Arch LunchboxPrivacy Policy
Arch Lunchbox (“we,” “us,” or “our”) is a study system and tutoring service for the ARE® 5.0 exam, operated by Brian Rohrlick. This policy explains what information we collect when you use arelunchbox.com and the study app, how we use it, and the choices you have.
By using the site, creating an account, or subscribing, you agree to the practices described here.
1. Information we collect
We try to collect only what we need to run the service:
Account information
When you create an account, our authentication provider (Supabase) stores your email address and, if you provide it, your name. Passwords are hashed by Supabase; we never see or store your plain-text password. If you sign in with a third-party provider (such as Google), we receive your email address and basic profile information from that provider.
Payment information
Subscriptions and tutoring are billed through Stripe. Stripe collects and processes your card details directly; we do not receive or store your full card number. We keep a Stripe customer/subscription reference and your subscription status so we can unlock and manage your access.
Study data
When you are signed in, your study progress (confidence ratings, flagged modules, personal notes, and quiz history) is saved to your account in our database (Supabase) so it syncs across your devices. Your account’s study data is protected by row-level security, meaning it is readable only by you when signed in; we access it only as needed to operate the service. A copy is also cached in your browser’s local storage so the app stays fast, and the export/backup tools let you download your own copy at any time.
Communications
If you email us or use a contact form, we receive the information you send (such as your name, email, and message) so we can reply.
Technical information
Like most websites, our hosting provider may automatically log basic technical data (such as IP address, browser type, and pages requested) for security and reliability. We do not use third-party advertising or cross-site tracking.
2. How we use it
- To create and maintain your account and unlock the modules you’ve paid for.
- To process payments, renewals, and cancellations through Stripe.
- To provide, support, and improve the study system and tutoring.
- To respond to your questions and send service-related messages (for example, account or billing notices).
- To keep the service secure and prevent abuse.
3. Who we share it with
We do not sell your personal information. We share it only with service providers that help us operate, and only as needed:
- Supabase: account authentication and database.
- Stripe: payment processing and subscription management.
- Cloudflare: website hosting and delivery.
- Google Fonts: serves the fonts used on the site; your browser requests them from Google when a page loads.
We may also disclose information if required by law, or to protect our rights, users, or the security of the service.
4. Cookies & local storage
We use a small number of browser storage mechanisms, none of them for advertising:
- Login session: a cookie/token that keeps you signed in.
- Study progress cache: a local copy of your ratings, flags, and notes in your browser’s local storage, so the app loads instantly; the master copy lives in your account.
- Preferences: small settings such as your light/dark theme choice.
You can clear this data at any time through your browser settings. Clearing it will sign you out and remove locally-cached study progress from that device; progress saved to your account is restored the next time you sign in.
5. Data retention
We keep your account and billing records for as long as your account is active and as needed to provide the service, comply with legal or tax obligations, and resolve disputes. Study data saved to your account is kept so you can pick up where you left off, even if you cancel and later re-subscribe. You can ask us to delete your account information, including your study data, at any time (see below); the local cache in your browser is removed when you clear your browser storage.
6. Your choices & rights
You can:
- Access or update your account information from your account settings.
- Cancel your subscription at any time from your dashboard or the Stripe customer portal.
- Request a copy of, correction to, or deletion of the personal information we hold about you.
- Export a copy of your study data with the in-app Export tool, and clear the locally-cached copy through your browser, at any time.
Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA/CPRA. To exercise any of these, email us at info@archlunchbox.com and we’ll respond within a reasonable time.
7. Security
We rely on reputable providers (Supabase, Stripe, Cloudflare) and take reasonable measures to protect your information. No method of transmission or storage is completely secure, however, so we can’t guarantee absolute security. Please use a strong, unique password and keep your login credentials confidential.
8. Children
The service is intended for adults preparing for professional licensure and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we’ll delete it.
9. Changes to this policy
We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above, and for material changes we’ll take reasonable steps to let you know. Your continued use of the service after an update means you accept the revised policy.
10. Contact us
Questions about this policy or your information? Email info@archlunchbox.com or use the contact page.