Privacy data map

The current production data flows behind /privacy. Update this page when a provider or data path changes.

arbe is operated by Oskar Roug Mosumgaard (Invisible Touch). The public notice lives at docs/privacy-and-security/privacy.md (served at /docs/privacy-and-security/privacy/, with /privacy redirecting there); this page is the internal map used to keep it accurate.

Controller contact is deliberately email-only (oskar+arbe@rough.dk); no postal address is published, which is a standing decision rather than an oversight. Worth revisiting if arbe takes payment, leaves alpha, or picks up users outside the current circle.

Data flows

Data	Source	Where it goes	Purpose	Owner
Account identity, email, OAuth profile, auth timestamps	The person and their sign-in provider	Supabase Auth; GitHub when GitHub sign-in is selected	Sign-in and account recovery	`apps/www/src/routes/login/`, `apps/www/src/routes/auth/`, `docs/system/access/auth.md`
Profiles, houses, memberships, agents, threads, workflows, environments, usage ledger	People, agents, and application mutations	Supabase Postgres; Electric SQL for live browser sync	Durable product state and multiplayer sync	`packages/supabase/migrations/`, `apps/www/src/routes/api/shapes/`, `docs/system/data/storage.md`
Messages, tool events, lifecycle signals, run history	People, agents, and the dispatcher	Electric SQL Durable Streams	Shared conversation and durable run history	`packages/core/entries.ts`, `packages/core/schemas/stream-entries/`, `docs/system/chat/durable-streams.md`
Quick-feedback note, optional sentiment, submitting agent, current page, browser identification	Signed-in people	Private Supabase `feedback` row	Product feedback and triage	`apps/www/src/routes/api/feedback/`, `packages/supabase/migrations/20260825090000_feedback.sql`
House files and locally decoded readings	House members and agents	Supabase Storage and Postgres	File storage, local UTF-8/PDF decoding, search, citations, and irreversible per-path deletion	`packages/core/volume.ts`, `packages/core/volume-extractor.ts`, `docs/system/data/volumes.md`
Visual and scanned file bytes	House members and agents	External vision model	Produce searchable readings for images and scanned PDFs	`packages/core/volume-extractor.ts`, `docs/system/data/volumes.md`
Prompts, replies, selected thread context, tool inputs and results	People, agents, threads, and tools	OpenRouter and the selected model provider, or a directly selected provider	Generate model decisions and replies	`packages/core/dispatch/reply.ts`, `packages/core/pi/`, `docs/system/access/llm-keys.md`
Repositories, workspace files, commands, results, and bound runtime secrets	House members and agents acting on their instructions	Daytona	Run tools and coding work on remote computers	`packages/sandbox/src/daytona/`, `docs/system/sandboxes/runtime.md`
API-token metadata, secret names, encrypted secret values	House members and CLI sessions	Supabase Postgres and Vault; resolved values enter the selected runtime when needed	Authenticate API clients and supply tools with credentials	`apps/www/src/routes/api/secrets/`, `packages/core/dispatch/turn-secrets.ts`, `docs/system/access/secrets.md`
Request IDs, errors, runtime logs	Application and infrastructure	Cloudflare	Security, failure diagnosis, and service operation	`apps/www/src/hooks.server.ts`, `apps/www/wrangler.jsonc`, `docs/system/ops/observability.md`
App IDs, run IDs, model/tool usage, token counts, cost, latency, failure status	Dispatcher and paid capability seams	Supabase `usage_events`; PostHog EU	Usage limits, cost attribution, and operational reliability	`packages/core/usage.ts`, `packages/core/usage-posthog.ts`, `docs/system/ops/analytics.md`
Thread/agent/trace IDs, dispatch outcome, duration, HTTP status	Dispatcher run terminals, always-on (not opt-in)	PostHog EU	Operational reliability of agent runs	`packages/core/dispatch/signals.ts`, `docs/system/ops/analytics.md`
Optional lifecycle analytics, app IDs, hashed browser identity, and browser error groups	Application after per-agent opt-in	PostHog EU	Understand product use and diagnose browser failures	`apps/www/src/lib/analytics.ts`, `apps/www/src/hooks.client.ts`, `apps/www/src/lib/server/track.ts`, `docs/system/ops/analytics.md`
House id and creation time, always-on	Every house creation through the API	PostHog EU	Monitor the platform’s total house creation rate	`apps/www/src/routes/api/houses/+server.ts`, `apps/www/src/lib/server/track.ts`
Error codes or kinds, hashed error-message groups, route/runtime, status, release, request/worker IDs	Web server and backstage, always-on	PostHog EU	Detect, group, and act on service failures	`apps/www/src/hooks.server.ts`, `apps/backstage/src/server-error-monitoring.ts`, `docs/system/ops/analytics.md`
Session cookies; PostHog browser identifier after opt-in	The browser	Set by arbe; PostHog EU for the analytics identifier	Keep a session signed in; attribute opted-in analytics	`apps/www/src/hooks.server.ts`, `apps/www/src/lib/analytics.ts`, `docs/system/access/auth.md`

File deletion boundary

The product contract is immediate product-level erasure: once a file deletion commits, its current bytes, earlier versions, extracted readings, search data, history, and restore path are unavailable through every arbe surface. Reusing the path starts new history. Content-free file-change records may retain the path, author, and time.

Identical bytes can be shared by content hash. Stored bytes are physically removed once no undeleted path or version refers to them; deleting one file never destroys another file’s content. Provider backups and bounded asynchronous cleanup may expire later, but must not make deleted content product-readable. Volumes owns the canonical behavior and operational proof.

Providers

Provider	Role in arbe	Data boundary
Cloudflare	Hosts the web app and API; provides network security and application logs	Requests, IP/network metadata, request IDs, and logged failures
Supabase	Authentication, Postgres, file storage, and Vault	Account identity, structural product data, files, usage ledger, encrypted secrets
Electric SQL	Browser sync and durable thread streams	Synced house records and full thread/run history
GitHub	Optional OAuth sign-in	OAuth identity and profile fields returned during sign-in
OpenRouter and selected model providers	Model inference	Prompts, selected context, replies, and tool-related content needed for a turn
Daytona	Default remote sandbox runtime	Workspace content, commands, results, and credentials injected for requested work
Google Gemini	Visual extraction	Visual and scanned bytes for extraction only. Original text and text-bearing PDF bytes stay local, and file search is lexical inside Postgres
PostHog EU	Optional product telemetry plus always-on operational and usage events	No email, names, prompts, messages, file content, or session data; app IDs remain linkable inside arbe

Other house members and agents are recipients of data shared inside their house. They are part of the product’s collaboration boundary, not infrastructure providers.

Processors today are as mapped above. If or when EU residency is required, decide the bar first: data at rest in the EU (US-parent processors still allowed), or no US company in the processor chain. The first is mostly region moves; the second is self-host / EU-sovereign replacements. Pick the bar before migrating — they are different amounts of work.

Update rule

Before adding a provider or sending a new data category to an existing provider:

Update this map and the public /privacy notice.
Decide whether the data is optional or required, and keep optional analytics behind explicit opt-in.
Check export and account/house deletion behavior at the canonical storage boundary.
Keep content and direct identity out of PostHog.

Provider retention schedules, regions, contractual safeguards, and deletion propagation are deployment/legal records rather than code-owned facts. They are not verified in this map.