Privacy Policy

The operator identified in the operator details below is the controller of the personal data described here. This policy covers the ARN AUTH website, dashboards, public validation API, and support conversations. It does not cover software, sites, or services run by developers or sellers.

If you are a developer or seller, you are responsible for your own privacy notices and for the personal data you collect from your customers. ARN AUTH processes the account and licence data described here to provide the service.

• Account data: Clerk user ID, name, email address, profile image URL, account type, admin status, sign-in timestamps, and legal-acceptance records.
• Application data: app names, descriptions, public IDs, hashed API keys, download/version links, limits, plans, and configuration you enter.
• Licence and device data: licence-key hashes and previews, plan, duration, expiry, disabled/paused state, notes, seller association, device-limit counts, peppered hardware-ID hashes, binding timestamps, and validation timestamps.
• Seller and profile data: membership status, email, assigned key profiles, per-profile limits, and key-creation counts. We do not collect card or bank credentials.
• Technical and security data: peppered IP hashes, request timestamps, validation status codes, rate-limit counters, and audit records for owner actions.
• Support data: messages and payment references you choose to send us, including through Telegram.
• Payment data: when you buy Pro, Razorpay processes your payment credentials and returns a payment reference, status, amount, and term to us. ARN AUTH does not receive or store your full card number, CVV, or UPI credentials.

We do not ask for or store raw hardware identifiers or raw IP addresses within your dashboard. The validation service applies a secure, high-entropy cryptographic pepper and salt routine to perform token validation matching and prevent programmatic platform abuse. While these one-way cryptographic hashes are treated with standard personal data protocols where re-identification vectors persist, they prevent the exposure of raw user telemetry metrics.

• Provide the service and perform our contract:create accounts, issue keys, bind devices, validate licences, operate seller profiles and key limits, and provide support.
• Legitimate interests: secure the service, prevent fraud and abuse, enforce limits, debug failures, and maintain service integrity. We balance these interests against your rights.
• Legal obligations: keep records required by tax, consumer, or data-protection law, and respond to valid legal requests.
• Consent: where we ask for it, including optional communications or a legal acceptance that requires consent. You may withdraw consent at any time without affecting prior lawful processing.

We do not use your data for behavioural advertising, sell it, or share it for cross-context behavioural advertising. We do not make decisions with legal or similarly significant effects solely by automated means.

The site uses essential cookies and local storage from Clerk for authentication and session security, and may use a theme or interface preference. We do not currently run third-party advertising cookies. If we add non-essential cookies, we will provide notice and consent where required.

We share data only as needed to run ARN AUTH, with:

• Clerk for authentication and account management;
• Convex for the hosted database, functions, and validation API;
• Hosting and infrastructure providers that serve the website and protect it from abuse;
• Razorpay to process Pro payments and payment status. Razorpay handles payment credentials under its own terms and privacy policy;
• Telegram if you choose to contact us there; Telegram processes that conversation under its own terms and privacy policy;
• Professional advisers, auditors, or authoritieswhen required by law or needed to establish, exercise, or defend a legal claim; and
• A successor operator in a merger, acquisition, or transfer of the service, subject to appropriate safeguards.

Developers and sellers may see the data their role permits inside the service. Sellers see only their own keys and profile allowances. Developers see the keys and seller records for their applications. We do not give one customer access to another customer's private application data.

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses or an adequacy mechanism, and we take steps required by applicable law. You can ask us for more information about the safeguards using the privacy contact below.

• Account and application data: while your account is open. After a verified deletion request, it is removed by the hard-deletion cascade, subject to the exceptions below.
• Licence validation and security logs: normally up to 30 days, then pruned. Short-lived rate-limit counters are removed when their window expires.
• Audit records: while needed to protect the service and meet legal obligations; deleted with the account unless a legal hold applies.
• Backups: residual copies may remain in encrypted backups for a limited period, typically no more than 30 days, before rotation.
• Legal holds: we may retain specific records longer if required by law, a court, a regulator, or to establish, exercise, or defend legal claims. We limit that retention to what is needed.

We use server-side authorization, hashed API and licence keys, keyed hashes for hardware and IP data, environment-managed secrets, access controls, and rate limits. No system is completely secure. You are responsible for protecting your own credentials and for telling us promptly about suspected compromise. We may suspend validation while investigating a credible security threat.

Depending on where you live, you may have the right to access a copy of your personal data, correct inaccurate data, delete your account and data (subject to legal exceptions), restrict or object to certain processing, withdraw consent where processing is based on consent, receive portable data in a machine-readable format where required, complain to a data-protection authority, and not be discriminated against for exercising a privacy right.

To exercise a right, email the privacy contact below. We may need to verify your identity and account. We will respond within the period required by law. You can also use the account deletion control in Settings for immediate deletion. An authorised agent may submit a request with proof of authority.

EEA and UK (GDPR / UK GDPR). Where the GDPR or UK GDPR applies, we process account, licence, security, and support data to perform our contract, pursue legitimate interests in securing and operating the service, comply with legal obligations, and, where required, on consent. You may object to legitimate-interest processing, request restriction, request portability, or lodge a complaint with your local supervisory authority. We do not carry out solely automated decision-making with legal or similarly significant effects. In compliance with cross-border mandates, international privacy inquiries originating from the EEA or United Kingdom may be directed directly to our central processing registry via privacy@arnislive.com, where our operator infrastructure reviews and handles individual compliance obligations.

California (CCPA/CPRA). We collect the categories described in section 2 for the business purposes described in section 3. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not knowingly sell or share the personal information of consumers under 16. California residents may request to know, access, correct, or delete personal information, may use an authorised agent with proof of authority, and may not be discriminated against for exercising a privacy right. We do not offer financial incentives for personal information. To appeal a refusal, reply to the refusal email and we will review it.

India (DPDP Act and consumer law). You may request access, correction, erasure, and grievance redressal through the privacy or grievance contact below. Where processing is based on consent, you may withdraw it at any time. Upon a verified withdrawal of consent, we will cease processing your data and execute a hard-deletion cascade across our infrastructure pipelines within the statutory ceiling limits, unless retention is strictly required to comply with an absolute legal duty or tax verification law. Our Grievance Officer will acknowledge complaints within 48 hours and resolve them within one month of receipt.

We do not use dark patterns to obtain consent. If we introduce optional marketing, we will provide a separate choice and an easy opt-out. Exercising a privacy right will not cause us to close an account unless the data is necessary to provide the service and no lawful alternative exists; in that case we will explain the effect.

ARN AUTH is for people who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will take appropriate steps to delete the data.

We do not currently respond to browser Do Not Track signals because there is no common standard, but we do not run behavioural advertising on this site. The service may link to third-party sites, including Telegram. Their privacy practices are governed by their own policies.

We may update this policy to reflect changes in the service or law. The effective date below will change. Material changes will receive reasonable notice where required.

Privacy questions and requests can be sent to the privacy contact in the operator details. Legal and customer-care questions can use the same details. See also the Terms of Service and Acceptable Use Policy.