Privacy Policy

1. Who we are

Arcavia is a writing platform operated by Arcavia Technologies (Malaysia). Our registered address and contact information are available at our contact form.

2. What data we collect

We collect the minimum data necessary to operate the service:

• Account data: Your email address, display name, and hashed password (or OAuth provider ID if you sign in with Google).
• Writing content: Your project titles, chapter content, and word count records. This data is stored securely in Supabase and is private to your account.
• Usage data: Writing session timestamps and word counts, used to power your analytics dashboard. We do not track mouse movements, keystrokes, or idle time.
• Billing data: For Pro subscribers: payment is processed by senangPay. We do not store your card details. We receive and store your subscription status and plan ID only.
• Technical data: Browser type, device type, and country (for error logging and fraud prevention only). No detailed location data is stored.

3. How we use your data

We use your data only to:

• Provide and improve the Arcavia writing platform
• Display your personal analytics and achievement progress
• Send transactional emails (password reset, billing receipts)
• Send the optional weekly writing digest (Pro users, opt-out anytime)
• Respond to your support requests
• Detect and prevent abuse or fraud

We do not sell your data, show you advertising, or share your content with third parties except as required to operate the service (e.g. our hosting provider, Supabase).

4. Your writing is private

Your story content is stored encrypted at rest in our database. No Arcavia employee will read your stories without your explicit permission (e.g. if you share a specific excerpt in a support ticket). Your writing is never indexed, analysed for advertising purposes, or shared with any third party.

5. Data retention

We retain your account data for as long as your account is active. If you delete your account, all associated data — including your projects and writing content — is permanently deleted within 30 days. Billing records are retained for 7 years as required by Malaysian financial regulations.

6. Cookies

Arcavia uses only essential cookies required for authentication (your login session token). We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

7. Your rights

Under Malaysian and applicable data protection laws, you have the right to:

• Access a copy of all data we hold about you
• Correct inaccurate data
• Delete your account and all associated data
• Export your writing content at any time from the app
• Opt out of non-essential communications

To exercise any of these rights, let us know at our contact form.

8. Third-party services

We use a small number of trusted third-party services to operate Arcavia:

• Supabase — database and authentication hosting (servers located in Singapore)
• senangPay — payment processing for Malaysian users
• Resend — transactional email delivery
• Vercel — application hosting

Each of these providers has their own privacy policy. None of them have access to your story content.

9. Changes to this policy

We will notify you of any material changes to this policy by email and by updating the "Last updated" date above. Continued use of Arcavia after changes constitutes acceptance of the updated policy.

10. Contact

Questions about privacy? Use our contact form and we will respond within 5 business days.