Legal

Privacy Policy

Last updated: May 19, 2026

This Privacy Policy explains how Gino Fontana, doing business as Studio GinoFtn (the Operator), collects, uses and protects personal data through getark.dev and the ark-pm CLI (together, the Service). We aim to collect as little as possible and to keep what we collect for as long as we need it.

1. Who is the data controller?

Studio GinoFtn (Gino Fontana, sole proprietor), based in Saint-Martin, French Caribbean, is the data controller. As a French overseas collectivity, the GDPR (Regulation EU 2016/679) applies.

2. What we collect

Account data: email address, optional display name, optional slug, bio, website and Twitter handle (the latter four are shown on your public creator profile if you fill them in).
Authentication data: GitHub user ID and email (if you sign in via GitHub), magic-link tokens (short-lived), session cookies, and CLI tokens you generate yourself.
Payment data: Stripe customer ID, subscription status, package purchases and Connect account ID. We do not store full card numbers — Stripe does.
Usage data: packages you install, publish, react to, or review. Aggregated download counts are public per package.
Server logs: IP address, user-agent and request paths (kept briefly by our hosting provider for security and debugging).

3. Why we use it (legal basis)

Contract: running your account, processing payments, paying creators.
Legitimate interest: securing the Service, preventing abuse, fixing bugs.
Legal obligation: tax and accounting records linked to payments.
Consent: optional product emails (you can opt out at any time).

4. Who we share data with (sub-processors)

Stripe — payments, subscriptions, Connect payouts (US/EU).
Vercel — site hosting, edge network, server logs (US/EU).
Neon — Postgres database (US-East region).
Resend — transactional and magic-link emails (US).
GitHub — optional OAuth sign-in (US).
npm (Inc., GitHub): hosts the ark-pm package itself (CLI distribution only).

We do not sell your data, do not run third-party advertising, and do not use third-party analytics or trackers on getark.dev.

5. International transfers

Some sub-processors are located in the United States. Transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses where applicable.

6. Cookies and local storage

We use a small number of strictly necessary cookies and storage items, no analytics, no advertising cookies:

session cookie — keeps you signed in (HTTP-only, secure).
ark-theme localStorage — remembers your light/dark preference.
Stripe sets its own cookies during checkout; see Stripe’s privacy policy.

7. How long we keep it

Account data: as long as your account is active, then up to 30 days after deletion (anonymized backups may persist longer).
Payment records: 10 years (French accounting law).
Magic-link tokens: 15 minutes.
CLI tokens: until you revoke them.
Server logs: 30 days.

8. Your rights (GDPR)

You can at any time:

access the personal data we hold about you;
rectify inaccurate data (most of it is editable in your dashboard);
erase your data (account deletion);
restrict or object to certain processing;
request portability of your data in a machine-readable format;
withdraw consent for optional emails;
lodge a complaint with the French data-protection authority, CNIL.

To exercise any of these rights, email legal@getark.dev. We respond within 30 days.

9. Security

We use HTTPS everywhere, hashed CLI tokens, HTTP-only secure session cookies, and delegate sensitive payment handling to Stripe. No system is perfectly secure; in the event of a breach affecting your data, we will notify you and the CNIL as required by the GDPR.

10. Children

The Service is not directed to children under 16. We do not knowingly collect data from anyone under 16.

11. Changes

We may update this Policy as the Service evolves. The “Last updated” date at the top reflects the latest version. Material changes will be announced on the home page or by email.

12. Contact

Questions, requests, complaints? Email legal@getark.dev.

Ark lives
on the desktop.

Ark

Privacy Policy

1. Who is the data controller?

2. What we collect

3. Why we use it (legal basis)

4. Who we share data with (sub-processors)

5. International transfers

6. Cookies and local storage

7. How long we keep it

8. Your rights (GDPR)

9. Security

10. Children

11. Changes

12. Contact

Ark lives on the desktop.

Ark

1. Who is the data controller?

2. What we collect

3. Why we use it (legal basis)

4. Who we share data with (sub-processors)

5. International transfers

6. Cookies and local storage

7. How long we keep it

8. Your rights (GDPR)

9. Security

10. Children

11. Changes

12. Contact

Ark lives
on the desktop.