Trust

Your projects, memories and daily log are kept in a managed PostgreSQL database run by Neon, on Amazon Web Services in the United States (US East). The application runs on Vercel, also on servers in the United States. If you are outside the US, your data is transferred there.

In transit: the panel, the public pages and the address your AI connects to are served only over HTTPS, and the connection between the application and the database is encrypted as well.

At rest: the database provider encrypts stored data with AES-256, with keys managed in AWS Key Management Service.

The private address of each AI connection, every invitation and every OAuth credential are stored only as SHA-256 digests. A digest recognises the right address and cannot rebuild it — not for an intruder, and not for us.

Arroway has no passwords. You sign in with Google or with a link sent to your e-mail.

There is no SAML single sign-on, and no sign-on managed by your company, today. If your company needs it, write to hello@arroway.app.

An AI can reach only the projects its person belongs to, and that access always comes from the person's identity — never from anything the AI tells us.

• Neon — the managed database that stores everything above.
• Vercel — hosts the application, and counts page views without cookies.
• Google — sign-in, when you choose to sign in with Google (your name, e-mail and picture); and Google Analytics, on the public pages only, never in the panel.
• Resend — delivers e-mail: the sign-in link, the welcome message, the confirmation when you add another address, invitations to a project, the notice when work in flight is addressed to you, the notice when a project manager leaves a decision waiting for you, the manager's daily summary when you have not opened Arroway since it was written, reminders to finish setting up, the summaries of your projects, and the weekly news about what changed in Arroway. It also carries the notice we receive when an account is created or a sign-up fails.
• Sentry — error monitoring for the server, set up not to send personal data and to mask connection addresses.
• Anthropic — runs the model behind the cockpit's setup suggestion. When you ask for one, it receives the task you typed, the project's name and scope, and which AI tools you used recently.
• Stripe — processes payments when a team subscribes: the name, e-mail and payment details of the person who pays, and how many people the plan bills. Card details go to Stripe directly, never through Arroway.

None of them receives your content for their own use. We do not sell or share what you write, and we do not use it to train any AI model. Your AI — Claude, ChatGPT or another — receives what it reads from Arroway, because it is the one reading; what that vendor does with it is governed by its own policy.

What you write stays as long as your account exists. Archiving a memory or closing a project hides it from AI reads and keeps the history, because knowing that something was decided and later reversed is part of the record.

Daily-log entries older than 14 days stop being sent to AIs, and stay visible in the panel.

The record of what each read delivered to an AI, and the measurements of first use, are deleted automatically after 90 days.

You can delete your account yourself, from the menu under your photo. The screen shows what goes and what stays before you confirm. What goes: your access, your AI connections, your e-mail and picture, and your personal project. What stays is what you wrote in a team project, under your name — it is that team's record.

Revoking an AI connection under Connections ends its access immediately.

For a copy of your data, or anything this page does not answer, write to hello@arroway.app.