Privacy Policy

Anchor — Arc Transformation LLC Effective Date: April 13, 2026 Last Updated: October 29, 2026

Overview

Anchor ("the App") is a visual routine management application designed for families of children with autism and other developmental needs. Arc Transformation LLC ("we," "us," or "our") built this App with the privacy and safety of children and families as a top priority.

This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

Children's Privacy (COPPA Compliance)

Anchor is designed to be used by children under the direction and supervision of their parent or guardian. We comply with the Children's Online Privacy Protection Act (COPPA).

What we collect about children:

A display name (chosen by the parent, does not need to be the child's real name)
An avatar selection (preset icons, not photos)
Optional photos uploaded by the parent for routine steps and rewards (objects or people the parent chooses)
Routine completion data (which tasks were completed and when)
App usage events (task completions, break usage, routine progress)
Behavior event data entered by the parent (Compass module, v1.3+)

What we do NOT collect from children:

Real names entered by the child
Photos or videos from the child device camera roll via the child role
Location data
Contact information
Any personally identifiable information entered by the child
Data from other apps or services on the device

Parental control:

All child profiles are created and managed by the parent
Parents can view and edit child data at any time
Parents can ask to have a child profile and that data removed by emailing tgood@arctransformation.ai from their account email. We delete that data within 30 days.
No data about a child is collected without the parent first creating a profile

Information We Collect

Account Information

Email address (for authentication)
Password (encrypted, never stored in plain text)

Child Profile Information (Parent-Created)

Display name
Avatar selection
Preferences (timer style, icon size, notification settings)

Parent-Uploaded Routine and Reward Photos (v1.4.2+)

Parents may optionally upload photos of objects or people for routine steps and rewards.

Stored privately and scoped to that child profile. The files are not in a public bucket and are not served as public URLs.
Children cannot upload photos. The child role does not access the device camera roll to pick or attach images.
Photos are deleted when the parent removes the photo or deletes the task or reward.
When you delete your account, photos are removed from storage as part of the deletion.
Parents can ask to have photos removed by emailing tgood@arctransformation.ai from their account email. We delete that data within 30 days.
We still do not collect child-entered PII, location data, or photos from the child device camera roll via the child role.

Usage Data

Routine and task completion records
Prompt level tracking data (entered by the parent)
Sensory break usage
Token board progress
Activity timestamps
App session identifiers (anonymous, for grouping events)

Behavior Tracking Data (Compass Module — v1.3+)

When you use the Compass behavior logging module, we collect the information you enter:

Behavior descriptions — what behavior occurred (selected from a curated list or entered as free text)
Antecedents — what was happening just before (optional; selected or free text)
Consequences — what happened after (optional; selected or free text)
Contextual factors — time, location (e.g., "Home," "School"), who was present, and sensory environment notes (all optional)
Optional parent-hypothesized function tags — your best guess at the function the behavior served (Sensory, Escape, Attention, Tangible, or Unsure); clearly labeled as parent-observed, not clinician-determined
Custom category labels — behavior, antecedent, and consequence categories you create for your child
Links to scheduled routine tasks — if you connect a behavior event to a specific task from Rhythm (optional)
Free-text notes — any additional context you want to record

All behavior data is entered by you, the parent. Your child does not have access to this data within the App.

Technical Data

Device type and operating system version
App version
Crash reports (if applicable)

How We Use Your Information

We use the information we collect to:

Provide the App's core functionality — creating routines, tracking progress, managing child profiles
Display analytics and progress — completion rates, streaks, prompt level trends
Send notifications — routine reminders and completion alerts (configurable by the parent)
Improve the App — understanding which features are used to prioritize development
Provide customer support — responding to questions or issues

For behavior tracking data specifically:

Behavior events are stored in Supabase (our cloud database provider) with encryption at rest and in transit
Your behavior data is displayed to the primary parent and to a co-parent they have invited, within the App
Behavior data is never used for AI model training or AI-powered analysis in v1.3. If AI-powered features are added in a future version, that will be disclosed before the feature launches and will require explicit opt-in
Behavior data is never sold, shared with advertisers, or provided to third parties for any purpose

How We Do NOT Use Your Information

We do not sell your data. Ever. To anyone.
We do not serve advertisements. The App is ad-free.
We do not share data with third parties for marketing or advertising purposes.
We do not use children's data for profiling or behavioral targeting.
We do not track users across other apps or websites.

Behavior Tracking Data — Extra Care

Behavior data is different from routine completion data. A record of a behavior event — what happened, what led up to it, what your child did — is a sensitive, medical-adjacent observation about a minor. We treat it accordingly.

Here's what that means in practice:

The primary parent controls who else can see it. The primary parent can invite a co-parent who already has an Anchor account. Once that access is granted, the co-parent can view and edit that child's routines and behavior data. The primary parent can revoke access. Clinicians are not invited yet. No other user, and no Anchor team member, has access to your child's individual behavior records as part of normal operations.
Your child cannot see it. The Compass module is parent-only. Behavior events are not accessible from the child's view of the App, and child devices have no permission to read behavior data at the database level.
We do not view individual records. The Anchor team does not review individual behavior events in normal operations. We may access anonymized or aggregated data only to diagnose technical issues, and only when necessary.

Exports and Data Leaving Anchor

The Compass module lets you export your child's behavior data as a CSV file (for use in spreadsheet tools or with a BCBA) or as a formatted PDF (for sharing with clinicians or keeping as a record).

What you should know about exports:

Exports are generated on your device, not on our servers. The raw event data does not leave your device to be rendered — the export file is assembled locally.
Once you download or share an exported file, that file is entirely under your control. Anchor has no ability to modify, delete, or track the exported copy.
We recommend treating exported behavior files with care. They contain sensitive observations about your child.
- Store them somewhere secure (not in an unsecured cloud folder or shared drive)
- Be thoughtful about who you share them with — even when sharing with a clinician
- Delete exported files when you no longer need them
Every exported file includes a disclaimer: behavior data was parent-collected and should be interpreted alongside professional clinical observation. Anchor does not provide clinical advice.

Data Storage and Security

All data is stored securely using Supabase, a trusted cloud database platform with encryption at rest and in transit.
Passwords are hashed and never stored in plain text.
Row-level security (RLS) ensures that users can only access their own data.
The App stores some data locally on your device (using encrypted local storage) for offline functionality.

We may share data only in the following limited circumstances:

Service providers: We use Supabase for data storage and authentication. They process data on our behalf under strict contractual obligations.
Legal requirements: We may disclose information if required by law, court order, or governmental authority.
With your consent: We will not share your data with anyone else without your explicit permission.

We do not share, sell, or rent personal information to third parties for their own purposes.

Your Rights

You have the right to:

Access your data — View all information associated with your account within the App
Correct your data — Edit child profiles, preferences, and account information at any time
Delete your data — To remove a child profile and its data, email tgood@arctransformation.ai from your account email. We delete that data within 30 days. Account deletion in the Android app is at Settings > Account > Delete Account. Anyone, including iOS users, can request account deletion by emailing tgood@arctransformation.ai from the account email. Email requests are completed within 30 days. See Delete your account and the account deletion page
Export your data — For behavior data, export directly from the Compass module as CSV or PDF. For other data, contact us (see below)
Opt out of notifications — Disable all notifications from within the App's settings

For behavior tracking data specifically, you also have the right to:

Access all behavior events — View your full behavior log within the App at any time
Export behavior data — Generate a CSV or PDF export for any date range, at any time, from within Compass
Delete individual behavior events — Remove any event from the log
Delete all behavior data — Request deletion of all Compass data for a child profile or your entire account
Manage custom categories — Add, rename, or archive custom behavior, antecedent, and consequence categories. Note: if you archive a category that is referenced by existing logged events, we retain the archived category label in our records for historical accuracy (so past events still display correctly) — but it will no longer be offered as an option when logging new events

For California Residents (CCPA)

You have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, request deletion, and opt out of data sales (we do not sell data).

If applicable, you have rights under the General Data Protection Regulation, including access, rectification, erasure, and data portability. Our legal basis for processing is legitimate interest (providing the service you signed up for) and parental consent for children's data.

Data Retention

Active accounts: We retain your data for as long as your account is active.
Deleted profiles: When we complete your emailed request (within 30 days), the live data for that profile is removed, including routines, completions, activity events, token progress, behavior events, behavior categories, and parent-uploaded step and reward photos. Routine database backups roll off within the backup retention period for our hosting plan, currently 7 days.
Deleted accounts: When you delete your account in the Android app, your account and data are deleted when you confirm, and you're signed out. If deletion can't finish, the app tells you and lets you retry. Anyone, including iOS users, can request deletion by emailing tgood@arctransformation.ai from the account email. Email requests are completed within 30 days. We delete your account data, except information we must keep for security, fraud prevention or legal reasons. Routine database backups roll off within the backup retention period for our hosting plan, currently 7 days. If a backup is ever restored, we would delete your data again. Details are in Delete your account.
Automatic cleanup: We do not retain data beyond what is needed to provide the service.

For behavior tracking data specifically:

Active behavior events are stored until you delete them or delete your account. We do not automatically prune behavior history.
Soft-deleted events — events you delete within the App — are retained for 30 days and then permanently removed. This gives you a short window to recover an accidentally deleted entry. After 30 days, the deletion is final.
Archived custom categories (categories you've archived rather than deleted) are retained indefinitely so that past behavior events that referenced them still display correctly. They will not appear as options when logging new events.
Account deletion removes behavior events, behavior categories, and the other Compass data for children you own from the live database when the deletion completes. The 30-day recovery window for an individually deleted event does not apply after the account is deleted. We delete your account data, except information we must keep for security, fraud prevention or legal reasons. Routine database backups roll off within the backup retention period for our hosting plan, currently 7 days.

Delete your account

In-app deletion is available in the Android app. Anyone, including iOS users, can request deletion by emailing tgood@arctransformation.ai from the account email. Email requests are completed within 30 days.

In the Android app: Sign in as the parent and open Settings > Account > Delete Account, then confirm. Your account and data are deleted when you confirm, and you're signed out. If deletion can't finish, the app tells you and lets you retry.

By email: Anyone, including iOS users, can email tgood@arctransformation.ai from the email address on the account. You can start that message from the account deletion page. If you sign in with Google or Apple, send the request from the email address on that account. If you use Hide My Email, send it from the relay address. We may reply to confirm ownership and will never ask for your password. We complete email requests within 30 days.

What gets deleted:

Your account and sign-in details
Every child profile you own and all of its data, including routines, schedules, completions, activity, token boards and rewards, and Compass events and categories
Uploaded photos are removed from storage as part of the deletion
Linked devices, which are signed out, and pairing codes
Co-parent access and invites you granted. Those people lose access to your children and keep their own accounts
Feedback you sent through the App

Co-parents: If you are a co-parent, deleting your account removes only your own access. Child profiles you do not own stay with the parent who owns them.

What is kept: Routine database backups roll off within the backup retention period for our hosting plan, currently 7 days. We use those backups only for disaster recovery. If a backup is ever restored, we would delete your data again. We delete your account data, except information we must keep for security, fraud prevention or legal reasons.

What we cannot delete for you:

Files you exported and saved yourself
Purchases handled by Google Play or the App Store. The App is free

Part of your data, not the whole account: In the App you can delete events or photos without deleting your account.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the App or via email. The "Last Updated" date at the top of this page indicates when the policy was last revised.

Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

Arc Transformation LLC Email: tgood@arctransformation.ai Website: arctransformation.ai

This Privacy Policy applies to the Anchor application and any future applications under the Arc Transformation ecosystem.