Privacy Policy

What Arcus collects, how we use it, and the controls you have.

This policy applies to the Arcus mobile application and any related services we provide ("Arcus", "we", "us"). By using Arcus you accept the practices described here.

1. Who we are

Arcus is operated by Merick Evans (sole proprietor). The legal entity will be updated here once Arcus is incorporated. Contact: merickevans@gmail.com.

2. Information we collect

Account information

When you sign in with Apple, we receive your Apple ID identifier and (with your consent) your name and email. We do not receive your Apple ID password.

Profile information you provide

Your handle, display name, optional bio, optional bodyweight, optional height, optional unit preference, optional avatar image, and the reason you joined.

Workout data you create

Workout templates you build, workout logs you record (sets, reps, weights, dates), and any notes attached.

Posts and social data you create

Workout-card posts, video uploads, physique-update entries (bodyweight, height, optional photos), captions, comments you write, "Hoorays" you give, the people you follow, and the clubs and challenges you join or create.

Device and usage information

Standard logs including app version, OS version, IP address (transient, used for security and abuse prevention), and crash reports.

What we do not collect

Advertising identifiers (IDFA), location data, contacts, microphone audio, or any tracking data from outside the app.

3. How we use information

To provide the core service: authentication, social feed, workout logging, sharing.
To keep accounts secure (rate-limiting, abuse detection).
To improve features (in aggregate, not as personal targeting).
To communicate critical product changes (rarely).

We do not sell your data. We do not share it for advertising.

4. Where your data lives

Arcus uses the following infrastructure providers:

Supabase (hosted in the US) — primary database, file storage, authentication.
Mux (hosted in the US) — video transcoding and streaming.
Apple — Sign in with Apple, App Store distribution.
Meta / Instagram — only if you explicitly tap "Share to Story", we hand the rendered image to Instagram via an iOS share intent. We do not send any other data to Meta.

These providers process data on our behalf under their own security and privacy commitments.

5. Visibility of your content

Public posts are visible to anyone using Arcus.
Private posts (e.g. private physique updates) are visible only to you. Storage URLs are gated by row-level security policies in our database.
Followers and clubs see your public posts in their feed.

You control visibility per post.

6. Your rights

You can:

Edit your profile, posts, and physique entries at any time.
Delete posts individually.
Delete your account at any time from inside the app: open Profile, scroll to the bottom, tap Delete account. This permanently removes your profile, posts, comments, follows, workouts, and uploaded photos and videos. You can also email merickevans@gmail.com if you'd prefer manual handling.
Request a copy of your data. Email us.

We will honor deletion requests within 30 days.

7. Children

Arcus is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us data, contact us and we will delete it.

8. Security

We use HTTPS for all network traffic, row-level security for database access, and signed URLs for private content. No system is perfectly secure — if we discover a breach affecting your data we will notify you within 72 hours.

9. Changes to this policy

We may update this policy. Material changes will be communicated in the app. The "Updated" date at the top reflects the latest revision.

10. Contact

Questions: merickevans@gmail.com