Last updated: October 15, 2026
The local-library, Feedback and diagnostic descriptions below cover Arrow R1 (version 1.1.0). Connected-export sections describe versions of Arrow 1.1.1 that offer those optional connections; availability can vary by version, account and pilot access. Earlier public versions may differ; the data disclosures also cover the older Feedback form described below.
Arrow stores your Arrow photo library locally on your device. We do not run a cloud photo library or require an account to use Arrow. Your photos are not included in our analytics, crash reports or in-app Feedback submissions. You can choose to share or export photos to destinations you select.
Save Location is optional. Initial setup can request location permission after Camera permission; declining location still allows capture. When Save Location is enabled and location access is allowed, Arrow can save available coordinates with new photos. Apple’s location services may turn coordinates into a place label. These photo-location details stay in Arrow’s local library during normal capture. You can use the camera without granting location. Precise location is included in our App Store privacy disclosure because the older Feedback form can send recent coordinates when disclosed in that form. Separately, our analytics and diagnostic services process IP addresses and may derive approximate location, as described below; this does not depend on permission to save GPS coordinates with photos.
Arrow attempts to remove embedded GPS metadata from image copies prepared for sharing or export. If that conversion fails, it may use the original image data, which can retain GPS metadata. Do not rely on Arrow exports to guarantee removal of location or other metadata.
Connecting Dropbox, Google Drive, OneDrive or Notion is optional. Arrow sends the photo copies and export metadata you choose to that provider. Photo content travels directly from your device to the selected provider; it is not uploaded to Arrow's Cloudflare authentication service or Supabase Feedback service as part of connected export. Providers process the copies under their own terms and privacy policies. Exported copies remain there when you disconnect, delete a photo in Arrow or uninstall the app.
Arrow keeps access and refresh credentials in a nonsynchronized, device-only Keychain, separate from its shared photo database. Local records retain account/destination identity, chosen defaults, export options, delivery evidence and unfinished status. During unresolved cleanup, a blocked credential or recovery handle may remain in the Keychain until cleanup is resolved; it cannot be used for ordinary exports. Disconnect does not erase all local or server security/history records.
Arrow requests account identity, file-metadata read and file-content write permissions. It uses account/root information to bind the intended account, metadata to browse and verify destinations, and write access to create and verify exported copies in the top level or chosen accessible folder. Arrow does not request file-content read for importing your Dropbox library. The permission applies within the content boundary authorized by Dropbox; the folder you choose for one export is not itself a reduction of that grant. Arrow does not synchronize later photo edits or deletions with Dropbox.
Arrow requests drive.file access to create and work with files associated with the app, rather than requesting access to your entire Drive. It reads your Drive account identifier and available display name or email address to identify the connected destination. It creates photo copies in My Drive and checks the exported files. Sign-in, token exchange and photo transfer take place between your device and Google.
Google account and Drive data are used to provide the connection and export features you choose. We do not use that data for advertising, sell it, or use it to train general-purpose AI models. Arrow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google processes the data it receives under its Privacy Policy.
Microsoft's delegated Files.ReadWrite and offline-access permissions allow broader file access and continued connection than Arrow's export feature uses. Arrow uses its connector to identify the account, create new copies at the top of My files and verify delivery. It does not offer shared-library, SharePoint or arbitrary-folder browsing. Photo transfer and token exchange take place between your device and Microsoft.
Notion requires authorization to pages made available to the connection. Arrow currently offers ordinary and nested page destinations; eligibility in Arrow does not guarantee that Notion will allow every append operation.
Arrow uses Cloudflare Workers and a Cloudflare Durable Object database to authenticate the Notion connection, exchange authorization codes, refresh or revoke submitted tokens and enforce installation admission and replay protection. Authorization codes and access/refresh tokens therefore pass through this service during those operations; they are not kept exclusively on the device. The broker's durable connection records store token digests rather than raw access or refresh tokens. Short-lived authorization codes awaiting redemption are stored encrypted and cleared when consumed, cancelled or handled by expiry cleanup. Cleanup is scheduled and bounded, not a promise of immediate wall-clock deletion during interruption.
Server security records include a persistent installation identifier and public signing key, admission and App Attest public-key/counter information where applicable, Notion workspace/bot/owner identifiers, connection generations, token/permission digests and authentication/disconnection outcomes. These records can link activity to the same installation and Notion identity. They are retained to enforce access, prevent replay and recover safely; disconnect does not automatically delete them all. This service receives network metadata needed to handle requests and uses source-derived keyed digests for abuse limits. Application logs/traces are disabled in the reviewed deployment; this is not a guarantee that Cloudflare, Apple or Notion retains no platform or network metadata. Photo upload bytes go directly from Arrow to Notion.
Supabase continues to host Arrow's Feedback/support service described elsewhere in this policy. It is separate from the current Cloudflare Notion authentication service. Earlier Notion endpoints are disabled for current authentication rather than forwarding it through Supabase.
Disconnect blocks new use in Arrow and stops cancellable unsent work. A copy already being sent may finish; an unconfirmed outcome can still correspond to a copy at the destination. No automatic resend is implied by opening activity or trying to finish account cleanup.
Dropbox disconnect requests revocation of the corresponding token authorization. Google disconnect revokes this user's Arrow Google-project authorization and can affect other devices/clients using that authorization. Notion disconnect disables the exact Arrow broker grant and requests revocation of the submitted token; it does not guarantee every workspace token or browser session has been removed. OneDrive disconnect removes Arrow's local credential on this device; Microsoft's permission remains unless removed separately.
A failed or lost response remains unconfirmed and can require provider permission removal and scoped support recovery. Arrow distinguishes that manual recovery from a provider-confirmed response. A fresh Connect after completed cleanup starts a new authorization/account-choice session; it does not promise browser sign-out or password entry.
Provider policies: Dropbox, Google, Microsoft, Notion, Cloudflare. Existing Supabase, analytics, diagnostics and Feedback disclosures remain applicable.
The Settings form described below is the R1 (1.1.0) form. Earlier public versions can expose the older form described afterward.
The current Settings Feedback form sends your message, chosen reason, app version/build, device model, operating-system version and screen context to our Feedback service hosted by Supabase. Get help requires a contact email so we can reply; email is optional for other reasons. Your message and any supplied contact email are stored together. This Settings form does not attach your photos, audio or photo-location coordinates, and its payload does not contain the legacy installation/session identifiers described below.
If your library contains Older Stash items, you may also see the older Feedback form. It accepts text, an optional voice note and an optional reply email. When its location conditions are met, the form tells you that recent location context may be included. Those submissions include a persistent installation identifier and a session identifier alongside app/device context. Voice-note storage paths also identify the installation. This can link submissions and their optional content to the same installation or supplied contact details.
We use PostHog to understand app use, including feature interactions, screens, lifecycle/session activity and usage counts or duration information. Events use a persistent, randomly generated installation identifier. At our September 16, 2026 configuration review, PostHog’s app project allowed client IP retention and had geographic enrichment enabled. This can add approximate location derived from IP addresses. These records can be associated with the same installation; we do not describe them as anonymous.
Arrow’s analytics event payloads do not include your photo content, photo filenames, raw Feedback messages, voice recordings, contact email or saved photo GPS coordinates. IP-derived approximate location is separate from those saved photo coordinates.
We use Sentry for crash reports, errors, session health and technical performance diagnostics such as memory and app-hang information. Diagnostic information includes app/operating-system/device context, and session reports include a persistent installation identifier. The app removes event user and request context before sending events. Session reports still include an identifier that can connect reports from the same installation. At our September 16, 2026 configuration review, the Sentry project and organization did not enable prevention of IP-address storage. Diagnostic processing may also derive approximate location. We therefore treat these diagnostic records as linked data rather than promising that they are anonymous. Photos are not attached to this reporting.
We use PostHog to count homepage visits and clicks on the App Store download button. The website sends the event type and a temporary identifier for the current page. It does not reuse a previously stored analytics identity for these events. It is configured not to record sessions, console messages, heatmaps, automatic interactions or performance measurements, and does not include URL query parameters or campaign fields in these events. PostHog receives network information needed to process requests. Website measurement does not access photos stored inside Arrow.
PostHog receives usage analytics, installation identifiers and IP-derived context to help us understand and improve Arrow. Sentry receives the diagnostic information described above to maintain app reliability. Supabase stores Feedback and support submissions. Cloudflare processes the Notion authentication and security information described above. Apple provides optional location/place-label services. Feedback alerts sent through Telegram contain a submission reference, category, severity, whether contact details were supplied, source and an instruction to look up the submission. They do not include the message, email, audio, photo or precise location.
These are the uses covered by this policy. Persistent identifiers and supplied contact details can link records to an installation or person. We do not use the described data for advertising tracking. This statement concerns Arrow’s configured use, rather than a guarantee about every service provider’s unrelated activities.
Deleting or uninstalling Arrow affects locally stored app data; it does not automatically delete information already submitted to our Feedback, analytics or diagnostic services. Copies you shared or exported remain wherever you sent or saved them. Contact support@tryarrow.app with questions about information you submitted or a deletion request. Do not send passwords, payment details or unrelated sensitive information with that request.
Camera access is required to capture photos. During initial setup, Continue starts the Camera permission request and then the optional Location request. You can decline Location in the iOS dialog and continue using the camera. Save Location can be changed later in Arrow Settings, and location access can be revoked in iOS Settings. Microphone access is optional and is used only if you record a voice note in the older Feedback form. Saving an export to Camera Roll can request permission to add photos to your photo library.
Deleting a photo moves it to Recently Deleted. Auto Delete moves scheduled photos there when Arrow next refreshes. You can restore a photo while it remains available or choose Delete Permanently to remove it from Arrow. Arrow does not guarantee automatic permanent removal when the displayed recovery window ends. These controls do not remove previously shared or exported copies.
PostHog, Sentry and Supabase. Telegram handles the limited alert metadata described above; see its privacy policy.
Arrow is not directed to children under 13. The same local-photo storage, optional permission, and optional feedback-submission rules described in this policy apply to every user.
We may update this policy from time to time. Changes will be reflected by updating the Last updated date.
Questions about this privacy policy or information we control? Contact support@tryarrow.app.
Arrow — A second camera for practical photos.