Privacy Policy

Last updated: November 3, 2026

Arsenal Lab treats privacy like security: fail closed, minimal surface, explicit consent before cloud features. You must accept this policy during onboarding to enable dashboard sync.

What we collect

Account email and profile from WorkOS; billing metadata from Lemon Squeezy; anonymous session IDs and page paths for product analytics; optional campaign sync metadata when you use Pro or Enterprise.

What we do not collect

Lab payloads, customer production telemetry, or offensive artifacts from your air-gapped runs unless you explicitly export and upload them. The desktop app remains offline-first.

How we use data

Authentication, subscription enforcement, dashboard features, abuse prevention, and aggregated usage stats. We do not sell personal data.

Retention

Analytics raw events: 90 days (Pro) or per Enterprise contract. Account data: life of account + legal retention. You may request deletion at privacy@arsenal.lab.

Sub-processors

WorkOS (auth), Supabase (database), Lemon Squeezy (payments), and our hosting provider for this marketing/dashboard site.