Overview

ArcBrush is a desktop application that processes images locally on your device. We collect only the minimum data necessary to provide our services and improve the application.

Anonymous Telemetry

ArcBrush sends an anonymous usage heartbeat once per hour while the application is running. This helps us understand how the app is used and prioritize improvements. The heartbeat contains:

Install ID. A randomly generated identifier (UUID) created on first launch. It is not derived from hardware IDs, MAC addresses, or any personal information.
App version. The version of ArcBrush you are running.
Operating system. "windows", "macos", or "linux".
Session duration. How many minutes the app has been open.
Node count. The number of nodes in your current graph.
Generation count. How many AI generations you have run this session.
Registered status. Whether you have signed in to an account (true/false only, not your email).

Telemetry does not include your email address, images, prompts, file paths, file names, project content, or any personally identifiable information.

You can disable telemetry at any time in Settings. When disabled, no usage data is sent.

AI Generation Features

AI features are optional and require an account. When you use AI generation:

Data sent to AI providers

Text prompts. The prompt you write is sent to the AI model provider to generate an image.
Input images. For AI Image Edit, AI Remove Background, and AI Upscale, your input image is sent to the provider for processing.

Images and prompts are transmitted securely via HTTPS through our proxy server. We do not store your images or prompts on our servers; they are forwarded to the AI provider and discarded.

AI providers

AI generation is powered by third-party providers including fal.ai, Black Forest Labs (Flux models), Google (Nano Banana 2), OpenAI (GPT Image 2), Bria, Ideogram, and Pixelcut. Your data is processed according to their respective privacy policies.

Local generation log

ArcBrush keeps a local log of your AI generations on your device. This log includes timestamps, prompts, model used, dimensions, credit cost, and file paths. This log is stored only on your computer and is never sent to our servers.

Send Feedback

The Send Feedback feature (Help menu) lets you report bugs, request features, or share general feedback. When you submit feedback, the following is sent:

Your message. The text you write.
System info. OS, app version, GPU model, and display resolution to help reproduce issues.
Graph context. Node types and connection structure of your current graph (no image data, file paths, or prompts).

Feedback submissions are stored on our servers for the purpose of improving ArcBrush. No images or file contents are included.

Payment Processing

Credit pack purchases are processed by Stripe, our third-party payment processor. When you purchase credits, Stripe collects and processes your payment information (including card details and billing address) directly. ArcBrush LLC does not see or store your full card number. Stripe's handling of your data is governed by its own privacy policy at stripe.com/privacy.

After a successful purchase, a confirmation email is sent to your account email address showing the pack name, credits added, and new balance. These emails are sent only for completed purchases.

Account Data

If you create an account to use AI features:

Email address. Used for authentication and account communication. Stored securely on our servers.
Authentication tokens. Stored in your operating system's secure credential storage (Windows Credential Manager, macOS Keychain, or libsecret on Linux). We never store passwords.
Credit balance and purchase history. Stored on our servers for billing purposes.

We do not sell or share your personal information with third parties.

Third-Party Service Providers

We use the following categories of third-party service providers to operate ArcBrush. Each is contractually bound to handle data only as instructed by us:

AI model providers. fal.ai, Black Forest Labs, and Google process your prompts and input images to generate AI content (see AI Generation Features above).
Payment processor. Stripe processes credit pack purchases (see Payment Processing above).
Cloud hosting. Our proxy server and account database are hosted with reputable cloud infrastructure providers.
Email delivery. Purchase confirmation and account emails are sent through a transactional email service.

Website

We do not use third-party tracking cookies or analytics services on our website.
Download counts are recorded with no personal information attached.

Data Security

All communication between ArcBrush and our servers uses HTTPS encryption. Account credentials are managed through industry-standard authentication. API keys are never stored on the client.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay, and in any case within the time frames required by applicable law (typically within 72 hours of becoming aware, where required by the GDPR). Where required, we will also notify the relevant data protection authority.

Data Retention

Telemetry events are retained in aggregate for product improvement.
Account data is retained while your account is active.
Credit purchase records are retained for accounting purposes.
AI-generated images are not stored on our servers after processing.
You may request deletion of your account and associated data at any time.

International Data Transfers

The third-party providers we use to operate the Software may be located in countries other than the one from which you access it. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, your personal data may be transferred to and processed in countries that have different data protection laws than your own. Where required by applicable law, such transfers rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, to ensure that your data continues to receive an adequate level of protection.

Your Rights

Depending on where you live, you may have specific rights regarding your personal data. We honor the following rights for all users, regardless of jurisdiction:

Access. Request a copy of the personal data we hold about you.
Rectification. Request correction of inaccurate or incomplete data.
Erasure. Request deletion of your account and associated data (the "right to be forgotten").
Portability. Receive your data in a structured, commonly used, machine-readable format.
Objection and restriction. Object to or restrict certain processing of your data.
Disable telemetry in Settings at any time.
Use the editor without an account. All 83 non-AI nodes work without any data collection beyond optional telemetry.
Withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@arcbrush.com. We will respond within the timeframes required by applicable law (typically 30 days under the GDPR; 45 days under the CCPA).

Legal basis for processing (EEA/UK users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

Performance of a contract. To provide AI generation features and process credit purchases.
Legitimate interests. To operate, improve, and secure the Software (including anonymous telemetry, when not disabled).
Consent. Where you have given consent for specific processing (for example, feedback submissions).
Legal obligation. To comply with applicable laws and respond to lawful requests.

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data in accordance with applicable law. A list of EU supervisory authorities is available at edpb.europa.eu.

California residents (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the rights listed above. In the preceding 12 months, we have collected the following categories of personal information: identifiers (email address, install ID), commercial information (purchase history), internet activity (anonymous telemetry), and user-provided content (prompts and feedback submissions). We do not sell or share your personal information for cross-context behavioral advertising, and we do not knowingly collect personal information from minors under 16 for the purpose of selling or sharing.

Children's Privacy

ArcBrush is not directed at children under 13. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. Updated policies will be posted at https://arcbrush.com/privacy.

Contact

For privacy questions or data requests, contact us at contact@arcbrush.com.