ArrowPoint is an app for identifying, cataloguing and sharing Native American artifacts such as arrowheads. This policy explains, in plain language, what information the app collects, why, who helps us process it, and the choices you have. It covers the ArrowPoint app on iPhone and Android.
The short version
- We collect what you give us: your email, your profile, your finds and photos, and what you post.
- We do not use your phone's GPS. Location is only the state and county you choose to type in.
- We do not show ads, sell your data, or track you across other apps or websites.
- Smart ID photos are sent to our own identification model to get a result. They are not stored by that service.
- Removing a photo's background happens on your phone. That photo is not uploaded for it.
- Your vault is private unless you choose to post a find. You can delete your account in the app at any time.
1. Information we collect
1.1 Account
- Email address, used to sign in (with a password or a one-time code we email you) and to recover your account.
- Password, if you set one. It is stored only in hashed form by our sign-in provider. We can never see it.
- Username and optional profile details you add: name, bio, profile photo, state and county.
- If sign-in with Apple or Google is offered and you choose it, we receive the account identifier and email address that Apple or Google shares with us.
1.2 Your collection and what you share
- Finds in your vault: photos, type, material, measurements, notes, the date found, and the state and county if you add them. Frames (groups of finds) and their layouts.
- Verification requests: if you ask us to verify a find, the photo of its certificate of authenticity, the certificate number and the authenticator's name.
- Posts, comments, likes, follows and mentions when you use the community features.
- Reports and blocks you make, and requests you send us to correct Library information.
- Giveaway entries, when a giveaway is running: that you entered and that you confirmed you are eligible.
1.3 Location
- The app never reads your phone's GPS and does not ask for location permission.
- Location means only the state and county you choose for a find, a post or your profile.
- When you post a find you choose whether the state and the county are shown. If you hide them, they are removed from the post on our servers, not just hidden on screen.
1.4 Photos
- Photos you add are cropped and re-saved inside the app before upload. This removes the hidden details cameras embed in a photo file (such as GPS coordinates, camera model and capture time).
- Library photos are chosen through your phone's own photo picker, so the app never gets access to your whole photo library. The camera is used only when you take a photo in the app.
- Smart ID: the photo you identify is sent to our identification model to get matches. Only the image is sent: no name, email, account ID or location. The photo is not saved by that service. Your recent identifications are kept only on your phone.
- Remove background: done entirely on your phone (Apple's or Google's on-device technology). The photo is not uploaded for it.
1.5 How you use the app
- App activity: which screens and posts you view, searches, likes and similar actions, a session identifier, and your platform and OS version. This is stored in our own database, not with an advertising or analytics company. We use it to understand which features work and to fix problems.
- Last seen: at most once every few hours we record the time, your app version and whether you are on iPhone or Android, so we know which versions are still in use.
- Crash and error reports: technical details about a crash or error (what went wrong, device model, OS and app version, and a trail of recent technical events in the app). We do not attach your name or email to these reports, do not record your screen, and do not take screenshots.
- Push notifications: if you allow them, a notification token for your device, along with its brand, model and OS version.
1.6 Purchases
- Subscriptions and purchases are handled by Apple's App Store or Google Play. We never receive or store your card or bank details.
- We receive your plan status (for example Pro, active or expired) and the product you bought, linked to your ArrowPoint account ID.
1.7 Stored on your phone
To keep you signed in and make the app fast and usable offline, the app stores on your device: your sign-in session, a cache of content you have viewed, your preferences, your recent Smart IDs and their photos, and any finds waiting to upload while you are offline. Signing out clears your session and the content cache. Deleting the app removes everything stored on the device.
2. How we use information
- To run the app: sign you in, store and show your collection, identify artifacts, run the community features and send the notifications you allow.
- To apply plan limits and unlock what your plan includes.
- To keep the community safe: review reports, remove content that breaks our Terms of Service, and act against abusive accounts.
- To fix bugs, measure performance and decide what to improve.
- To answer you when you contact support.
We do not use your information for advertising, and we do not use your photos or collection to build advertising profiles.
3. What other people can see
- Your vault is private. Finds, frames, notes and your personal finds map are visible only to you, unless you post a find.
- Public when you post: the post's photos, title and description, the artifact type and length, and the state and county only if you chose to show them. Your comments and likes are visible on the posts you interact with.
- Public profile: your username, name, bio and profile photo, the posts you have shared, your follower and following counts, a plan badge (such as Pro or Premium) and a Verified badge on verified finds.
- The community map shows only counts of public posts per state and county. It never shows who posted, never uses private vault finds, and never shows a precise location.
- Your email address is never shown to other users. Within ArrowPoint, only the app's owner can see account email addresses; moderators cannot.
- Sharing a find outside the app uses your phone's share sheet. What is shared, and with whom, is up to you and the app you pick.
- A note on photo links: uploaded photos are stored at long, hard-to-guess web addresses rather than behind a password. Private finds are never listed or linked anywhere publicly, but anyone you give a photo's direct link to can open it.
4. Companies that help us run ArrowPoint
We share information only with the service providers below, only so they can provide their service to us. We do not sell personal information, and we do not share it for advertising.
| Provider | What it does | What it receives |
|---|
| Supabase | Database, sign-in and server functions | Your account, profile, collection details, community activity, app activity, notification token and plan status |
| Cloudflare (R2 storage) | Stores uploaded photos | Photos of finds, profile photos, frame covers and certificate photos |
| Google Cloud | Runs ArrowPoint's own Smart ID model | Only the photo being identified. It is processed and not stored. |
| RevenueCat | Keeps subscription status in sync with the app stores | Your ArrowPoint account ID and purchase information from Apple or Google. Not your email. |
| Apple and Google | App stores, payments and delivery of push notifications | Purchase details (handled by them directly) and notification delivery |
| Sentry | Crash and error reporting | Technical crash details, device and app version. No name or email. |
| Expo | Sends push notifications and delivers app updates | Your notification token and the notification's content; basic device and app version details when checking for an update |
| Resend | Delivers sign-in and password emails | Your email address and the email's content (for example a sign-in code) |
We may also disclose information if the law requires it, or to protect the safety and rights of our users, the public or ArrowPoint.
5. Safety: reporting and blocking
- You can report any post or comment from its menu, and report a user from their profile. Reporting a user opens an email to our support address with that account's ID filled in.
- You can block any user from their profile, post or comment. Their posts, comments and notifications are then hidden from you.
- We review reports promptly, remove content that breaks our Terms, and may suspend or ban accounts. We keep records of reports and moderation decisions for as long as needed to keep the community safe and to handle appeals and legal requirements.
6. Keeping and deleting your information
- We keep your information while your account exists. You can edit or delete individual finds, frames, posts and comments at any time.
- Deleting your account (Settings, then Delete account) takes effect immediately and cannot be undone. It removes your account, profile, finds, frames, posts, comments, likes, follows, blocks, notifications and notification tokens from our database. App activity records are kept but are no longer linked to you.
- Uploaded photos are not removed automatically at the moment of deletion and may remain in our storage for a while afterwards. If you want them removed right away, email us from your account's email address and we will delete them.
- Routine database backups are kept for a limited time and are then overwritten.
- Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play account settings.
- If you cannot use the app, you can request deletion here: cole-latt.github.io/arrowpoint-privacy/deletion.html.
7. Your choices and rights
- See and correct your information in the app at any time.
- Get a copy of your data: email us and we will send it in a common, readable format.
- Delete your content or your whole account (section 6).
- Notifications: turn them on or off in your phone's settings or in the app.
- Location: always optional. Leave state and county blank, or hide them when you post.
Depending on where you live (for example California, the European Economic Area or the United Kingdom) you may have additional legal rights, such as the right to know what we hold, to have it corrected or deleted, to object to or restrict certain uses, and to complain to your local data protection authority. We do not sell personal information, and we will not treat you differently for using your rights. To make a request, email support@arrowpoint.app from the address on your account.
8. Security
Information is encrypted in transit (HTTPS). Database access is restricted by per-user rules so that each account can read and change only what it should. Staff access is limited by role. No system is perfectly secure, so please use a strong, unique password.
9. Children
ArrowPoint is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, email us and we will delete it.
10. Where information is processed
ArrowPoint is operated from the United States, and our providers process information in the United States and other countries where they operate. By using the app you understand that your information will be processed there.
11. Tracking
ArrowPoint does not use advertising identifiers, does not track you across other companies' apps or websites, and contains no advertising or third-party analytics software.
12. Changes to this policy
If we make meaningful changes we will update the date at the top and tell you in the app. The current version is always at this address.