Privacy and Policy

The short version

• Local first; iCloud is your choice. Your library is stored on your device. If you have Pro
  and turn on iCloud Sync, arsip mirrors it to your own private CloudKit database so it is
  available on your devices.

• No arsip account or server. We do not operate a document server, and records in your private
  CloudKit database are not visible to us.

• No tracking. arsip has no analytics, advertising, third-party trackers or profiling.

• On-device processing. OCR, document analysis and photo-background processing happen on your device.

• Feedback is optional. Feedback is sent only when you choose Send, and the form shows what
  you are submitting.

Data processed by arsip:

1. Your document library

Documents, scans, file contents, versions, metadata, tags, notes, people, templates and processes
are stored in arsip's sandbox on your device.

For Pro users with iCloud Sync enabled, this library is also mirrored through Apple's CloudKit to
the private database associated with the signed-in iCloud account. This enables sync and recovery
across your devices. Private CloudKit data counts toward your iCloud storage and is handled by
Apple under its privacy and iCloud terms. arsip does not use a public CloudKit database for your
library.

If iCloud Sync is off, unavailable, or you are using the Free tier, the library remains local to
that device.

2. Membership-card design

If you create a Pro membership-card design, arsip stores it locally and mirrors its appearance
data through Apple's iCloud key-value store so it can follow you across your devices. This can
include the displayed name, colours, pattern and any drawn mark you add. It is not shared with
other arsip users.

3. Optional feedback

If you choose Send feedback, arsip sends:

• the category and message you write;

• the name shown in the form, if provided;

• the arsip version and build number; and

• the operating-system version and, on iPhone or iPad, the device model.

If screenshot attachments are offered, they are sent only when you explicitly add them. arsip
never automatically attaches documents from your library.

Feedback is delivered through Formspree, our form processor, to the developer. If the service
is unavailable, arsip can open a pre-filled email instead; sending that email may reveal your
email address to the developer. Feedback is used only to respond to you, fix bugs and improve the
app. See Formspree's privacy policy.

We do not collect your contacts, location or document library through the feedback feature unless
you deliberately include that information in your message or attachment.

Apple services

arsip uses Apple services when you choose or enable the related feature:

• iCloud / CloudKit — private library sync and backup;

• iCloud key-value storage — membership-card appearance across your devices;

• App Store / StoreKit — purchases, restoration and optional tips; and

• Calendar, Reminders, Touch ID or Face ID — device features handled through Apple's system
  frameworks and permissions.

Apple processes information required to provide these services under Apple's privacy policy. We do not receive your payment-card details.

Storage and security

Local data is stored inside the app's sandbox and protected by the operating system's standard
file protections. Synced library data is stored in your private CloudKit database and protected by
your iCloud account.

App Lock restricts access to the arsip window using biometrics or a PIN. It does not encrypt
the underlying local files. Password-protected PDF export encrypts only the exported PDF you
create.

arsip has no custom document server. The app's network access is used for the Apple services above
and for feedback you choose to send.

Retention and deletion

• Local library data remains on a device until you delete it in arsip or remove its local app
  data. Merely deleting the macOS application may leave its sandbox data on the Mac.

• When iCloud Sync is active, permanent deletions made in arsip are mirrored to the private
  CloudKit database.

• Turning off iCloud Sync or deleting the app does not by itself guarantee deletion of the
  existing iCloud copy. That copy can restore when you reinstall arsip and enable sync again.

• Membership-card appearance data remains in local/iCloud app storage until it is replaced or the
  corresponding app data is removed.

• Feedback is retained by the developer and Formspree only as needed to review and act on it,
  subject to Formspree's policy. You can request deletion of feedback by contacting us.

Your choices

You can:

• use arsip locally without enabling iCloud Sync;

• turn iCloud Sync on or off in Settings;

• view, edit, export and permanently delete library items in the app;

• choose whether to send feedback and what to include; and

• request access to or deletion of feedback you have submitted by contacting us.

Because private CloudKit data belongs to your iCloud account and is not visible to us, requests
about the iCloud copy may also need to be managed through your Apple account and iCloud settings.

Children

arsip is not directed to children under 13 and does not knowingly collect personal information
from them.

Changes to this policy

If this policy changes, the updated version will be posted here with a new effective date.

Contact

Questions or requests about your privacy?
Arsip Help Center — contact@arsip.app