of each issued licence: its identifier, the computer, the time, the subscription state and the signing-key identifier. The newest 1,000 records are kept.

The service doesn't store your email address. Pending connection requests expire. Records of processed Paddle notifications are kept for 30 days.

How long we keep subscription and computer records:

• While you have paid access to ArcLedger Pro, we keep the account and computer records needed to provide it.
• After all paid access ends, we keep those records for up to 12 months. Then we delete them.
• You can ask us to delete them sooner by emailing info@arcanedge.ai. We check that the request comes from you before we act on it.
• We may keep some records longer when we need them to meet a legal obligation, keep the service secure, or resolve a dispute or chargeback.
• If we can't reliably tell which records and sign-in accounts belong to you, we keep them until we can.

Retention is handled by an operator procedure, with a review on the first business day of each month. Verified deletion requests are handled as they arrive. Before anything is deleted, an operator reviews the planned deletions and authorizes that run. There is no automatic background deletion service. A sign-in account that has never purchased is eligible for deletion 90 days after its last successful sign-in, or after creation if it has never signed in, at the next monthly review. An applicable hold may delay deletion.

We keep records of deletion requests, verification, holds and completed deletions separately from the subscription database. They contain account and subscription identifiers, hashes of email addresses, and the actions and dates; they do not contain the email addresses themselves. At the monthly review, closed case details that have been kept for at least 24 months are deleted or reduced, unless a hold applies. Completed deletions are reduced to subscription identifiers and deletion details that prevent a restore or provider import from bringing deleted records back. We review the continued need for those remaining records yearly.

Other copies follow their own schedules:

• Your Firebase Authentication sign-in account is deleted when we delete your records. Google then removes it from its systems within 180 days.
• Server request logs are kept for 30 days.
• Database backups are kept for up to 14 days. Records we have deleted stay in them until they expire. If we ever restore a backup, we delete those records again before the restored copy is put back into use.
• Paddle keeps its own records of your purchases under its privacy notice.

Deleting your records with us doesn't remove copies that Paddle or Google keep on their own terms.

Server logs. Like any web service, the subscription service's hosting (Google Cloud) logs each request: the time, the requested address, the response, and the connecting IP address and browser or app details. These logs are kept for 30 days. One-time sign-in codes are excluded from them. To limit abuse, the running service also briefly remembers connecting addresses in memory.

Who else handles this data, and in what role:

• Paddle sells ArcLedger Pro as our online reseller and Merchant of Record. Paddle collects your payment details, billing address and tax information itself and, for its reseller and payment activities, handles them as a controller under its own privacy notice. ArcanEdge receives your Paddle customer and subscription records from Paddle, not your payment details.
• Google provides the services the subscription service runs on. Its role depends on the service and the terms that cover it:
  • Google Cloud hosts the subscription service, its database and its request logs. Under Google's Cloud Data Processing Addendum, Google processes this data as ArcanEdge's processor.
  • Firebase Authentication keeps your sign-in account and sends the sign-in email. Under the Firebase Data Processing and Security Terms, Google generally acts as ArcanEdge's processor. Firebase Authentication runs from US data centers.
  • The account page loads Google's Firebase sign-in software from gstatic.com. Google provides it under its own terms and privacy policy.

Local Learning

Estimate calibration stores structured category codes, immutable source IDs, numeric aggregates, exclusions, confidence, and facts hashes. It does not copy client names, proposal narrative, prompts, transcripts, or source code. The user may disable suggestions or clear/rebuild derived aggregates without deleting source history.

OAuth, API Keys, and Tokens

Source-connection OAuth tokens are stored separately from the business data file and use Electron safeStorage when persisted. If OS-backed secure storage is unavailable, ArcLedger fails closed rather than writing plaintext OAuth tokens. API keys are session-only unless a future approved workflow states otherwise.

Network Services

Desktop operation is local-first. REST bindings default to 127.0.0.1; non-loopback mode requires explicit configuration.

Subscription service (ArcLedger Pro only)

A connected Pro computer contacts ArcanEdge's subscription service to activate and refresh its licence. Refresh checks run about once a day while the app is running, at launch or wake when due, and when you ask it to check. The "Subscription Service" section above lists what it sends and stores. ArcLedger Free makes no subscription connection.

Managed Local AI downloads

When managed Local AI starts (first launch by default) and its pinned files aren't already installed, ArcLedger downloads:

• its pinned llama.cpp runtime from github.com;
• its pinned model files from huggingface.co.

It verifies each against a SHA-256 checksum. These requests send no local work or business data. Like any HTTPS request, they reveal the device's address and the time it connects to those services. On Windows, if the installed Microsoft Visual C++ runtime is missing or older than required, ArcLedger installs Microsoft's bundled runtime after a Windows elevation prompt; that step is local. Settings → Local AI turns managed setup off.

OpenTimestamps evidence anchoring

OpenTimestamps anchoring is ArcLedger's one default-on outbound evidence call. It does not run during ordinary tracking or reconciliation. When the operator explicitly anchors the audit chain or marks a statement billed, ArcLedger computes one combined SHA-256 root over the audit, time-evidence, tracking-evidence, and agent-runtime chains and submits only that 32-byte hash to three public OpenTimestamps calendar servers. No client names, business data, file contents, prompts, URLs, or image data are included in the request. That describes what ArcLedger sends, not what any network connection reveals: like any HTTPS request, it is visible to those servers and the network, for example the device's address and when it connects.

Each calendar's result is stored locally on the audit-anchor record. For a success, that is opaque cryptographic proof bytes built from at most the first 10 KB of the calendar's response (the whole response is received before it is cut). For a failure, it is the HTTP status with up to 200 characters of the calendar's response body, or the error message.

The operator may turn OpenTimestamps anchoring off in Settings → Privacy → External evidence checkpoint for offline or restricted environments. The choice is read when ArcLedger starts, so a change takes effect on the next launch. Closing the window keeps ArcLedger running in the tray; it must be quit from the tray and opened again. Settings shows the saved choice and this session's configuration separately. If no choice has been saved, the default (on) applies. If the saved choice can't be read, ArcLedger also starts with anchoring on, and Settings says the saved choice is unavailable. Setting the environment variable ARCLEDGER_OPENTIMESTAMPS_ANCHOR_DISABLED to 1 or true (trimmed, any case) disables the submission whatever choice is saved.

Telemetry

ArcLedger does not include analytics telemetry. Local backups stay on your computer unless you choose to copy or share them. Manual exports and support files are user-controlled.

This Website

Public downloads and Pro subscriptions are currently unavailable. Disabled checkout does not load Paddle.js or open Paddle's payment interface.

The website's information pages serve their scripts, fonts and images locally. Those pages do not set cookies or run analytics or advertising trackers. Email contact links open your email application.

When checkout becomes available and you choose to continue, the page loads Paddle.js from Paddle and opens Paddle's payment interface. Paddle receives your purchase details, the contact and billing information you enter, and technical information such as your IP address and browser details. Payment details are entered in Paddle's interface; the ArcLedger website does not receive your card number or security code. Paddle may use cookies, browser storage and related technology to provide, secure and support payments and subscriptions. See Paddle's privacy notice.

The page shown after checkout explains how to connect Pro in ArcLedger. Visiting that page does not verify payment or activate Pro. The subscription service verifies your subscription separately, as described above.

The site is hosted on Google's Firebase Hosting. Like any website host, it receives what a browser sends with each request, such as the IP address, the page requested, the time and the browser's user agent. Firebase Hosting uses the IP addresses of incoming requests to detect abuse and report usage, and keeps that IP data for a few months.

Support Correspondence

We keep ordinary ArcLedger support correspondence for 24 months after the case closes, then delete it. A documented legal, security or payment-dispute hold keeps only the specific correspondence still needed. The hold records its reason, the responsible person and a review date. We review support correspondence monthly.

Original emails for privacy and deletion requests are also kept for 24 months after the case closes, then deleted. The same holds and monthly review apply. The separate privacy and deletion-request log follows the retention schedule described in "Subscription Service (ArcLedger Pro)" above.

These correspondence rules cover ArcLedger messages only, not unrelated messages in the shared info@arcanedge.ai mailbox.

Contact

Privacy questions, deletion requests and security reports: info@arcanedge.ai (ArcanEdge LLC).

Business location: Wichita Falls, Texas, United States.