What we hold, and what we never do.

Document storage and optional text processing

Document files — passport scans, admission and visa documents, financial statements — are encrypted on your device with AES-256-GCM. The mobile vault stores these files locally; account sync carries document metadata rather than files or document numbers. On-device OCR reads a scan locally. Optional cloud document-text analysis is a separate feature, described below.

The web app holds document metadata only: the label you gave a document, its issue and expiry dates, and the reminder offsets you chose. That metadata is stored in your browser's local storage on this device.

What the account stores

An account exists so your checklist progress, budget entries, and profile can sync between your devices. It holds your email address, your display name if you gave one, and that synced state.

It does not hold document files, document numbers, or the contents of any question you ask the advisor.

AI processing

Cloud AI features use structured planning context, such as your destination, visa type, arrival date, checklist progress, document categories, and budget summaries. Questions and search text are screened and redacted before provider processing. These requests do not include vault files or your billing account ID.

Optional document-text analysis asks you to review a redacted text preview and confirm before sending it to the cloud. Redaction can miss identifying information: check the preview and remove sensitive details yourself. Cancelling this confirmation sends no document text. The original scan remains local.

Production cloud AI, including document-text analysis, remains release-gated pending privacy approval and provider configuration. Prototype or test access is not approval to send real immigration paperwork. This page does not promise a provider retention period or training policy that has not been approved for production.

Purchases and RevenueCat

Mobile purchases use Apple App Store or Google Play billing and RevenueCat to reconcile purchase access. Arrival supplies your numeric Arrival account ID as RevenueCat’s app user ID. This identifier links purchase status to your account; it is not an anonymous identifier. Arrival does not supply your email, profile name, vault files, or document text to RevenueCat through this billing integration.

The store and RevenueCat process purchase and receipt or transaction information, product identifiers, and subscription status to support the one-time unlock and restores, and reconcile any historical recurring subscriptions. Arrival’s backend checks RevenueCat for the account’s entitlement and records the associated plan, subscription status, and period end. Successful AI usage is counted against that account’s allowance.

For billing abuse prevention and AI cost accountability, Arrival retains a hashed purchase or license identifier and aggregate AI usage counters even after account deletion. This ledger does not retain raw store receipts, transaction identifiers, document contents, or prompts. The hash is not a promise of complete anonymity or deletion of all billing-related data. Usage follows the verified license across legitimate transfers, so deleting an account, restoring, or repurchasing does not refill credits. The retention policy still requires production privacy review.

Automatic device identifier collection is disabled in Arrival’s RevenueCat configuration. This does not mean third-party services collect no connection information or diagnostics. Their own privacy notices describe their processing. The new whole-app unlock is non-consumable and does not renew. Deleting an Arrival account does not establish deletion of the store’s or RevenueCat’s records, or cancel any historical recurring store subscription.

What we log

Standard operational records: request timing, error rates, and authentication events tied to your account ID. We do not log document numbers, decrypted file paths, raw support message bodies, or the text of immigration questions.

Deleting your account

Deleting your account removes the account record, synced state, account-owned AI usage, links, and reservations. Local vault files must be removed from the device. Any optional cloud text processing and store billing records are separate from that local vault storage.

Third parties

Arrival uses infrastructure providers for hosting and database services, app stores and RevenueCat for billing, and configured model providers for approved cloud AI processing. It does not sell personal data, does not run advertising, and does not share your data with data brokers.