What ARCY collects

ARCY runs inside your product. ARCY AI is currently offered as a BETA product; this page explains what we collect during normal SDK operation, what we never access, and how data is retained, as things stand today.

This is a technical explainer, not the legal Privacy Policy. For the binding document, including your rights over your data (access, correction, deletion, restriction, portability, and objection) and our Children's Privacy stance, see arcyai.com/privacy.

Session events

When the ARCY SDK is installed, it collects the following per user session:

• Session start and end timestamps
• The active route when a session begins
• Autocapture events: clicks, form submits, and navigation, described structurally (element id, class names, aria-label, visible text, position in the page) so ARCY can learn what's on your pages and build a working knowledge graph without you annotating your source code. See Element Targeting for what this is used for.
• Guided flow progress (which steps were started, completed, or skipped)
• userId and role, if you pass them to ARCYProvider
• Conversation text when a user talks to Chat, Copilot, or Autopilot, so the assistant can hold context across a session and so you can review conversation history

Turning off message-content storage: You control whether ARCY stores the text your users type into the widget. In your app settings, under Data privacy, turn off "Store message content." When it is off, ARCY keeps only usage metadata for each conversation (which mode was used, which page, and timing) and never stores the message text or the assistant's reply. This is on by default so conversation history and insights work out of the box.

Masking, before anything leaves the browser: input and hidden field values, and anything matching an email, SSN, or card-number pattern, are masked client-side before an autocapture event is ever sent. What ARCY receives is the shape of an interaction (what kind of element, roughly where, what it's labeled), not the values your end users typed.

Raw autocapture events are kept in short-term storage (14 to 30 days) and then rolled up into aggregated confidence statistics; the raw events are dropped after that rollup.

What we do not collect: email addresses, passwords, or form field values you have not explicitly passed to us as a trait.

See What arcy init and arcy analyze read and send for what the CLI itself scans and transmits during setup.