Your data, and how it's cared for.

Updated on 18 Sep 2026

1. What this app holds

Your arc keeps what you put into it: your first name and email, your date of birth (the start of your line), your Areas, your moments with when they happened and how they felt, your intentions and any vision image you attach, your quests (the belief you're testing and the action you chose), how each quest step felt in your own words, your reflections, and the evidence you write down.

It also keeps the numbers the game makes from those things: experience points, levels, badges, and counts of what you've shared. Plus the ordinary technical records any app keeps, like when you signed in and from what kind of device, which is how we keep accounts secure.

This is deeply personal material, and every rule below exists to treat it that way.

2. Before you save, it's on your device only

You build your first arc before any account exists. Everything you enter in that setup lives only in your own browser. Nothing reaches our servers until you save your arc and create an account. If you never sign up, nothing was ever sent, and clearing your browser storage erases the draft for good.

3. Why we're allowed to hold it

Different parts of your data are held for different reasons, and the law asks us to say which is which.

To run your arc. Your account, your moments, your quests, your reflections. We hold these because you asked us to, and without them there's no product. This is us performing the agreement you made with us.

Because writing about your inner life is sensitive. Your reflections, your emotions and your evidence say something about your mental and emotional state. Data like that gets stronger protection under privacy law than an email address does, and holding it needs your clear, separate permission rather than a general agreement to terms. You give that when you create your account, for one purpose: running your arc. It isn't a preference you can switch off while carrying on, because the product can't run without it, so withdrawing it means closing your account. We'd rather say that plainly than bury it. Anything beyond running your arc is a separate choice, and those are in sections 9 and 10.

Because you gave permission for something optional. How things felt, and usage analytics. Each is a separate choice, each is off until you turn it on, and you can change either whenever you like.

Because it is a fair and expected use, and you can stop it. Activity patterns: counts and timings with no feelings in them, which tell every member how the app is generally used. This one starts on, because there is nothing in it that points to a person and nothing about how anyone felt. One switch in Settings turns it off, and turning it off takes effect immediately.

To tell you about the thing you signed up for. Updates, the occasional email about Character Arc. You can refuse them when you create your account and stop them at any time afterwards. Section 16 sets out how email works.

To keep the service safe and working. Security logs, fraud prevention, keeping backups, and seeing which parts of the app get used. This is our legitimate interest, we keep it to what's necessary, and you can object by writing to us.

Because a law says so. Payment records, mostly, which tax rules require us to keep.

4. Who can see it

Every member is walled off from every other member. Nobody using the app can reach your moments, your reflections, or your profile. That separation is enforced at the database itself rather than only in the app.

The people who run this app can see some of what's in your account, and it's fairer to list it than to summarise it.

What we can see:

Your name, email, and date of birth
The Areas you chose, including any you named yourself
Your quests: the belief you're testing, the action you chose, and the mindset shift that came out of it
Which models you've started, how far through you are, and which you've finished
How many of each thing you have: moments by type, reflections, emotions logged, sealed letters created, mindset shifts, and quests active, finished or not yet started
Your experience, levels and badges
How you use the app: when you sign in, how long a session lasts, and which sections you spend time in
Whether an email or push notification was sent, delivered, opened or clicked

What we can't see:

Your reflections. Not the writing, and not the titles either
The words in a sealed letter. We can see that one exists, when it was made, when it is set to open and whether it has been, but never a single word of what it says
Your moment titles, your evidence notes, and your own writing anywhere else in the app

Your personal writing is yours. What's on the first list is either something you told us directly, like your name, or a count of something you did. We use it to run your account, to see whether the app is working, and to fix it when it isn't.

Two exceptions are worth naming rather than leaving implied. If you write to support and paste something in, we read what you sent us. And if a valid legal order compels us, we comply, and we'll tell you unless the order forbids it.

5. What we record about how you use the app

Alongside what you create, the app keeps a record of how it gets used. When you sign in, how long you stay, which sections you open and how long you spend there, and what you tapped to get around. For email and push notifications, whether one was sent, delivered, opened or clicked.

This is about actions rather than content. It tells us that a reflection was written, never what it said. We use it to see which parts of the app are working, to notice when something's broken, and to decide what to build next.

6. Your feelings are yours to report

The app never guesses how you feel. Every felt score and every emotion here is one you chose and typed or tapped yourself. Nothing reads your words to infer your mood. That's a promise built into the product rather than a setting you have to find.

6a. The one thing that does read what you write

One check reads what you type, and only on your own device. If you write something suggesting you might be in danger, the app recognises a few specific phrases and shows you a page with people who can help.

That check happens in your browser. Nothing is sent to us, nobody is told, and no record is kept. It exists so the app doesn't answer a hard moment with a reflection prompt.

6b. Speaking instead of typing

If you dictate rather than type, the recording has to be turned into words by a speech service, and that means your actual voice, saying your actual words, leaves your device.

This is the one place where what you write reaches a third party as itself rather than as arithmetic. We'd rather say that plainly than let you find out later.

What happens to it. The audio goes straight to ElevenLabs, which turns speech into text, comes back as words, and is gone. We don't keep the recording, we don't log it, and nothing is stored on our side. ElevenLabs is contractually forbidden from keeping it or training on it.

One more step, and it's worth naming. The raw transcript is passed once through the same AI service that writes Mirror, purely to add punctuation and drop filler sounds like "um". That pass is only allowed to tidy: it may not add a word, remove a real word, rephrase, summarise, or answer anything you said. Your words are the point of this product, and a model that improves them has broken it. If you'd rather skip that step entirely, turn voice off and type.

What we can't promise. Once audio has left your device, it's in someone else's hands for the seconds it takes to transcribe. We've chosen a service that commits to holding nothing, but that's a contract rather than a technical impossibility, and it's a different kind of protection from the one that covers your typing.

You never have to use it. Typing does the same job, and nothing leaves your device on the way. The choice is yours every single time, and speaking is never the default.

6c. Areas you name yourself

If you create an Area with your own name for it rather than picking one we offer, that name alone is sent once to the AI service in section 17, so the app can work out which part of life it belongs to and show you relevant material.

Only the name goes. Nothing you wrote inside that Area, and nothing that identifies you. The answer is remembered for everyone, so the same name is never sent twice by anyone.

If you'd rather that didn't happen, choose one of the Areas we offer instead and nothing is sent at all.

7. Sealed letters

The words in a sealed letter are locked on your device before they are stored, with a key we never hold. We can't read one. Not the words, not a fragment, not ever, and no change of policy on our side could make it possible.

What the record does hold is worth saying plainly rather than leaving you to assume: that a letter exists, when you made it, when you have set it to open, and whether it has been opened. The app needs those to hand you the letter at the moment you asked for it, and we can see how many you have. That is the whole of it. The words stay yours.

8. Reflection prompts drawn from your own record

Some reflection prompts are built from your own writing, so a question might name a word you use often or an Area you've been living in. That matching happens on your device, using your record only. The words behind those prompts are never sent to us and never leave your device.

9. Patterns across members

Your arc is yours. Nothing here involves your words, your name, or anything that could point back to you, and there are two separate things going on, so it's worth separating them.

What we look at to run the app. Plain counts that don't involve how anyone felt, like how many members pick a given area, how often quests get finished, and how far people get through a model. We use these to see whether the app works and to decide what to build next. They can't identify anyone, and they include none of your writing.

What we look at only if you said yes to measurement. How feelings are reported across the app, using the emotion words and intensities from the fixed set the app offers. That's part of the analytics choice in section 10, and if you declined it, none of your emotional data reaches our measurement at all.

The pooled picture other members can see, which is two switches in Settings. This part is about other members seeing the pool, not us, and it is split in two because the two halves are not the same kind of thing.

Activity patterns is counts and timings: how long quests tend to run, how many reps they take, which models get opened. There are no feelings in it and nothing in it points to a person. It starts on, and one switch turns it off.

How things felt is the emotion word and number you picked, from the fixed set the app offers: how a quest tends to feel at the first rep against the last. That's information about your state of mind, which the law protects more closely and which we won't use for this without being told yes. It's off until you turn it on, every time, and we won't put it in the terms and call that an answer.

Both halves are grouped and stripped of anything pointing back to you before anyone sees them, and a group smaller than five people is never shown at all. Turning either off later changes nothing you've already written.

10. How we measure the app, and what we never read

We use Google Analytics to understand how the app is actually used, so that what gets built next is based on something real. This is new since 6 August 2026. It replaces an earlier promise that there were no analytics in the app at all, and we'd rather say that plainly than change it quietly.

It's off until you say yes. You're asked once, the answer is remembered, and declining is a real choice that costs you nothing in the app. Nothing is measured and no analytics cookie is set while that question sits unanswered.

What's counted is behaviour, in categories: that a moment was logged and whether it was a milestone, a setback, an everyday moment or an intention; that a reflection was written; that a quest was created, embarked on, stepped or finished; which models were finished and how far through them people got; which focus areas people pick; and the emotion words and intensities being reported, out of the fixed set the app offers.

What's never counted, never read and never sent: the words in your reflections, and anything whatsoever about your sealed letters. Also never sent: the titles of your moments, the belief or action in your quests, your evidence notes, and any focus area you named yourself, which is reported only as "custom" so the word you chose stays yours. Nothing that identifies a single record ever leaves your device.

11. Sharing is always your choice

There's no feed, no comments, no followers. Everything is private unless you choose to share a specific thing, and you always see a preview first. Shared cards never include your photos or your felt scores, and you can remove any title before it goes out.

A share link carries a code that identifies you as the sharer so the app can thank you if a friend starts an arc. It never identifies the person who opens the link, and you're never shown who joined, only a count.

When you publish a share page, it's public. Anyone with the link can read it, search engines may index it, and other people may copy or screenshot it. Pages expire on their own after 30 days unless you chose otherwise, and you can remove one at any moment. We can't reach copies other people already made, so take a moment before you publish anything you'd mind a stranger reading.

12. Crossroads

Crossroads holds a decision you're weighing. You write the decision and every option, and everything you enter stays private to you unless you choose otherwise. The app doesn't generate options, rank them, score them, or recommend one, so nothing you see there is a suggestion from us.

13. Mirror

Section held until Mirror ships.

Mirror reads your record and writes you a reading of it. Because an AI helps write it, we want to be exact about what that AI is given, since it's less than people assume.

Your reflections are not sent. Nor are your moment titles, your evidence, your notes, or anything from a sealed letter. The writing you do here stays here.

What is sent is arithmetic. Counts, dates, the emotion words you chose yourself from the fixed set the app offers, and how far you got through things. Facts your record already contains, not the words you wrote around them.

And anything identifying is hidden even from that. Before the request leaves, sensitive values are swapped for placeholders like «m1». The AI is told to keep every placeholder exactly as written and never to guess what one hides. The real values are put back afterwards, on our side. So the model writes about a shape it can't see the contents of.

Your name never goes with it, and nothing sent can be traced back to you.

The AI service is named in section 17. It's contractually forbidden from keeping what it receives, using it for its own purposes, or training any model on it.

Mirror is off until you turn it on, and you can turn it off in Settings at any time. What it shows you isn't advice, isn't a diagnosis, and can be wrong. Read it as one observation to weigh against what you already know about yourself.

14. Paid links never use your data

Some quotes and concepts carry clearly marked paid links to books, courses or tools, shown only when you press the paid links button. We may earn a commission if you buy something. They're matched to the content on the page, never to you. Nothing about your moments, reflections, feelings or Areas is used to pick them, and opening one sends nothing personal.

15. Age, and members under 18

You need to be 16 or older to hold an account. If a date of birth under 16 is entered during setup, the flow stops there, kindly, and nothing entered is kept or sent anywhere.

If you're 16 or 17, a few things work differently for you, and they're set that way by default rather than being something you have to find. Activity patterns, How things felt and usage analytics all stay off, including the one that starts on for everybody else, and the app will not let them be turned on. Share pages carry an extra confirmation before they go public.

If we learn an account belongs to someone under 16, we close it and delete what it holds.

16. Email

Account emails come with the account: confirming your address, a reminder you set yourself, notice before a payment or renewal, a receipt, notice when a policy changes. These can't be switched off while you hold an account, because they're how we keep you informed about something you're relying on.

Updates are occasional email about Character Arc: what's new, what we've learned, what's worth knowing. They start when you create an account. You can say no right there, and you can turn them off any time afterwards.

Account emails and Updates are sent from two different addresses, by two different services, on purpose, so a problem with one can never delay the other. Account email comes from notify.characterarc.io.

Turning Updates off takes one tap in Settings. Every Update also carries an unsubscribe link, because the law requires one and because you shouldn't have to sign in to stop email. Either route works and both do the same thing.

When you stop them, we record it in two places: our own database and the service that sends our email. Both, so that a change in one can't quietly fail to happen in the other.

Turning Updates off never affects Account emails, and never affects anything else about your account.

17. The outside services we rely on

Your account and data live with Supabase, our database provider, with security keys held on the server and never in your browser. Payments run through Stripe, and this app never sees or stores your card. Google Analytics measures use of the app, and only if you said yes. Resend sends account email and MailerLite sends Updates. Cloudflare carries the site and the app to you and filters attacks on the way in. Push reminders use your device's push service, and only if you turn a reminder on.

If you dictate instead of typing, ElevenLabs turns your speech into text (section 6b).

Mirror hasn't launched yet. When it does, Anthropic, the company behind Claude, will help write it from the arithmetic described in section 13, and will do the tidy pass on a dictated transcript. Nothing is sent to Anthropic today, because nothing calls it today.

Each of these processes your data only on our instructions.

There are no ad networks here, and nothing you do is used to sell you anything.

18. Where your data goes

We're a Singapore company, and the services above operate in Singapore, the European Union and the United States. When information moves between those places we use the safeguards the law provides, which for European data means Standard Contractual Clauses with each provider.

19. How long we keep it

While your account is open, we keep what you put in, because that's the product.

When you delete your account, we close it immediately. You lose access straight away, and nobody at Character Arc goes looking through it. There's then a short window, usually 30 days, before permanent deletion runs. That window exists for one reason: people change their minds, and an account deleted by accident should be recoverable for a little while. Tell us inside that window and we can bring it back. After it closes, we can't.

Then it's gone from our live systems. Your moments, reflections, quests, letters, profile details and everything else are removed from the working database.

Backups are the last to go. Our systems keep encrypted backups so that a failure doesn't lose everyone's work. We keep a week of daily backups, so deleted data cycles out of them within about a week, and it isn't restored into the live app in the meantime.

Anonymous pooled numbers you contributed under section 9 stay, because they can no longer be connected to you.

Financial, payment and legal compliance records are kept for 5 years, because Singapore law requires us to keep accounting records that long. Our payment provider keeps its own records for as long as financial regulations require it to, which is outside our control.

A record that you asked not to be emailed survives deletion, because the only way to keep a promise not to contact you is to remember that you asked.

A short record that you were a member survives deletion, for 3 years. It holds your email address in scrambled form (a one way code that can confirm an address when we're given it, but can't be turned back into one), the dates you joined and left, and a copy of what you agreed to and when, including the version of the words you saw. It holds nothing you wrote and nothing from your arc. We keep it so that if a question ever comes up about what you agreed to, or whether your account really was deleted, we can answer it truthfully. After 3 years it's removed automatically.

Security logs are kept for 12 months.

20. Your data stays yours

You can ask for a full copy of your data at any time by writing to [email protected], and we'll send it within a month in a format you can open and take elsewhere. There's no download button in the app; a person puts it together for you. Asking costs nothing and changes nothing about your account.

You can delete your account from Settings, and deletion is real. Your data is never sold, rented or traded, full stop.

21. Your rights

Wherever you live, you can ask us to: show you what we hold, correct anything wrong, delete your account and its contents, send you a copy of your data, stop using your data for anything optional, and answer a question about any of it. Write to [email protected] and we'll reply within a month. Exercising any of these never costs you anything and never degrades your service.

If you're in the European Union or the United Kingdom. You also have the right to restrict how we use your data, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting what was lawful before. You can complain to your national data protection authority. To reach us directly, write to [email protected] and we'll reply within a month.

If you're in Singapore. The Personal Data Protection Act gives you rights of access and correction, and we'll tell you how your data has been used in the past year if you ask. Our Data Protection Officer can be reached at [email protected].

If you're in California. You have the right to know what we collect and why, to delete it, to correct it, to limit how sensitive information is used, and not to be treated differently for asking. We don't sell your personal information and we don't share it for cross-context behavioural advertising. We do disclose limited information to the service providers named in section 17, who process it only on our instructions and can't use it for their own purposes.

Everywhere else. If your local law gives you a right not listed here, ask and we'll honour it where we can.

22. Security

We protect your data with encryption in transit and at rest, database-level separation between members, access controls limiting who can reach what, and regular review of the services we rely on. No system is perfectly secure and we won't pretend otherwise. If your data is ever exposed in a way that puts you at risk, we'll tell you and the regulators, quickly.

23. When this policy changes

If we change something that matters, like adding a new use of your data or a new service that touches it, we'll email you at least 30 days before it takes effect and ask you to agree before you carry on using the app. Smaller changes just get a new date at the top.

We keep every version we've published, along with a record of exactly what was on screen when you agreed to it. Ask us for any of it at any time and we'll send it.

24. A note on care

Your arc is a reflection tool for personal development. It isn't therapy, diagnosis, or crisis care, and it doesn't replace them. If you're ever in real distress, please reach out to someone you trust or your local support services. Find a crisis line where you are

Read the full wellbeing note

25. Who we are

Character Arc is operated by Limitless Lumens Pte. Ltd., a company registered in Singapore. That company is the data controller for everything described here.

Questions about this policy or your data: [email protected]. Our Data Protection Officer: [email protected]. We'll answer in plain language.

For the record, and because the law asks a controller to be findable rather than merely named: company registration 202344388K, registered at 68 Circular Road, #02-01, Singapore 049422.