We collect nothing. On purpose.

Last updated 2 August 2026

Arcalox has no account, no server we run, and no analytics. The app makes no outbound network calls. Your notes, secrets, and media never reach us, because the app is built so they cannot. This page explains exactly what that means.

The app

Everything you create in Arcalox is stored only on your own device, encrypted at rest with AES-256-GCM under a SQLCipher whole-database key derived through Argon2id. There is no login, no email, and no phone number. Your identity is a cryptographic keypair generated on your device.

Arcalox does not include analytics, advertising, crash reporting to us, or any tracking library. It does not phone home. We do not receive, store, or have any ability to read your data.

Sync

When you choose to sync between your own devices, Arcalox writes a single encrypted file to storage you control, such as a local folder or your own cloud. Only ciphertext leaves the device. We operate no sync server, and no third party can read the contents. Direct device-to-device peer-to-peer sync is planned but not yet part of the shipped app.

Your passphrase

Your passphrase never leaves your device and is never sent to us. Because there is no account and no server, we cannot recover your passphrase or your data if you lose them. Keep a backup of your encrypted export and remember your passphrase.

This website

The Arcalox website is a set of static pages. It sets no cookies, runs no analytics, and loads no third-party trackers or fonts. The hosting providers that serve this site, currently Cloudflare and Codeberg Pages, may record standard technical request information such as IP address in their own logs under their own policies, which we do not control and do not use for analytics.

Links to Codeberg (source code) and Open Collective (donations) lead to third-party services with their own privacy policies.

Children

Arcalox is a general-purpose tool and is not directed at children. Because we collect no data, we collect no data from anyone, including children.

Changes

If this policy changes, the updated date above will change and the new version will be published here. Because the app collects nothing, changes will be rare.

Contact

Questions or security disclosures: see the security policy in the source repository.