ARCA — Privacy Policy

Last updated 24 October 2026

ARCA is a community events and ticketing service, run by Ourstory Studios Limited, a company registered in England and Wales (company number 15850097), 66 Wenham House, Ascalon Street, London SW8 4DZ ("ARCA", "we", "us"). We are the controller of the personal data described here. This policy explains what we collect, why, the legal basis for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, who can see it, how long we keep it, and your rights. Questions: hello@arcacommunity.app.

1. Data we collect

• Account details: your name, email address, date of birth and username, collected when you sign up.
• Profile content: your Arca customisation (colours, containers, photo elements) and profile photo.
• Photos you upload to communities, events or your Photo Book, including photos taken with the in-app event camera.
• Activity: communities you join, events you attend, tickets you hold (including their purchase time and price), and check-ins at event doors.
• Messages you send in bubbles (small group chats).
• Reports you make about content or members, and blocks you set.
• Brand accounts: brand name, handle, contact details and Instagram handle.
• If you run a community that sells tickets: the payout details you give us so we can pay you (the account name, account number and sort code). The app only ever shows the last four digits back, and only to the community's own login.
• If you sign in with Google or with Apple, the basic account details they share with us. Sign in with Apple lets you hide your email: if you do, we receive a relay address from Apple and never your real one.
• A push token for each device you allow notifications on, so we can send them. It identifies the device, not you, and is deleted when you sign out.
• Diagnostics: if the app crashes we receive a crash report through Google Crashlytics, which can include your account ID, the device model, operating system version and what the app was doing.
• The country or city you choose in Settings → Location. It stays on your device and sets the currency prices are shown in.
• A device check (Apple's App Attest or DeviceCheck), used only to confirm requests come from a genuine copy of ARCA rather than a script.

2. Buying or getting a ticket on arcacommunity.app

You can buy or get a ticket on arcacommunity.app without an account. For that we collect your name and email address, and the number of tickets. For a paid ticket you give these to Stripe on its payment page, and Stripe passes them to us with the payment; for a free ticket you type them on our page, and we email a confirmation link to that address. Nothing is booked for a free ticket until the link in that email is followed and confirmed; if it is not confirmed within 30 minutes, the name and email are deleted within the hour.

We use your email to send your receipt or ticket, a reminder before the event, and a message if the event is cancelled, and so that your ticket moves into the app when you sign in with the same, verified email. Your name is shown to the host on their guest list. To limit how many checkouts can be started from one place, and how many emails can be sent to one address, we keep one-way scrambled forms of your network address and email address, which cannot be turned back into them, for up to two days. On the website, Google reCAPTCHA checks that a checkout is started by a person rather than a script; it may set Google cookies needed for that check, and Google's privacy policy applies to it. The website sets no cookies of its own.

3. Payments

Payments are processed by Stripe. Your card number, expiry and security code go directly to Stripe and never touch ARCA's systems. We store only a reference to the payment (so the event's host can refund you), never card details. Stripe's own privacy policy applies to their processing: stripe.com/privacy.

4. Why we use your data, and our legal basis

• To provide ARCA under our Terms (performance of a contract, UK GDPR Article 6(1)(b)): your account and profile, showing your content to the people each feature is for, issuing and checking tickets, payments, refunds and payouts, and the emails that go with a ticket.
• To keep ARCA safe and working (our legitimate interests, Article 6(1)(f)): confirming you are old enough, checking that requests come from a genuine copy of the app or a real person, limiting automated checkouts, crash reports to fix faults, and acting on reports of abuse.
• To meet our legal obligations (legal obligation, Article 6(1)(c)): keeping payment and accounting records, and responding to lawful requests.
• To send notifications to your phone (your consent, Article 6(1)(a)): you choose this in your phone's settings, and can turn it off there at any time.

We do not sell your personal data, and we do not use it for advertising.

Your right to object. Where we use your data on the basis of our legitimate interests (the second point above), you can object at any time by emailing hello@arcacommunity.app. We will then stop, unless we have compelling grounds to continue, such as keeping other members safe.

5. Who can see what

• Community members can see what you share to that community.
• Bubble members can see your messages and, as you chat, your gradually revealed Arca.
• Event hosts can see the names and handles of their attendees, including the names of guests who got their ticket on the website, and can check tickets at the door. Hosts use that information to run their event and are responsible for it once they have it.
• Your date of birth is used to check you are 18 or over, and your age is shown where the app shows it.

6. The companies that process data for us

We use these service providers, each under contract and only on our instructions:

• Google (Firebase and Google Cloud): sign-in, database, file storage, server code, notifications, crash reports and device checks; and reCAPTCHA on the website.
• Stripe: payments, refunds and payouts.
• Apple: Sign in with Apple, notifications and device checks.
• Hostinger: sending our emails.

7. Where your data is stored

Our main database is in London. Photos and other files, our server code, crash reports and parts of Google's and Stripe's services are in the United States or elsewhere outside the UK. Where data leaves the UK, it is protected by the safeguards UK data protection law requires: the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") for companies certified under it (Google and Stripe are), and the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) otherwise. Hostinger is based in the European Union, and the UK recognises the EU's protection of personal data as adequate.

8. How long we keep it

• Your account, profile, photos and activity: while your account exists. When you delete your account, they are deleted, except as below.
• Messages you sent in bubbles: they stay in the chat after you delete your account, with your name removed, so the conversation still makes sense to the others in it.
• Tickets and payment records: as long as UK tax and accounting law requires (six years after the end of the financial year they belong to), with your name removed from them once your account is deleted.
• Website ticket buyers' name and email: until 30 days after the event, then deleted. The name stays on the host's guest list record, and the ticket keeps a one-way scrambled form of the email (it cannot be turned back into the address) for as long as the ticket record is kept. Unconfirmed free tickets: deleted within an hour.
• Scrambled network and email addresses used to limit checkouts and emails, and records used to limit password-reset and verification emails: up to two days.
• Push tokens: until you sign out on that device.
• Crash reports: up to 90 days.
• Reports about content: as long as needed to deal with them and keep members safe.

9. Your rights

Under the UK GDPR you have these rights over your personal data (Articles 15 to 22):

• Right of access: to ask for a copy of your data.
• Right to rectification: to have inaccurate data corrected.
• Right to erasure: to have your data deleted. You can delete your account yourself in the app, at Settings → Account → Delete account.
• Right to restriction of processing: to ask us to limit how we use your data.
• Right to data portability: to receive the data you gave us in a common, machine-readable format.
• Right to object: to object to how we use your data on the basis of our legitimate interests.
• Right to withdraw consent: where we rely on your consent (notifications), you can withdraw consent at any time in your phone's settings, without affecting what happened before.
• Rights about automated decision-making: we do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

To use any of these rights, email hello@arcacommunity.app; we reply within one month. We have not appointed a Data Protection Officer, as the law does not require one for an organisation like ours; hello@arcacommunity.app reaches the people responsible for your data.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office, the UK's supervisory authority for data protection (UK GDPR Article 77; ico.org.uk, 0303 123 1113).

10. Emails and cookies

We email you only about your tickets and your account: receipts, ticket confirmations, reminders before an event, cancellations and sign-in or security messages. We do not send marketing emails or texts. If we ever want to, we will ask you first, as the Privacy and Electronic Communications Regulations 2003 (PECR) require, and every such message will let you unsubscribe. The app and arcacommunity.app set no cookies of their own; the app keeps your settings on your device.

11. Children

ARCA is for people aged 18 and over. The only information we hold about a child is the name a parent or guardian gives when getting a ticket for them to an event that admits under-18s. If we learn an account belongs to someone under 18 we delete it promptly. Report concerns to hello@arcacommunity.app.

12. Security

We protect your data with access controls, encryption in transit, checks that requests come from genuine copies of ARCA, and by keeping card details out of our systems entirely. If a breach affects your data in a way that puts you at high risk, we will tell you.

13. Changes

If this policy changes materially we will flag it in the app, and the date above will change.

14. Contact

Ourstory Studios Limited, 66 Wenham House, Ascalon Street, London SW8 4DZ — hello@arcacommunity.app