Draft — not reviewed by an attorney.

This describes what the product actually collects and does today, written to be accurate rather than aspirational — but it has not been reviewed against CCPA/CPRA or the other state privacy regimes it needs to satisfy. Review by qualified U.S. counsel is required before Arbiter is offered to real users, per §13 of the build spec.

Privacy Policy

Last updated: [DATE] — draft, unreviewed

What we collect

Account information — name, email address, and a securely hashed password. We never store your password itself.
Your messages and the AI’s replies — the full content of every conversation, stored so your threads remain available when you return.
Routing and usage data — which type of request each message was, which AI model answered it, how long each stage took, and token counts, used to bill usage and operate the product.
Technical data — your IP address, used to enforce rate limits, verify you’re in a supported region, and detect abuse.

Third parties who process your messages

To answer your messages, Arbiter sends their content to one of several third-party AI providers — currently Anthropic, Google, or OpenAI, depending on which is best suited to the request. Each provider processes that content under its own privacy and acceptable-use terms in addition to ours. We do not sell your data to anyone.

Automated safety screening

Every message is checked by an automated, local screen before it’s sent to any AI model. Messages that appear to involve child sexual abuse material are blocked and reported to the National Center for Missing & Exploited Children (NCMEC) as required by law. Messages that appear to express thoughts of self-harm are flagged internally so the response can include crisis resources — this flag records that the screen fired, not a copy of what you wrote.

How long we keep data

Account and conversation data is currently retained until you delete your account or request deletion. Arbiter does not yet have automatic retention limits or a self-service way to delete a thread or account. [A defined retention schedule and self-service deletion are expected before this policy is finalized.]

Your rights

Depending on your state of residence, you may have rights to access, correct, or request deletion of your personal information under laws such as the CCPA/CPRA. To exercise these rights today, contact us directly at [CONTACT EMAIL] — a self-service option is expected in a future update.

Children’s privacy

Arbiter is offered only to people 18 or older and is not directed at children. We do not knowingly collect information from anyone under 18.

Changes to this policy

We may update this policy as the product changes. Material changes will be communicated through the product before they take effect.

Contact

[Company name and contact address to be added.]