# Arcaeon Privacy Policy

Not legal advice. Every claim below was checked against the code that actually runs the site
and the hosted Witness — not assumed, not copied from a template. Where we don't know
something, this document says so instead of guessing.

Effective date: 19 August 2026 · Covers: `arcaeon.io` (marketing site),
`witness.arcaeon.io` (the hosted Witness API), and the free `pip install arcaeon-*`
libraries.

## 1. The short version

- **The free PyPI libraries** (`arcaeon-ledger`, `arcaeon-audit`, `arcaeon-dedup`,
  `arcaeon-compact`, `arcaeon-meter`, `arcaeon-baseline`, `arcaeon-distill`,
  `arcaeon-continuity`, `arcaeon-once`) send us nothing. They run entirely on your own machine,
  read and write only the files you point them at, and make no network calls to any
  Arcaeon-operated server — confirmed by reading the package source: stdlib-only per each
  package's own `pyproject.toml` (`dependencies = []`), no `requests`, `urllib`, or `httpx`
  import anywhere in the libraries checked.
- **`arcaeon.io` sets no cookies and runs no analytics or tracking scripts.** Confirmed by
  grepping every page on the site for `analytics`, `gtag`, `cookie`, and the usual tracker
  names — zero matches, no third-party `<script>` tags at all.
- **The hosted Witness stores fingerprints, never content.** Table below.
- **Stripe handles payment.** We don't receive or store your card number.

## 2. What the hosted Witness stores

| Data | Where stored | Public or private | Purpose |
|---|---|---|---|
| `namespace` (a string you choose) | Public GitHub repo `dan8433-user/arcaeon-witness-pins`, as a JSON file path | **Public** | Identifies whose pin this is — you choose it, we don't assign it. Don't put PII in it; see §4. |
| `rows`, `chain` (a hash), `pinned_at`, `seq`, `cadence_hours`, `next_pin_due_by` | Same public repo, same file | **Public** | The witness mechanism itself — this is the product. |
| API key, hashed (full sha256, never the raw key) | Private GitHub repo `dan8433-user/arcaeon-witness-usage` | **Private** | Usage metering, billing enforcement, idempotent credit tracking. |
| Usage counts / balance per key | Same private repo | **Private** | Enforces your plan cap (100/mo free, 2,000/mo paid). |
| Payment/checkout data (name, card, email) | **Stripe**, not our own infrastructure | Held by Stripe as payment processor | Billing. Our own webhook code reads a hash of your key and the pack you bought — not your email or name. Stripe's own dashboard does show us your checkout email by default, since Stripe Checkout always collects one; we can see it there even though our code never touches it. |

**Never stored, anywhere**: the content of your ledger, log rows, or anything a pin references.
Only the hash and the row count.

## 3. Where this data goes

- **GitHub** — hosts the public pin repo (that's the product: a stranger reading GitHub's
  commit history without trusting our API is the point) and a private usage/balance repo.
- **Stripe** — processes the $9/mo checkout and the Apify actor payments' underlying rails
  where applicable. Governed by Stripe's own privacy policy for anything it collects directly;
  we don't see or store card numbers.
- **Vercel** — hosts the site and the Witness's serverless API functions. Standard
  hosting-provider access-log exposure (IP addresses, request timestamps) likely applies under
  Vercel's own infrastructure logging — we haven't independently audited Vercel's retention
  defaults for this project, and this document doesn't pretend otherwise.
- **OpenTimestamps** — a free, third-party Bitcoin-anchoring service, called once daily to
  timestamp the pin repo's HEAD commit hash. Receives a commit hash. Nothing else.
- **Apify** — operates the two paid actors (Verified Snapshot, Public-Safety Hiring Alerts) as
  its own marketplace platform; Apify's privacy policy governs data flowing through actor runs.
  We haven't line-by-line audited the actors' own code for this document — if they process
  user-submitted URLs or search terms, that deserves its own line here, added once that read
  happens.

## 4. What not to put in a namespace

Namespace names and pin fingerprints are committed to a **public** GitHub repository by
design — that's the entire trust mechanism (see [/witness-practices](/witness-practices)). So:
**don't use your name, email address, or anything identifying as a namespace.** This is the one
place your own choice, not our architecture, decides whether something private becomes public.

## 5. Data retention and deletion

**[PENDING-DANIEL — wording below is draft, needs sign-off before this ships.]**

The pin mechanism is architecturally append-only and public. A pin, once committed, can't be
quietly deleted without visibly rewriting a public git history — which the anchoring described
in [/witness-practices](/witness-practices) §6 exists specifically to make detectable. That has
a real consequence for any deletion request: we can't delete a namespace's public pin history
without either (a) breaking the tamper-evidence promise you're paying for, or (b) doing it
visibly, which defeats the same promise. Better you know this before choosing a namespace than
discover it after asking us to delete one. Draft language:

> Public pin records (namespace, rows, chain, timestamp) are, by the nature of the service,
> committed to a public, append-only ledger and are not designed to be deleted. If you need a
> right to erasure for regulatory reasons, don't use the Witness for data that requires one, or
> use a namespace that doesn't reference anything identifiable (see §4).

**Private data** (API keys, usage/balance records): email hello@arcaeon.io to request deletion.
There's no self-serve deletion path yet.

## 6. Children's privacy

The Witness is developer/agent infrastructure. It's not directed at children under 13, and we
don't knowingly collect anything from them.

## 7. Changes to this policy

Tracked the same way as the Terms — see [/terms](/terms) §7. No separate announcement
mechanism exists beyond the public `CHANGELOG.md` files.

## 8. Contact

hello@arcaeon.io — checked daily, per [/witness-practices](/witness-practices) §8. This is the
one privacy-contact claim in this document already backed by a real process, not a promise.