Privacy Policy

1. Introduction

Arkiv (“we,” “our,” or “us”) operates the Arkiv platform at arkivhq.com. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information.

Arkiv is operated from Saskatchewan, Canada by Hemant Naidu (operating as Arkiv), who is the data controller responsible for your personal information under applicable privacy laws. You can reach us using the details in Section 10.

By using Arkiv, you agree to the practices described in this Privacy Policy. This policy is incorporated into and governed by our Terms of Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Password (stored as a secure hash; we never store your plaintext password)
• Profile picture (if provided)
• Account preferences and settings

2.2 Collection and Activity Data

As you use the Service, we store the content you create:

• Media items you add to your collection (titles, formats, editions, condition, purchase details)
• Watch logs, ratings, and reviews you write
• Lending records you create
• Your “On My Radar” and wish list entries
• Custom tags and organizational data

2.3 Usage Data

We collect limited technical data to operate and improve the Service:

• Log data such as IP address, browser type, and pages visited
• Approximate location (country, city and a general area within roughly one kilometre) derived from your IP address when you sign in, used for security and aggregate analytics, and visible to Arkiv administrators. We do not track your precise location, such as your street address or GPS position.
• Feature usage signals to understand which parts of the app are used most
• Error and crash reports to diagnose technical issues

2.4 Google Sign-In (when enabled)

If you choose to sign in with Google and the operator has enabled Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive your Google password or access to other Google services. You can disconnect Google Sign-In at any time through your account settings.

2.5 Cookies and Similar Technologies

We use a small number of cookies and similar technologies, limited to what is needed to run the Service:

• Essential authentication cookies: used to keep you signed in and to secure your session. The Service does not function without these.
• Error and performance monitoring: our error-reporting provider (Sentry) may set limited technical identifiers to help us diagnose crashes and reliability issues. We scrub personal information from these reports.

We do not use advertising cookies, third-party analytics cookies, or cross-site tracking, and we do not build advertising profiles.

3. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide and operate the Service (storing your collection, generating stats, enabling lending records)
• Send transactional emails such as account verification and password reset links
• Respond to your support requests and feedback
• Identify and fix bugs and technical issues
• Improve and develop new features based on aggregate usage patterns
• Comply with applicable legal obligations

We do not use your data to serve third-party advertising and do not build advertising profiles.

Legal bases (for users in the EEA, the UK, and other regions where this applies): we process your account and collection data to perform our contract with you (providing the Service); we process limited usage, security, and error data on the basis of our legitimate interests in operating, securing, and improving the Service; and we rely on your consent for any optional processing, which you may withdraw at any time. Where Canada's PIPEDA applies, we collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

4. Data Sharing and Third Parties

4.1 The Movie Database (TMDB)

Arkiv uses TMDB as its metadata source for films and TV series. When you search for titles, your search query is sent to TMDB's API. TMDB's own privacy policy governs their handling of that data. We do not share your account information or collection data with TMDB.

4.2 Google (when OAuth is enabled)

If you use Google Sign-In, your authentication is handled by Google. We receive only the profile data described in Section 2.4. Google's privacy policy governs their handling of your authentication data.

4.3 Service Providers (Sub-processors)

We share data with a limited set of service providers who process it on our behalf, under confidentiality and data-protection obligations, solely to operate the Service:

• Hosting and infrastructure: our cloud hosting provider stores the data that runs the Service.
• Error monitoring: Sentry, for crash and error diagnostics (personal information is scrubbed from reports).
• Email delivery: our email provider, used to send transactional and account-related messages.

We do not sell, rent, or trade your personal information to any third party.

4.4 Legal Requirements

We may disclose your information if required by law, court order, or to protect the rights, safety, or property of Arkiv, our users, or the public.

4.5 International Data Transfers

Arkiv is operated from Canada, and our service providers may process data in Canada, the United States, or other countries. If you access the Service from the EEA, the UK, or another region with data-transfer rules, your information may be transferred to and processed in countries whose data-protection laws differ from your own. Where required, we rely on appropriate safeguards (such as the European Commission's standard contractual clauses or an adequacy decision) to protect your information when it is transferred.

5. Data Retention and Deletion

We retain your personal data for as long as your account is active. When you delete your account:

• Your personal information (name, email, profile) is deleted from our active databases
• Your collection, watch logs, and other user-generated content are deleted
• We keep a limited deletion record for security and abuse prevention: a one-way hash of your email (never the email itself), the deletion date, your account age, and your collection size. The hash cannot be reversed to recover your email.
• Residual copies in encrypted backups are purged on our normal backup rotation, within 30 days of deletion

While your account is active, we retain your personal data for as long as the account remains active. We may delete an account, after notice to you, following an extended period of inactivity. You can export your data at any time before deletion. Some aggregate or anonymized data derived from your usage may be retained in a form that cannot identify you.

6. Data Security

We implement reasonable technical and organizational safeguards to protect your data, including:

• Passwords stored using strong one-way hashing (bcrypt)
• Encrypted connections (HTTPS/TLS) for all data in transit
• Access controls limiting who can access production data
• Regular backups

No system is completely secure. You acknowledge that you use the Service at your own risk and that we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

7. Children's Privacy (COPPA)

Arkiv is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, you may not create an account or use the Service.

If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will:

• Promptly suspend the account to prevent further data collection
• Delete the account and all associated personal data
• Notify the reporting party when action has been completed

For parents and guardians: If you believe your child under 13 has created an account on Arkiv without your consent, please contact us using the information in Section 10. You may request to:

• Review any personal information we have collected from your child
• Delete your child's account and all associated data
• Revoke any consent for future collection of your child's information

We will respond to verifiable parental requests within a reasonable time and at no charge.

8. Your Rights

Depending on your location, you may have certain rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (see Section 5)
• Export (portability): Download your collection and account data at any time
• Objection: Object to certain processing of your data
• Restriction: Ask us to restrict processing of your data in certain circumstances
• Withdraw consent: Where we rely on your consent, withdraw it at any time without affecting processing already carried out

To exercise these rights, contact us using the information in Section 10. We will respond within the timeframes required by applicable law.

EEA and UK users (GDPR): if you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with your local data protection supervisory authority.

Canadian users (PIPEDA): you may also raise an unresolved privacy concern with the Office of the Privacy Commissioner of Canada.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Post the updated policy on our website
• Send email notification for significant changes where possible

Your continued use of the Service after changes become effective constitutes your acceptance of the updated Privacy Policy.

10. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern (including concerns about a child's account), please contact us through:

• Email: [email protected]
• The feedback form on our About page

The data controller responsible for your personal information is Hemant Naidu (operating as Arkiv), based in Saskatchewan, Canada. We will make reasonable efforts to respond to privacy inquiries promptly and within the timeframes required by applicable law.