Privacy Policy

Without an account, Arclio sends us nothing. Your library, your files and your downloads stay on your computer. With an account, we store your email and your library metadata — titles, tags, collections, favourites, source URLs and playback progress.

We never receive your media files. Not the videos, not the audio, not the documents. We do not receive the paths to them on your disk either. There is no copy of your library on our servers — only a catalogue of what it contains.

Kemzang Bryan is the data controller for the account and sync services, reachable at kemzangbryan@gmail.com.

Account. Your email address, name and profile picture as provided by Google when you sign in, so that the account exists and you can be recognised across devices. We never see or store your Google password.

Devices. A name, platform and creation date for each connected device, plus a hashed access token — never the token itself. This is what lets you see and revoke your devices.

Library metadata. For Pro subscribers, the catalogue described above, so it can be synced between your devices and restored after a reinstall.

Payments. Handled entirely by Paddle, the merchant of record. We receive confirmation of your subscription status; we never see your card details.

We do not sell your data, share it with advertisers, or use it to profile you. We do not read your library to recommend anything to anyone else.

The desktop app collects anonymous usage analytics, which you can turn off in its settings. It is not tied to your account and does not include what you download.

Account and sync data live in Cloudflare D1, on Cloudflare’s network. Data is kept while your account exists.

Deleting your account removes your account record, your devices and your synced metadata. Disconnecting a single device removes that device’s access without touching the rest. Your local library is never affected by either.

You can ask for a copy of the data we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to kemzangbryan@gmail.com and we will act within 30 days.

If you are in the European Economic Area or the United Kingdom, these rights come from the GDPR and apply regardless of where we are based. Our lawful basis is the performance of our contract with you for account and sync data, and consent for optional analytics.

If this policy changes in a way that affects what we collect or why, we will say so before it takes effect. The date at the top always reflects the last substantive revision.