Privacy data map
The current production data flows behind
/privacy. Update this page when a provider or data path changes.
arbe is operated by Oskar Roug Mosumgaard (Invisible Touch). The public notice lives at apps/www/src/routes/privacy/+page.svelte; this page is the internal map used to keep it accurate.
Controller contact is deliberately email-only (oskar+arbe@rough.dk); no postal address is published, which is a standing decision rather than an oversight. Worth revisiting if arbe takes payment, leaves alpha, or picks up users outside the current circle.
Data flows
| Data | Source | Where it goes | Purpose | Owner |
|---|---|---|---|---|
| Account identity, email, OAuth profile, auth timestamps | The person and their sign-in provider | Supabase Auth; GitHub when GitHub sign-in is selected | Sign-in and account recovery | apps/www/src/routes/login/, apps/www/src/routes/auth/, docs/system/auth.md |
| Profiles, houses, memberships, agents, threads, workflows, environments, usage ledger | People, agents, and application mutations | Supabase Postgres; Electric SQL for live browser sync | Durable product state and multiplayer sync | packages/supabase/migrations/, apps/www/src/routes/api/shapes/, docs/system/storage.md |
| Messages, tool events, lifecycle signals, run history | People, agents, and the dispatcher | Electric SQL Durable Streams | Shared conversation and durable run history | packages/core/entries.ts, packages/core/schemas/stream-events/, docs/system/durable-streams.md |
| Uploaded files and derived search data | House members and agents | Supabase Storage; ragthis on Fly.io; the model used for visual extraction | File storage, extraction, search, and citations | packages/core/files.ts, apps/www/src/lib/server/file-index.ts, docs/system/files.md |
| Prompts, replies, selected thread context, tool inputs and results | People, agents, threads, and tools | OpenRouter and the selected model provider, or a directly selected provider | Generate model decisions and replies | packages/core/dispatch/reply.ts, packages/core/pi/, docs/system/llm-keys.md |
| Repositories, workspace files, commands, results, and bound runtime secrets | House members and agents acting on their instructions | Daytona; legacy Sprites when that runtime is selected | Run tools and coding work on remote computers | packages/sandbox/src/daytona/, packages/sandbox/src/sprites/, docs/system/runtime.md |
| API-token metadata, secret names, encrypted secret values | House members and CLI sessions | Supabase Postgres and Vault; resolved values enter the selected runtime when needed | Authenticate API clients and supply tools with credentials | apps/www/src/routes/api/secrets/, packages/core/dispatch/turn-secrets.ts, docs/system/secrets.md |
| Request IDs, errors, runtime logs | Application and infrastructure | Cloudflare | Security, failure diagnosis, and service operation | apps/www/src/hooks.server.ts, apps/www/wrangler.jsonc, docs/system/observability.md |
| App IDs, run IDs, model/tool usage, token counts, cost, latency, failure status | Dispatcher and paid capability seams | Supabase usage_events; PostHog EU | Usage limits, cost attribution, and operational reliability | packages/core/usage.ts, packages/core/usage-posthog.ts, docs/system/analytics.md |
| Thread/agent/trace IDs, dispatch outcome, duration, HTTP status | Dispatcher run terminals, always-on (not opt-in) | PostHog EU | Operational reliability of agent runs | packages/core/dispatch/signals.ts, docs/system/analytics.md |
| Optional lifecycle analytics and hashed browser identity | Application after per-agent opt-in | PostHog EU | Understand product use | apps/www/src/lib/analytics.ts, apps/www/src/lib/server/track.ts, docs/system/analytics.md |
| Session cookies; PostHog browser identifier after opt-in | The browser | Set by arbe; PostHog EU for the analytics identifier | Keep a session signed in; attribute opted-in analytics | apps/www/src/hooks.server.ts, apps/www/src/lib/analytics.ts, docs/system/auth.md |
Providers
| Provider | Role in arbe | Data boundary |
|---|---|---|
| Cloudflare | Hosts the web app and API; provides network security and application logs | Requests, IP/network metadata, request IDs, and logged failures |
| Supabase | Authentication, Postgres, file storage, and Vault | Account identity, structural product data, files, usage ledger, encrypted secrets |
| Electric SQL | Browser sync and durable thread streams | Synced house records and full thread/run history |
| GitHub | Optional OAuth sign-in | OAuth identity and profile fields returned during sign-in |
| OpenRouter and selected model providers | Model inference | Prompts, selected context, replies, and tool-related content needed for a turn |
| Daytona | Default remote sandbox runtime | Workspace content, commands, results, and credentials injected for requested work |
| Sprites | Legacy remote sandbox runtime | The same runtime categories when a house selects Sprites |
| Fly.io / ragthis | Hosts arbe’s derived file-search service | Uploaded file content, extracted text, images, captions, and embeddings |
| PostHog EU | Optional product telemetry plus always-on operational and usage events | No email, names, prompts, messages, file content, or session data; app IDs remain linkable inside arbe |
Other house members and agents are recipients of data shared inside their house. They are part of the product’s collaboration boundary, not infrastructure providers.
Update rule
Before adding a provider or sending a new data category to an existing provider:
- Update this map and the public
/privacynotice. - Decide whether the data is optional or required, and keep optional analytics behind explicit opt-in.
- Check export and account/house deletion behavior at the canonical storage boundary.
- Keep content and direct identity out of PostHog.
Provider retention schedules, regions, contractual safeguards, and deletion propagation are deployment/legal records rather than code-owned facts. They are not verified in this map.