Who is responsible?
UpArcly is operated by Iftimi Alexandru Paul, based in Romania, under the brand NorthShutter. Iftimi Alexandru Paul is responsible for the processing of personal data described in this notice. Contact northshutterstore@gmail.com about your personal data or this notice.
What we store
Your account
Guest accounts have a generated account identifier. If you connect Google, our authentication service receives your email address, provider identifier and profile information supplied by Google, such as your name or profile picture. We do not receive your Google password.
We store the display name and username you choose, your time zone, and your account creation and onboarding information.
Your preferences and progress
This includes your selected interests, pets, lifestyle, work type, activity level and focus skills; your quests and schedules; completions, XP, levels and streaks; challenges, achievements, free days, friend connections and races.
Quests can contain text you write. Avoid including sensitive personal details in quest titles or support messages.
On your phone
The app stores your sign-in session, a cache of game data, your reminder preference, and any quest completions waiting to sync. Personal quest reminders are scheduled locally on your device.
When you contact us
Your email address, message and any information you choose to include are handled through our support mailbox. Service providers may also process technical request information, such as IP addresses and security logs, to operate and protect their services.
Why we use it
- Provide UpArcly: manage your account, remember your quests, calculate progress, and run the friend features you use. Our legal basis is performance of the service contract with you.
- Personalize suggestions: match your selected preferences to a tagged quest catalog. This is part of providing the service you request. Suggestions use matching rules, not generative AI, and do not make decisions with legal or similarly significant effects.
- Support and security: respond to requests, troubleshoot problems and protect accounts. We rely on our legitimate interests in running a reliable and secure service, subject to your rights.
- Optional reminders: with your consent, schedule notifications when you enable them and grant permission. You can turn them off in the app or your phone settings.
- Legal obligations: handle requests or retain information where applicable law requires it.
The current app does not request access to your contacts, precise location, health records, or photo library. It does not include advertising or a third-party analytics SDK.
How long do we keep it?
We delete resolved support emails within 90 days after resolution, unless a legal obligation requires longer retention.
Account and game records remain available while you keep your account. Deleting a quest alone does not remove XP already earned; deleting your account removes its active account and game records.
The app’s persisted game cache has a 24-hour freshness limit. Pending offline completions are kept until they sync or are removed by account cleanup. Sign-out clears the old account’s cache and queue on that phone.
Service logs: our current Supabase Free plan provides one day of API and database platform log retention. This is separate from the account and game records described above.
Backups and exported logs: we do not currently run our own database backups or log exports. We have adopted limits of 30 days for future database backups and 7 days for future exported logs, measured from creation. These processes are not yet enabled. We will update this notice with the storage arrangements before enabling them.
Provider systems: deleting an active record does not necessarily erase every provider-held recovery or security copy immediately. Google describes a deletion process generally taking about two months and encrypted backup retention of up to six months, with exceptions, in its retention policy. Cloudflare determines retention using service purpose, data sensitivity, security needs and legal obligations, as described in its privacy policy. These provider processes are separate from our mailbox deletion deadline and planned backup limits.
See account deletion for in-app steps and the email request option.
Your choices and rights
You can edit your name and username, turn off reminders, and delete your account in the app. You can also contact NorthShutter to request access to or a copy of your data, correction, deletion, restriction of processing, or portability where applicable. You may object to processing based on legitimate interests, and withdraw consent where processing relies on it.
We respond to privacy requests without undue delay and normally within one month. If a request is complex or numerous requests require an extension, we will explain why within that month. We may need to verify that a request belongs to the account holder. Contact northshutterstore@gmail.com; do not send passwords or authentication codes.
You can complain to your local data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
This website
These pages contain no analytics scripts, advertising trackers, or embedded sign-in forms. Fonts and images are served with the site. Our hosting provider may process technical connection information needed to deliver and secure the pages.
Email links open your email app. Information is sent to NorthShutter only when you send your message. External websites handle information under their own policies.
When our data practices change, we will update this notice and its date.