Privacy Policy
1. Who we are
Ark ("we", "us") operates arkprivate.com, the Ark browser extension, and related services (together, the "Service"). Ark is the data controller for the account data described below. Contact: privacy@arkprivate.com.
2. What we collect — and what we physically cannot
Data we store on our servers (the scorecard)
| Data | Example | Why we need it |
|---|---|---|
| Email address & name | you@example.com | Login, billing, daily brief |
| Password hash | bcrypt hash (never the password) | Authentication |
| Privacy score & event counts | "12 threats blocked today" | Dashboard, daily brief |
| Share-link URLs you create | chatgpt.com/share/abc… | Checking whether search engines indexed them |
| Extension audit flags | "Extension X has risky permissions" | Your audit report |
| Subscription status | Pro active until Sep 30 | Keeping paid features on |
| Referral & promo data | Your referral code, invite status | Running the referral program |
Data that never leaves your device
- Anything you type into ChatGPT, Claude, Gemini, Perplexity, Grok, DeepSeek, Kimi, Copilot, Mistral, Poe, Qwen, You.com, or any protected platform
- The actual sensitive data Ark catches (we know that it blocked something, never what)
- AI responses, your files, your documents, your browsing outside AI chat sites
3. How the extension works (technical transparency)
Auto-redaction, PII detection, and share-link detection run entirely inside your browser. The extension periodically syncs only counts, scores, link URLs, and audit flags to the API. You can verify this yourself: open your AI chat, press F12 → Network tab, and watch — no conversation content is ever sent to arkprivate.com.
4. Legal bases (GDPR / Singapore PDPA)
- Contract — providing the Service you signed up for (account, monitoring, briefs)
- Legitimate interest — security, fraud prevention, improving detection accuracy (using anonymized counts only)
- Consent — marketing emails, which you can withdraw anytime
5. Who processes data for us (subprocessors)
| Provider | Role | Data touched |
|---|---|---|
| Vercel | Hosting (site, API, dashboard) | Account data, request logs |
| Cloudflare | DNS & security | Connection metadata |
| Airwallex | Payments | Billing email, payment details (we never see card numbers) |
| Google Custom Search / SerpAPI | Indexing checks | Share-link URLs only |
No subprocessors ever receive conversation content — we don't have it to give. Enterprise customers can also sign our Data Processing Agreement (GDPR Art. 28 / PDPA).
6. Retention & deletion
- Account data: kept while your account is active
- Activity/event counts: rolling 90 days
- Deletion: one click in the dashboard purges your data within 72 hours, including backups
7. Your rights (all self-service)
- Export: Dashboard → one-click JSON export of everything we hold
- Delete: Dashboard → one-click purge
- Correct / object / withdraw consent: email privacy@arkprivate.com — answered within 30 days
8. Cookies & analytics
We use a single localStorage entry to remember your referral code and sign-in token. We use privacy-friendly, cookie-less analytics (Cloudflare Web Analytics) that does not track you across sites. No advertising cookies, no data brokers, no sale of personal data — ever.
9. Security
HTTPS everywhere, bcrypt password hashing, signed webhooks, scoped API tokens, and an architecture where your most sensitive data never reaches us. Report vulnerabilities to security@arkprivate.com.
10. Children
The Service is not directed at children under 16, and we do not knowingly collect their data.
11. Changes
We will post changes on this page and email account holders before material changes take effect.