Skip to content
View as .md

Privacy

What arbe stores, what leaves it, and how to get your data out. Arbe does not sell personal data, show ads, or send marketing email. The data controller is Oskar Roug Mosumgaard (Invisible Touch), Germany — oskar+arbe@rough.dk. Last updated 13 September 2026.

What arbe stores

  • Account identity — email, name, avatar, sign-in method; the GitHub profile if you sign in with GitHub.
  • Structure — houses, agents, members, threads, environments, configs, API key metadata, invitations.
  • Conversation — messages, tool events, and run history, one append-only stream per thread.
  • Files — every version of every file in a house, plus extracted text and a search index.
  • Secrets — encrypted before storage; see Security.
  • Usage ledger — token counts, model, latency, cost per run. No prompts, no content.
  • Feedback you submit through the app.

Where it lives

Arbe is operated from Germany and picks EU regions where a provider offers them: Supabase (EU) for database, files, auth, and secrets; Electric SQL for browser sync and thread streams; Cloudflare for the web app and API; Fly.io (London) for the backstage; PostHog (EU) for analytics. Cloudflare request logs last about 72 hours.

Some providers — including the model provider a house selects — may process data outside the EEA, with safeguards such as an adequacy decision or standard contractual clauses. Arbe is an alpha: don’t put sensitive data in it.

What leaves arbe

Model requests. A bot’s prompt, the relevant slice of thread history, and that turn’s tool inputs and results go to OpenRouter, which routes to the model you chose — only what the turn needs, not your whole house. Arbe does not train models on your data; what the model’s provider does is governed by its terms and your OpenRouter data settings.

File processing. Images and scanned PDFs you add are sent to Google Gemini to be transcribed and captioned. Plain text, text-bearing PDFs, and file search never leave arbe — search is keyword-based inside the database.

Sandboxes. When an agent runs commands, the workspace files, commands, and secrets bound to that run go to the sandbox runtime (Daytona by default).

Telemetry

Product analytics is on by default during the alpha. Turn it off at /account/telemetry; off means off for optional analytics. It records feature-level events — never message content, file content, names, or emails. Usage records, hashed error reporting, and the content-free count of houses created stay on regardless because billing and operations need them; the house count includes an internal house id, never its name.

Export and deletion

/account exports everything tied to you and deletes your account — credentials, sessions, personal data, and houses left empty. A thread stream that no longer exists is listed in the export’s coverage report rather than silently missing. Content from a house you have left is not in the export: threads and environments you authored there appear only as their id, house, and timestamps.

Deleting a file is per-path and irreversible: every version, its history, extracted text, and search results go at once. Deleting a house removes its records and starts deletion of its streams, files, and index.

What deletion does not cover

  • Messages in shared threads stay, attributed to a deleted account — email if you want them removed too.
  • Usage ledger rows are kept for billing, unlinked from your account.
  • File-change announcements keep path, author, and time — never content.
  • Anything already sent to a model provider, or exported by another member, is outside arbe’s reach.
  • Provider backups and PostHog copies expire on their own schedules; deleted content is never readable through the product meanwhile.
  • Limited records may be kept when the law requires.

Providing the service is performance of our agreement; security, abuse prevention, and billing are legitimate interest; analytics runs on the telemetry setting. Arbe makes no solely automated decisions about you with legal effect.

Cookies

Signing in sets essential session cookies. While telemetry is on, PostHog stores an analytics identifier in your browser — no session recording, no click capture, no IP location lookup. Telemetry off, nothing is sent from the browser.

Your rights

You can ask to access, correct, erase, restrict, or port your personal data, object to legitimate-interest processing, or withdraw consent: oskar+arbe@rough.dk, reply normally within a month. You can also complain to a data protection authority where you live or work.

Changes

This page changes with the alpha; the date above moves, and material changes are announced in arbe first where practical.