# Privacy data map

> The current production data flows behind `/privacy`. Update this page when a provider or data path changes.

arbe is operated by Oskar Roug Mosumgaard (Invisible Touch). The public notice lives at `apps/www/src/routes/privacy/+page.svelte`; this page is the internal map used to keep it accurate.

Controller contact is deliberately email-only (`oskar+arbe@rough.dk`); no postal address is published, which is a standing decision rather than an oversight. Worth revisiting if arbe takes payment, leaves alpha, or picks up users outside the current circle.

## Data flows

| Data | Source | Where it goes | Purpose | Owner |
| --- | --- | --- | --- | --- |
| Account identity, email, OAuth profile, auth timestamps | The person and their sign-in provider | Supabase Auth; GitHub when GitHub sign-in is selected | Sign-in and account recovery | `apps/www/src/routes/login/`, `apps/www/src/routes/auth/`, `docs/system/auth.md` |
| Profiles, houses, memberships, agents, threads, workflows, environments, usage ledger | People, agents, and application mutations | Supabase Postgres; Electric SQL for live browser sync | Durable product state and multiplayer sync | `packages/supabase/migrations/`, `apps/www/src/routes/api/shapes/`, `docs/system/storage.md` |
| Messages, tool events, lifecycle signals, run history | People, agents, and the dispatcher | Electric SQL Durable Streams | Shared conversation and durable run history | `packages/core/entries.ts`, `packages/core/schemas/stream-events/`, `docs/system/durable-streams.md` |
| Uploaded files and derived search data | House members and agents | Supabase Storage; ragthis on Fly.io; the model used for visual extraction | File storage, extraction, search, and citations | `packages/core/files.ts`, `apps/www/src/lib/server/file-index.ts`, `docs/system/files.md` |
| Prompts, replies, selected thread context, tool inputs and results | People, agents, threads, and tools | OpenRouter and the selected model provider, or a directly selected provider | Generate model decisions and replies | `packages/core/dispatch/reply.ts`, `packages/core/pi/`, `docs/system/llm-keys.md` |
| Repositories, workspace files, commands, results, and bound runtime secrets | House members and agents acting on their instructions | Daytona; legacy Sprites when that runtime is selected | Run tools and coding work on remote computers | `packages/sandbox/src/daytona/`, `packages/sandbox/src/sprites/`, `docs/system/runtime.md` |
| API-token metadata, secret names, encrypted secret values | House members and CLI sessions | Supabase Postgres and Vault; resolved values enter the selected runtime when needed | Authenticate API clients and supply tools with credentials | `apps/www/src/routes/api/secrets/`, `packages/core/dispatch/turn-secrets.ts`, `docs/system/secrets.md` |
| Request IDs, errors, runtime logs | Application and infrastructure | Cloudflare | Security, failure diagnosis, and service operation | `apps/www/src/hooks.server.ts`, `apps/www/wrangler.jsonc`, `docs/system/observability.md` |
| App IDs, run IDs, model/tool usage, token counts, cost, latency, failure status | Dispatcher and paid capability seams | Supabase `usage_events`; PostHog EU | Usage limits, cost attribution, and operational reliability | `packages/core/usage.ts`, `packages/core/usage-posthog.ts`, `docs/system/analytics.md` |
| Thread/agent/trace IDs, dispatch outcome, duration, HTTP status | Dispatcher run terminals, always-on (not opt-in) | PostHog EU | Operational reliability of agent runs | `packages/core/dispatch/signals.ts`, `docs/system/analytics.md` |
| Optional lifecycle analytics and hashed browser identity | Application after per-agent opt-in | PostHog EU | Understand product use | `apps/www/src/lib/analytics.ts`, `apps/www/src/lib/server/track.ts`, `docs/system/analytics.md` |
| Session cookies; PostHog browser identifier after opt-in | The browser | Set by arbe; PostHog EU for the analytics identifier | Keep a session signed in; attribute opted-in analytics | `apps/www/src/hooks.server.ts`, `apps/www/src/lib/analytics.ts`, `docs/system/auth.md` |

## Providers

| Provider | Role in arbe | Data boundary |
| --- | --- | --- |
| Cloudflare | Hosts the web app and API; provides network security and application logs | Requests, IP/network metadata, request IDs, and logged failures |
| Supabase | Authentication, Postgres, file storage, and Vault | Account identity, structural product data, files, usage ledger, encrypted secrets |
| Electric SQL | Browser sync and durable thread streams | Synced house records and full thread/run history |
| GitHub | Optional OAuth sign-in | OAuth identity and profile fields returned during sign-in |
| OpenRouter and selected model providers | Model inference | Prompts, selected context, replies, and tool-related content needed for a turn |
| Daytona | Default remote sandbox runtime | Workspace content, commands, results, and credentials injected for requested work |
| Sprites | Legacy remote sandbox runtime | The same runtime categories when a house selects Sprites |
| Fly.io / ragthis | Hosts arbe's derived file-search service | Uploaded file content, extracted text, images, captions, and embeddings |
| PostHog EU | Optional product telemetry plus always-on operational and usage events | No email, names, prompts, messages, file content, or session data; app IDs remain linkable inside arbe |

Other house members and agents are recipients of data shared inside their house. They are part of the product's collaboration boundary, not infrastructure providers.

## Update rule

Before adding a provider or sending a new data category to an existing provider:

1. Update this map and the public `/privacy` notice.
2. Decide whether the data is optional or required, and keep optional analytics behind explicit opt-in.
3. Check export and account/house deletion behavior at the canonical storage boundary.
4. Keep content and direct identity out of PostHog.

Provider retention schedules, regions, contractual safeguards, and deletion propagation are deployment/legal records rather than code-owned facts. They are not verified in this map.