Privacy & your data

What this covers

This policy is about the arkhelion.ai website and the early-access email list: the form where you reserve a spot, and the emails I send you afterward.

The Arkhelion desktop app is a separate thing. Your health data lives in a local vault on your own Mac. That vault is encrypted at rest with a key held only in your Keychain. Your vault does not pass through my servers; it stays yours, private by design. The app isn't publicly released yet; its own policy will ship with it. This page does not cover it.

Arkhelion is for adults. You must be 18 or older to join the early-access list. This site isn't directed at children, and I don't knowingly collect anything from anyone under 13. If you think a child signed up, email [email protected] and I'll delete the record.

What I collect, and why

When you submit the signup form, the form sends a small request to my own server (a Cloudflare Worker at api.arkhelion.ai). It records:

• Your email address: so I can email you a confirmation link and, once you confirm, the early-access updates you signed up for. Stored as you typed it, plus a one-way hash of it used to look you up without scanning the plaintext.
• A status (pending, confirmed, or unsubscribed): so I know whether to email you.
• A source tag: which signup page you came from (defaults to arkhelion.ai). This tells me where signups originate.
• How you heard about Arkhelion: whichever option you pick from the dropdown on the form. It's optional, you can leave it blank, and leaving it blank changes nothing. This is a different thing from the source tag above: that one is recorded automatically from the page you were on, this one is only what you chose to tell me.
• A truncated IP address: the last part is zeroed out before it's stored (e.g. 203.0.113.0). It's kept only to slow down abuse and spam, and it can't identify your exact device.
• A one-way hash of your browser's user-agent string: the raw user-agent is never stored, only an irreversible fingerprint, again for abuse prevention.
• A country code: the two-letter country your request came through (e.g. US), from Cloudflare's edge. No finer location than that.
• Timestamps. The lifecycle of your signup: when you consented and signed up, when the confirmation was sent, when you confirmed, when you unsubscribed, and when the record was last updated.
• One-way token hashes: irreversible hashes of the confirmation and unsubscribe links emailed to you, stored so those links can be validated when you click them. The link values themselves are never stored.

That's the entire list. I don't ask for your name, and I don't collect anything the form doesn't show you.

What I don't do

• No cross-site tracking, no ads, no profiling. There's no Google Analytics, no advertising pixels, no ad-network scripts, and nothing that follows you to other sites. The page loads its own files, a Cloudflare anti-bot widget, and a Cloudflare page-view counter — both described below.
• A page-view counter, and that's all it is. I use Cloudflare Web Analytics to count how many people land on a page. It sets no cookies, doesn't follow you to other sites, and doesn't build a profile — I can see that a page was loaded, not who loaded it. I use it for one reason: without it I can't tell "nobody wanted this" from "nobody saw it".
• No selling or renting. I do not sell, rent, or trade your information, and I do not share it for cross-context behavioral advertising. Not now, not ever.
• No profiling. I don't combine your email with data from other sources to build a profile, and I don't make automated decisions about you.

Who can see it

Your information is held by me and by two service providers that operate strictly on my behalf, under their own data-protection terms. They are processors, not partners. They're contractually limited to handling your data only to provide these services, and don't get to use it for their own purposes.

• Cloudflare hosts the signup server and the database that stores the list, and runs the anti-bot challenge on the form. That challenge (Cloudflare Turnstile) inspects browser and network signals to tell humans from bots; it sets no tracking cookies, and I don't get access to its bot-detection logs.
• Resend delivers the confirmation, welcome, and update emails. To send you an email, Resend necessarily receives your email address.

I may also disclose information if the law genuinely requires it. I'll resist over-broad requests, and I'll tell you if I'm allowed to.

How long I keep it

I keep your information for as long as you're on the list. If you unsubscribe, I mark your record as unsubscribed and stop emailing you, and I keep a minimal suppression record (just your email and unsubscribed status) for as long as the list runs, so I don't accidentally add you back. There's no fixed calendar period; that record exists only to honor your opt-out. If you ask me to delete everything, I remove your record entirely, suppression record included. See your rights below.

Your rights

Wherever you live, you can email me and I'll honor these. If you're in California, the CCPA/CPRA gives you the right to:

• Know and access what I've collected about you.
• Delete it.
• Correct it if it's wrong.
• Opt out of sale or sharing. There's nothing to opt out of, because I don't sell or share your data, but the right stands.
• Not be discriminated against for exercising any of these. I won't treat you differently for asking.

California's CPRA also adds a right to limit the use of sensitive personal information, but I don't collect any (no government IDs, financial details, precise location, health data, or the like), so there's nothing to limit here.

To use any of these, email [email protected] from the address you signed up with (or tell me which address), and say what you want. I'll respond within 45 days, as the law requires, usually much sooner, since it's just me. You can also unsubscribe instantly using the link at the bottom of any email I send.

If you're in the UK, the EU, or Australia

The section above is written for California law. Here's the same thing in the terms your own law uses.

• Who holds your data: Brock Vom Steeg, in the United States. There is no company department to write to; it's one person, and the address is [email protected].
• Why I'm allowed to hold it: because you consented when you signed up (UK/EU GDPR Article 6(1)(a)). That's the only basis I rely on.
• You can take that back at any time, and it costs you nothing: use the unsubscribe link at the bottom of any email, or just tell me. Withdrawing doesn't undo anything I did before you withdrew, but it stops everything after.
• You can also ask what I hold, get a copy of it, correct it, delete it, ask me to stop, or object. Wherever you live, I'll do it.
• How fast: within one month, as UK and EU law require. Usually the same day; it's just me and the list is small.
• I don't hold health data about you. The free tool at /what-came-before/ runs entirely inside your own browser and sends nothing anywhere — that's checked automatically on every change, and if it ever stopped being true the page would come down the same day. If we ever talk, I take short notes with no name attached, and I don't want your records.
• If I get it wrong, you can complain to your regulator: the ICO at ico.org.uk/concerns in the UK, your national data protection authority in the EU, or the OAIC at oaic.gov.au in Australia. You don't have to go through me first.

Notice at Collection (California)

At the point you sign up, here's the required summary:

• Categories collected: identifiers (your email address, a truncated IP, a hashed user-agent, a country code), a source tag, an optional self-reported "how you heard about Arkhelion", lifecycle timestamps, token hashes, and your email-opt-in consent record.
• Purpose, by category: your email, to send the confirmation and the early-access updates you asked for; the truncated IP and hashed user-agent, to detect and block signup-form abuse; country, source, how you heard about Arkhelion, timestamps, and token hashes, for operational record-keeping and validating your confirm/unsubscribe links. Nothing else.
• Sold or shared? No. Never sold, and never shared for cross-context behavioral advertising.
• How long: until you unsubscribe or ask me to delete it (see above).

Cookies & tracking

This site sets no tracking cookies. The signup form uses Cloudflare Turnstile to tell humans from bots; it may set a short-lived, privacy-preserving token to run that check, and it does not track you across other sites. Cloudflare Web Analytics counts page views without setting any cookie at all — it uses no cookie, no local storage, and no cross-site identifier.

Changes

If I change this policy, I'll update the effective date at the top, and for anything significant I'll say so in an email to the list. The current version always lives at arkhelion.ai/privacy.

Contact

Arkhelion is built by one person, Brock, in Southern California. Reach me directly at [email protected] for privacy questions, deletion requests, or anything else.