Creating your account: privacy notice and terms

Last updated: November 3, 2026

This notice supplements our Privacy Policy and Terms of Service. Anything not explained here is governed by those documents. The controller is Angel De Leon, as an individual, in Mission, Texas, United States. Write to us at hola@heyamadeus.tech.

This text has not yet been reviewed by a lawyer.

1. How an account is created today

• Accounts are created only inside the Arpeo app, on the "Create account" screen. You must be 18 or older and accept this notice, the Privacy Policy and the Terms.
• Today the only active method is a passkey from your device or password manager. There is no password: your device keeps the private key and we keep only the public part, which lets us check it is you.
• Other methods (email and password, email link, Google, Apple, phone and Telegram) show as "Soon" and are not active. Before turning any of them on, we will update this notice.
• Telegram never creates accounts: it can only be linked to an existing account, with a one-time code.

2. What we store

In our database, on Oracle Cloud, United States (Chicago region):

• The name you type (up to 80 characters) and your time zone and language.
• Your email, if you type one (it is optional). It is stored as unverified: we send nothing to it and it is not used to sign in. If someone else later proves that mailbox is theirs, the email is removed from your account, so nobody can hold someone else's address.
• Your passkey's public key and its identifier.
• A security record of the sign-up: the method ("passkey") and a fragment of a secret-keyed hash of your IP address. We do not store your IP address in clear.

3. Anti-abuse controls

• We reject disposable email services (using a public, local list; no third party is queried) and domains that cannot receive mail (we check their DNS MX record).
• Sign-ups are limited: 3 per day per IP address and 30 per hour overall. Past that, you will see a notice and can try later.
• The disposable list also applies everywhere else in the app where you type an email (for example, inviting a friend or sharing a memory).

4. Providers

Creating an account sends your data to no outside provider, AI or otherwise (and never to NVIDIA). The MX check only looks up the domain name in DNS.

5. Your choices

You can change your name, export your data or close your account from Settings, as the Privacy Policy explains.