Privacy Policy

1Who is responsible

The controller of your personal data is Jovan Maksimović, Ugljevik, Bosnia and Herzegovina, who operates Arka. Write to support@arka.today about anything in this policy.

This policy covers the Arka website, the demo editor on it, your account pages, the Arka API and the Arka for Blender add-on. Features that are not publicly available yet are not covered; this page will be updated before they launch.

2What we collect

Your account

When you register we store your email address and a password. The password is stored only as a hash by our authentication provider; we never see it. Alongside that we keep a small account record: an internal user ID, your email, a display name if one exists, your plan, whether the account is active, and when it was created and last used.

If you add websites under Allowed websites in your dashboard, we store those addresses (for example https://app.example.com) with your account, so that browsers on those sites can call the API with your key.

A record of metered API calls

For each call that counts against a plan or a free allowance we record: the time, which endpoint was called, its category (placement or AI), the HTTP status, how long it took, which of our apps made it, the origin of the page that made it, and your user, customer or add-on install ID. For AI calls we also record the model used, the number of tokens and what the call cost us. This is what quotas, usage charts and billing are computed from.

These records do not contain your IP address, your prompt, or the room you sent.

The rooms and prompts you send

Room outlines and furniture lists are processed in memory to compute a layout and are not stored. When you use the AI feature, your prompt is sent to our AI provider together with the room's overall width, depth and usable floor area — not its coordinates — so the model can choose furniture that fits. We do not store prompts. Please do not put personal or confidential information in a prompt; the service needs none.

The Blender add-on

The add-on needs no Arka account and sends no name or email address. The first time it contacts our server, it registers itself: we store a random install token (only as a hash), the add-on and Blender versions, your operating system, when the install was first and last seen, and — once you activate a subscription — which subscription it belongs to. That record is what counts the free trial and links your calls to your subscription.

With each furnish the add-on sends the room's outline (its wall corners), its doors and windows, the furniture list and any Auto furnish notes. They are handled exactly like the rooms and prompts described above: processed, not stored. Nothing else from your scene or your files leaves Blender. On your computer, the add-on keeps its install token and your license key in its own settings file.

With Generate the add-on sends the boundary’s outline with its doors and windows and the rooms you picked, handled the same way: the house is laid out on our own server.

IP addresses

We use your IP address in memory to enforce rate limits, the daily free allowance of the demo and the limit on new add-on installs. We do not write it to our database. Like any web service, our hosting provider's server logs do contain IP addresses and request paths; those logs are kept by the host for a limited time and are used only to operate and secure the service.

The waitlist

If you join the waitlist we store the email address you give us, the plan you were interested in, and the date. We use it for one thing: to tell you when a seat opens.

Payments

Subscriptions are sold by Lemon Squeezy, our reseller and merchant of record. Lemon Squeezy collects your payment details, billing address and tax information, and is an independent controller of that data under its own privacy policy. We never receive or store your card details. What Lemon Squeezy sends us is limited to what we need to switch your plan on and off: order and subscription identifiers, the plan, the subscription's status, and its renewal or end date — linked to the account email and user ID we attached to the checkout.

A Blender add-on subscription has no Arka account to link to, so Lemon Squeezy also sends us the email address you gave at checkout and your license key. We keep that email with the subscription, so we can find it when you write to us, and the license key only as a hash.

Email

We send service email only: account confirmation and password resets, notices about your subscription or about changes to the service, and replies to messages you send us. We do not send marketing newsletters.

3Cookies and browser storage

Our pages set no advertising or analytics cookies and load no third-party trackers or fonts. We use your browser's local storage for things the site needs to work: your sign-in session, your display preferences, and — for up to an hour — the plan you picked before creating an account, so checkout can continue after you sign in.

The checkout itself is worth naming. It runs on Lemon Squeezy's own site: when you continue to checkout you leave our pages, and Lemon Squeezy may set cookies it needs to process the payment and prevent fraud. None of our pages loads a Lemon Squeezy script.

4Why we use your data

We do not sell your data, we do not use it for advertising, and we do not use the rooms or prompts you send to train models.

5Who processes it for us

These providers process data in the United States and other countries, which may be outside the country you live in. Where the law requires it, such transfers rely on the safeguards those providers offer, such as standard contractual clauses.

6How long we keep it

• Account record: for as long as your account exists. Ask us to delete the account and we will.
• Records of metered calls and subscription records: while your account exists, and afterwards for as long as we need them for accounting, tax and resolving disputes.
• Add-on install records: kept with the records of metered calls they count, as above. They carry no name or email address.
• Waitlist entries: until we have told you a seat is open, or until you ask us to remove you, whichever comes first.
• Allowed websites: until you remove them or the account ends.
• Server logs: a limited period set by our hosting provider.
• Rooms and prompts: not kept at all.

7Security

All traffic to Arka is encrypted in transit. Passwords are stored only as hashes by our authentication provider, and API keys, license keys and add-on install tokens are stored only as hashes by us — which is why an API key is shown once and cannot be recovered. (A license key stays in your Lemon Squeezy order email and on its My Orders page.) The tables that hold this data cannot be read from the browser; only our own server can read them. No system is perfectly secure, so if you ever suspect a problem with your account or key, tell us and generate a new key.

8Children

Arka is a tool for professionals and developers. It is not directed at children, and we do not knowingly collect data from anyone under 16.