Privacy

Effective 19 September 2026 · arkhelion.ai

What this page covers

This page covers the arkhelion.ai website, the early access list, and what the Arkhelion Mac app does and does not send. People in Washington and Nevada, and anyone else who wants it, can also read the consumer health data policy. The two pages say the same thing where they overlap.

Arkhelion is for adults. You must be 18 or older to join the list. I don't knowingly collect anything from anyone under 18. If you think a child signed up, email me and I'll delete the record.

The Mac app

• Only on your Mac. Your health history, your notes, and everything the app finds live on your Mac, encrypted, locked with a key only your Mac holds. There is no Arkhelion cloud copy of it.
• I never see your data. Not to set you up, not to help you, not to check anything. Setting up works without it.
• The app makes the reading. It looks for patterns on your Mac. No person reads your record.
• Only if you choose: a question to your own AI account. If you connect your own AI account, then when you ask a question, your question and the parts of your history it needs to answer go to that AI company, under your account and its terms. Never to me. If you never connect one, no part of your history leaves your Mac.
• No tracking in the app. It sends me no usage data and no health data.

The app is not publicly released yet. It will ship with this same promise.

What the website collects, and why

When you reserve early access, the form sends a small request to my own server (a Cloudflare Worker at api.arkhelion.ai). It records:

• Your email address, to send you a confirmation link and, once you confirm, the early access emails you asked for. Stored in lower case, plus a scrambled copy of it, used to look you up.
• A status (pending, confirmed or unsubscribed), so I know whether to email you.
• A source tag: the tag on the link you arrived by, if it had one (for example a link I shared in a patient group), otherwise "arkhelion.ai". It names my link, not you.
• How you heard about Arkhelion, only if you pick an answer on a form that asks. It is optional.
• A shortened IP address, with the last part zeroed out, a scrambled copy of your browser's name, and a two letter country code. These are only for blocking spam and abuse, including checking whether an invite came from the inviter's own network or device.
• Timestamps for when you signed up and consented, when the confirmation was sent, and when you confirmed or left.
• Scrambled copies of your confirm and unsubscribe links, so those links work. The links themselves are never stored.
• Email delivery results: whether each email I sent arrived, bounced or was reported as spam.
• Your place in line, once you confirm, so offers can go out in the order people joined.
• Your own invite link code, a short random code in the link you can give a friend. If a friend joins by it, their record notes that you invited them.
• Who invited you, only if you came by someone's invite link. It is kept as a row number, not their email, along with whether that invite can count.
• That you ticked "I plan to join", if you did, when, and which wording you saw. Unticking clears the tick; my log keeps a dated note of each change.
• Founder's Guest status, if you used a private invite or I gave you one: your guest number and when. Only a scrambled copy of any private invite code is stored.
• A second copy of your email with any +tag and Gmail dots removed, so the same address is not counted twice.
• A test mark, set when the address is one of my test addresses or a few people I know are not customers, so my counts leave it out.

That's the whole list. I don't ask for your name, and I don't collect anything that is not on this list.

How I count visits

I count visits to this site, and presses of the "Reserve early access" button, as daily totals. My own server adds one to a number for that page and that day. That's all it keeps.

• No cookies. No ad pixels. No analytics company.
• No IP address, no browser details, nothing that says who you are is stored with the counts.
• If the link you used carried a tag (like ?via= and a word), I count the tag too, so I know which of my links people use. The tag is removed from the address bar straight away.

Cloudflare, which runs my server, sees your IP address when your browser connects, as any web host does. It uses it for a moment to slow down anyone sending thousands of fake visits, and I never store it.

What I don't do

• No selling or sharing. I don't sell, rent or trade your information, and I don't share it for advertising. Not now, not ever.
• No tracking across other sites. No ads, no ad pixels, no tracking cookies, nothing that follows you elsewhere.
• No profiling. I don't combine your email with data from anywhere else. Apart from the spam checks and setting aside my own test addresses and a few people I know are not customers, software marks only whether an invite could ever count toward a friend credit; it never changes anyone's place in line.

Who can see it

Me, and two service providers that work only on my behalf. They may use your information only to provide their service to me. When you confirm, my phone also gets a short alert through ntfy.sh, a push service, with a row number and the time, never your email.

• Cloudflare hosts this site, the signup server and the database that stores the list, and runs the human check on the form (Turnstile). The human check looks at browser and network signals to tell people from bots. It sets no tracking cookies, and I can't see what it looks at.
• Resend sends my emails, so it receives your email address and the email it is sending.

When paying opens, a payment company will handle your card. I'll name it here before anyone pays, and I will never see your card number.

I may disclose information if the law truly requires it. I'll push back on overly broad requests, and I'll tell you if I'm allowed to.

How long I keep it

I keep your record while you're on the list. If you unsubscribe, I stop emailing you. I keep your record, marked "unsubscribed", so I don't add you back by mistake and you keep your place if you return. If you ask me to delete everything, that goes too.

Your rights

Wherever you live, you can ask me to:

• show you what I hold about you,
• delete it,
• correct it,
• stop using it.

Asking is free, and it won't change how I treat you. Email brock@arkhelion.ai from the address you signed up with. I answer within 45 days and aim to respond much sooner. To stop the emails at once, use the unsubscribe link at the bottom of any email.

California law also lets you limit the use of sensitive personal information. Your email together with the fact that you reserved, any invite record, and the tag on the link you arrived by, could count as health data, so I treat it as sensitive, as the consumer health data policy explains. I use it only to run the list and email you about Arkhelion, and never to guess anything about your health.

If you're in the UK, the EU or Australia

• Who holds your data: Brock VomSteeg, in the United States. It's one person, at brock@arkhelion.ai.
• Why I'm allowed to: you consented when you reserved (UK and EU GDPR Article 6(1)(a)). The daily visit counts hold no personal data.
• You can withdraw at any time, for free, with the unsubscribe link or by telling me. It stops everything after, not before.
• You can also ask what I hold, get a copy, correct it, delete it, ask me to stop, or object.
• How fast: within one month for UK and EU requests. I aim to respond much sooner.
• If I get it wrong, you can complain to your regulator: the ICO at ico.org.uk/concerns in the UK, your national data protection authority in the EU, or the OAIC at oaic.gov.au in Australia.

Notice at collection (California)

• What: identifiers (your email, a shortened IP address, a scrambled copy of your browser's name, a country code), a source tag, an optional "how you heard" answer, timestamps, scrambled link copies and your consent record; once you confirm, your place in line, your own invite link code and which friends joined by it; if they apply, who invited you (as a row number) and whether that invite counts, your "I plan to join" tick, when, and the wording you saw, a Founder's Guest number and when, a scrambled private invite code, a test mark, and a second copy of your email.
• Why: your email, to send what you asked for; the IP and browser hash, to block spam and abuse, including checking whether an invite came from the inviter's own network or device; the rest, to run the list and make your links work.
• Sold or shared? No.
• How long: until you ask me to delete it. Unsubscribing stops the emails.

Cookies and your device

This site sets no cookies of its own. The human check on the form may set a brief token to do its job; it doesn't follow you to other sites. If you switch the site to dark, your browser remembers that one choice on your device. If you arrived by one of my tagged links, your browser also keeps that tag while the tab is open, so a reservation you make on a later page still tells me which link brought you. If you arrived by a friend's invite link, it keeps that link's code the same way, under the name ark-ref, so I still know who invited you. These stay on your device, and the tag and the invite code go when the tab closes. This site never saves a private invite code in your browser.

Changes

If I change this page, I'll update the date at the top. For anything that matters, I'll email the list first.

Contact

Arkhelion is built by one person, Brock, in Southern California: brock@arkhelion.ai.