The formal document · plain-language version is What happens to your words
This is the formal privacy policy. If you want the short, plain-language explanation of the same thing, read What happens to your words.
The version above is the value recorded against your consent. If you agreed to an earlier version, that is the one that applies to you until you agree to this one.
Service: ArrowMem. Operator: ArrowMem Inc., operating as ArrowMem. Registered office: 1300B-350 Bay St., Toronto, ON, Canada M5H 2S6. Contact: privacy@arrowmem.ca.
ArrowMem helps you draft, in your own words, structured material for tasks you choose. Depending on the pack in use, that may include the sections of a Veterans Affairs Canada disability benefits application that the applicant completes themselves (form PEN 923).
We are not Veterans Affairs Canada. We are not affiliated with, endorsed by, or connected to Veterans Affairs Canada, Service Canada, the Government of Canada, any government department, or any veterans organisation. We do not submit anything on your behalf and we do not speak to any department for you. The application stays yours. Veterans can connect with Veterans Affairs Canada for help at any time, free of charge: Disability benefits.
We do not assess your condition, your service history, your entitlement, or your eligibility. This is not legal, medical, or financial advice.
We describe what the software does. We do not tell you what is true about us.
"The server writes no record of your answers" stays true unless somebody changes a file, and a test catches that. "We would never look" is only a sentence. Every claim below is meant to be a description of a mechanism you could hold us to. If you find one that is not, write to privacy@arrowmem.ca and we will correct it.
Your chat messages are sent to AI services to get an answer. ArrowMem does not store them on its servers.
Only on answers that use web search, a short search query based on your message and your notes is sent to a search service.
When you use an online option, your words travel to our servers, which pass them to the AI service that writes the answer. ArrowMem does not store them on its servers.
What we do with them is process them and return the result. The server does not write a row containing your answers or your generated report.
We state both halves because only stating the second one would mislead you.
The server writes no content row. The controls behind that sentence, so it can be checked:
The route that receives your answers validates and counts them and returns written: 0, stored: false. The response states what happened rather than leaving it to be inferred.
The report route performs no write of report content.
The two tables that used to hold this content have been destroyed. They are not disabled and not emptied. They are gone from our infrastructure definition, and there is no table left for this content to go into.
A test in the build walks the syntax tree of every file we ship and fails the build if a handler writes narrative or report content. It runs on every push and every pull request.
Because no row is written, there is no copy of your answers or your report in any backup of ours, and nothing of yours to produce in response to a request or a court order. This is a statement about keeping, not about receiving.
We also write down: your email address, because it is how you sign in; a consent record, so we can show what you consented to and when; a usage count, so the usage meter works; a session marker, to expire an idle session; a payment record, to administer a purchase and support billing; a promotional code redemption record, so a code is not reused; a request de-duplication record, so a retried request is not run or charged twice, which holds a hash of the request rather than the request itself, kept 24 hours; a transcription job record, to track a voice recording through transcription and delete it afterwards; IP addresses, for abuse prevention only; and an access log, recording that a read or write happened and which account it was for, so an unauthorized read can be detected and investigated. None of these records contain what you wrote.
We also hold reference data used to build a draft. It is public Government of Canada material and contains nothing about you.
We do not sell your personal information, and we do not share it for advertising.
Every read or write to your account state, your consent record, your session marker, and the storage that briefly holds a voice recording, is itself recorded: which table or storage location, when, and the account key it was for. It never holds your answers, your report, or your voice. It holds only the fact that something touched your row, and whose row it was.
We keep this record for one reason: to detect and investigate a read of your data by someone who should not have made it. Detecting a read as it happens does not depend on this specific copy. That detection runs off a separate, short-lived copy of the same events that clears on its own after fourteen days. What this longer copy adds is the ability to answer, later, exactly whose data a confirmed unauthorized read touched, including a read only discovered or reported well after it happened.
This record currently lives for 400 days from when it was written, and deleting your account does not shorten that or remove your identifier from it. A log of who accessed what that its own subject could erase would not be trustworthy as a log of who accessed what.
Speaking is sending.
Where a voice recording goes: our own servers, in Canada, inside our own account. Not to Google, not to Apple, not to any outside transcription service. While it exists, it is encrypted at rest under a key held in our own account. It is deleted the moment the text comes back, and a separate rule on the storage removes anything still sitting there after one day, so a failure part way through cannot leave a recording behind. Neither the recording nor the transcribed text is written into our logs.
Photos and documents. If you add a photo or a document to a chat, it is sent with your message so the assistant can answer about it. We keep no copy: it is not written to a database or to storage, and it is not in our logs. Where it is processed depends on the option you chose, the same as your words.
The transcript goes through the same filter as typed text before it is handed back to you. Automated transcription makes mistakes. Read it before you use it.
Voice input is switched on in this release.
We record the IP addresses your account connects from when you generate a draft, and we use them for one purpose: to notice when a single account is being used from an unusual number of different addresses, which is the pattern of a shared or automated account rather than one person preparing one application.
Each address expires 90 days after it was last seen, per address, and a scheduled job physically removes stale ones. If an account is flagged, one address is exempted from that expiry, for a stated reason, and only until the flag itself expires. We do not use these addresses to locate you, to build a profile of you, to follow you across other sites, or for advertising.
When an account crosses the threshold, one address, the one that triggered the alert, is put into an internal alert delivered to a monitoring address we control, and the same single address is written to our own operational log. Those two copies sit outside the 90 day expiry and outside the reach of an account deletion. The operational log clears itself on a seven day cycle.
This alert and its log line are switched off while we finish validating the signal that would trigger them, and are not being produced today. Recording the address itself is unconditional and does run.
So the honest statement is not that these addresses never leave the system. One address, on a flagged account, reaches our own monitoring inbox and our own log. It is not disclosed to any outside party for that party's own purposes.
A check from Cloudflare runs at three moments to tell people apart from automated use: when you sign up with your email, when you record your voice, and when you generate a report. It receives your IP address and basic details about your browser, and Cloudflare may process them outside Canada. It does not load at any other time.
Reports you send. If you report an answer, we receive the reason you pick, which option answered and the pack in use, and a reference to the answer. A report does not say who sent it. Reports are deleted after 30 days. Your IP address is visible to our server, as with any request.
We do not ask for your Social Insurance Number, your date of birth, your banking or direct deposit details, government identification numbers, or information about your family members. Veterans Affairs Canada collects what it needs directly; provide those details to it, not through us.
We do not ask for identifying details like your name or government-issued numbers either. Signing in needs an email address, and that is the only thing about you we require.
Inside the product itself, once you are signed in, this stays true without exception: essential session and sign-in cookies only, no advertising, no profiling, no tracking technologies. The IP addresses we do record are not tracking in that sense: they are never used to profile you or to follow you anywhere. On our public pages before sign-in, see the analytics disclosure below - it is a narrower exception, not a change to what happens once you are using the product.
We use Google Analytics on a few public pages only: How this works, Protect yourself, Pricing, Privacy and Terms. It does not load on the home page, and it never loads inside the product: not in chat, not in a claim, not on any screen after you sign in. It loads only if you accept the analytics banner. It counts how many people visit and which of these pages they read, so we can tell whether the product is reaching anyone; it is not shown to you and does not change anything you see. We have turned off the settings that would link it to an advertising profile or a personalized ad, and no event it sends carries your name, your email, or anything you have written. Google LLC, a United States company, receives the visit data this generates.
If you join our pre-launch mailing list from the landing page, before you have an account, we keep the email address you gave us until you ask us to remove it, rather than deleting it right away. Canada's anti-spam law requires us to be able to identify and contact whoever agreed to be on that list, so we can honour a removal request from the right address. Reply to the confirmation email, or write to privacy@arrowmem.ca, and we will remove it.
You choose which model processes your words. One option is shown already selected as a suggestion, and you can change it. The server refuses any request that names no choice.
The Canadian option processes your words in Canada.
The other options may process your words in the United States.
One option arrives pre-selected, and the screen where you choose says which one and what it means, on arrival, before you do anything.
While your information is outside Canada, the law of that country applies to it while it is being processed there, including the powers of that country's courts, law enforcement and national security authorities. We say so on the screen where you make the choice, and we say it here.
The provider may route a request through more than one of its own data centres. We cannot choose which, and we will not claim otherwise.
Everything else we run, the interface, the databases, the audit trail, is in Canada.
One exception we would rather name than have you find: our cloud provider records identity and access management events in the United States, because that service is global. Those are logs of administrative actions on our own account. No applicant information is in them.
People put things into a claim narrative that do not belong there: a phone number, an email address, a bank account they were arguing with an insurer about. We filter that out before it is sent.
On your device, as you type, before anything is sent: a filter removes email addresses, phone numbers, Social Insurance Numbers, bank account numbers, card numbers, and a military rank immediately followed by a surname. The full pattern list is fixed in a written specification. On our server, as a second pass, in case the first was skipped. Kept honest by a test that runs both copies against the same examples and fails the build if they ever disagree.
A card number is checked against its own checksum before it is removed, so a real card goes and a sixteen digit case reference is left exactly as you wrote it.
It is a filter, not a mind reader. It finds things that have a shape: numbers and addresses. It cannot recognise a person's name, a clinic, or a place, and it deliberately does not try, because a filter that guessed at names would quietly delete words out of your own story.
It reduces identifiers. It does not make your words anonymous, and we do not describe them that way. A narrative about your own health remains information about you after the filter has run.
Ordinary English sometimes gets caught. A rank word at the front of a phrase can take the next word with it. If something you wrote comes back changed, put it back.
Notes sent with a cloud answer. When you choose a cloud option, your device looks through the notes in the folders you linked to chat and sends only the ones that match your question, 2,000 characters in all, so the answer can use what you have kept. You see a line saying which notes were used, and you can choose Do not use on any note. They go to the service that writes the answer, the same way your message does, and we do not store them. When web search is on, which is the case for Balanced, Precise and Expert, the search the assistant writes can repeat details from those notes, and that search is sent to our search provider as described under web search below. A note you do not want to travel stays home if you unlink its folder or choose Do not use on it. An answer made on your phone uses your notes on the phone and does not send them.
Nothing of what you write to the assistant is stored on our servers, so there is nothing of it to delete. A voice recording and its transcript are kept only until the text comes back, and anything left over is removed automatically, usually within a day. The session marker still expires. After 30 minutes without activity, a scheduled sweeper deletes the marker for an abandoned session, keyed on when that session was last active, and a database time-to-live rule sits behind the sweeper as a backstop.
This is a change from our earlier policy and it is worth being clear about. We used to promise that your answers and your report were deleted within about 30 minutes. That described a mechanism that deleted rows. Those rows are no longer written at all, so there is nothing on that clock but the session marker.
While you are working, your unfinished draft sits in this browser on this device. It is not saved on our servers.
The draft is held in ordinary browser storage on the device you are using. It is protected by that device and by whoever can unlock it. It is not sealed, and it is not encrypted by us.
A browser can clear its own storage to free space, with no warning and no error. We measured that and we cannot prevent it. It is not synchronised to another device, and we cannot recover it for you.
This is different from your vault. Vault contents are sealed on your device with a key we do not have. Unfinished drafts are not in the vault, and we are not going to describe them as though they were. Moving them into the sealed store is something we intend to do; it is not done today.
A vault is optional. If you decline it, you can still complete a draft and print it.
If you use one: content is sealed on your own device before it is written anywhere. The key is derived on your device from your recovery phrase, and no part of the app contains code that sends key material anywhere. Key material stays inside an isolated worker process.
We hold no copy of your key, no half of a key, no escrow, and no reset mechanism. There is no support call that changes that. If you lose your recovery phrase, the vault does not come back.
Sync. If you turn on Sync, your vault is copied as one encrypted file into your own Google Drive. ArrowMem receives nothing: the file goes between your device and your Drive, and we ask Google only for access to files ArrowMem itself creates. Google can see that the file exists, how big it is, how many items it holds and when it changes, not what is in them. It opens only with your recovery phrase, and we hold no key. It is a copy for your own devices, not a backup, and you can delete it from Drive yourself. If two devices change the same entry, Sync keeps both versions.
The file you export is a plain readable file, on purpose, so anybody can open it without our software. It may name your clinicians, your employers, and where you were treated. Once it is on your device it is protected by your device. Keep device encryption switched on, and think before you email it.
In a web browser, stored data can be cleared by the browser to free space, with no warning and no error. The copy you export is the one that really lasts.
These are the outside services in the live path for this product. The list was checked against the code, not copied from an older document.
Amazon Web Services: the interface, the databases, storage, keys, notifications and operational logs. In Canada.
Amazon Bedrock (AWS): produces the draft text from what you wrote. In Canada, or possibly in the United States, depending on the option you elect.
Amazon Transcribe (AWS): converts a voice recording to text, inside our own account. In Canada.
Brave Search (Brave Software): when web search is used for an answer, a short search query that the assistant writes from your message is sent from our servers to Brave Search to find pages. The query can repeat words from your message, from text you pasted or from your notes. Before it is sent, street addresses are reduced to the area, postal codes are cut to three characters, and phone, email, card, bank, service and social insurance numbers are removed, or the search is not sent. Your IP address and account are not sent. Brave Search may process the search outside Canada. Brave Search keeps a log of search queries for up to 90 days, under its own privacy notice.
Hugging Face: hosts the on-device model file you can download to a phone. It sees the phone's IP address when the file is downloaded. May be outside Canada.
When an answer reads a web page, our server fetches it, so the site sees our server and not you.
Amazon Cognito (AWS): signs you in. In Canada.
Amazon SES (AWS): sends account email, such as a sign-in code. In Canada.
Stripe: processes payments. International, including the United States.
Google Drive (your own account): holds the encrypted vault file if you turn Sync on. International, including the United States.
Your own machine. If you connect a computer you own, we keep one record on your account for each machine: a fingerprint of its address, so that each machine is counted once. When you choose On my machine for chat, your message goes from your phone to that computer over Tailscale, a service you set up yourself, sealed so that Tailscale cannot read it, and it does not pass through our servers. The computer answers with the model you set it up to use, normally on that computer, which can be larger than the model on a phone. A claim draft is different: it is written by a cloud model, whichever option you chose for chat. The model you use is your choice, and its own terms are yours to read.
Cloudflare Turnstile: the challenge that tells a person from an automated script. International. Your browser contacts Cloudflare directly, so Cloudflare sees the address you are connecting from. We verify the resulting token on our side and do not send your address to them with it.
We do not use OpenAI. An earlier version of this policy named OpenAI as our voice transcription provider. That is not what the software does. Voice goes to Amazon Transcribe, in Canada, in our own account, and no audio or transcript is sent to OpenAI or to any other outside transcription service.
Per our cloud provider's published data protection terms for the draft generation service, your prompts and the model's outputs are not stored or logged by them after the request is processed, are not used to train any model, and are not shared with third parties, including the company that developed the underlying model. We have additionally kept that service's optional invocation logging of prompt and output content switched off, so no copy of your drafting request is written into our own account either.
Payments are processed by Stripe. Your card details are entered with Stripe. We do not see them, they do not pass through us, and we do not store them. We receive confirmation that a payment succeeded, what was bought, and a payment reference.
When you delete your account, the payment row is stripped rather than deleted. What is removed is the link to you and the status. What is kept is the payment reference, the quantity, and the date it was credited. That stub is a financial record and it has no expiry today.
ntfy.sh: carries the push notifications for Is It Really Me and for Guard's own alerts to your phone. International. What we send it is a topic name and one of a small set of fixed sentences written in advance. It never receives your name, your number, your account, or anything you wrote.
Amazon SNS (AWS): sends the text messages described in the Is It Really Me section. In Canada.
Amazon links. Some answers include a button that opens a search on Amazon.ca. The search words in the button come from your message and the answer, and go to Amazon when you tap it, along with our affiliate tag, so Amazon knows the visit came from ArrowMem. Your IP address is visible to Amazon, as on any website you open. If you buy there, ArrowMem earns a commission. Amazon's own privacy notice applies from that point.
Your answers about your health and your service are sensitive personal information. We ask for your express consent, separately, in plain language, unbundled from anything else, with no pre-ticked boxes and neither answer pre-selected.
What the consent record holds: who consented, what purpose they consented to, whether the act was a grant or a withdrawal, the version of this policy in force at the time, when it happened, how it was given, and the language it was given in. It holds nothing you wrote about your health or your service.
It is append only. A withdrawal is written as a new record, never as an edit to the record of the grant, so the history of what you decided cannot be overwritten. If the record cannot be written, we tell you the consent was not recorded and we do not let you continue. We would rather block you than have you using this service under a consent nobody can produce.
You can withdraw your consent at any time, from your account settings, without writing to anyone. It is one control, it takes effect when we record it, and we tell you plainly if the withdrawal did not record.
Withdrawing is not the same as deleting your account, and we keep them apart on purpose. Withdrawing the core purpose ends our ability to write a draft for you, because writing one means processing what you tell us. It does not take your account, and it does not touch a draft you have already written or anything you have kept in your vault. Deleting your account is a separate act.
If you decline, nothing is recorded, including your refusal. We do not write a record of a consent that was not given. You can come back to the consent screen at any time. Without the core consent we cannot write a draft for you.
We keep a continuous backup on the consent table and on no other table. The window is 35 days. The record is identity, purpose, timestamp and policy version. It contains nothing you wrote.
We keep the consent record for as long as we may need to show that you consented, and that includes after you delete your account, because a consent nobody can produce is not proof of anything.
Parts of your draft are produced by an AI model from what you provide. No decision about you is made by automated means. Nothing is submitted anywhere automatically. You review, edit and decide what goes into your application. Veterans Affairs Canada makes entitlement decisions, and its process is entirely separate from this service.
If the assistant produces something offensive or wrong, you can report it from inside the app, and a person reads those reports.
Wherever you live, you can ask what personal information we hold about you, ask for a copy, ask us to correct or delete it, and withdraw your consent. Under PIPEDA, the Canadian law that applies to us, and, where it applies, Quebec's Law 25, you can: ask what personal information we hold about you; ask for a copy of it, in a structured, commonly used, machine readable format, and ask us to send it to somebody you name where that is technically feasible; ask us to correct it; withdraw your consent, from your account settings, without writing to anyone; ask us to delete your account and what it holds; complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to the data protection authority where you live.
Write to privacy@arrowmem.ca. We answer within 30 days.
To delete your account, open Account and choose Delete account. What deleting your account actually does: the session marker is deleted. Promotional code redemptions tied to you are deleted, though the code itself stays used, so deleting an account does not free up a promotional slot. The payment row is stripped to the anonymised stub described above. The request de-duplication records expire on their own within 24 hours. Your account state row is deleted outright, with no marker left behind. Any voice recording and any transcription job record are deleted.
The consent record is kept, because it is the evidence of what you consented to and of your withdrawal.
An abuse alert copy may survive briefly. If your account was ever flagged, the single triggering address sits in our monitoring inbox and in an operational log that clears on a seven day cycle.
The access log is kept, unshortened. It continues to record that reads and writes on your former account's rows occurred, keyed to your account identifier, for up to 400 days after each one was written.
Anything held in this browser, including an unfinished draft, is on your device and is yours to clear. Deleting your account does not reach it. There is no stored claim content to delete, because none was written.
We describe controls rather than claiming outcomes. Sign-in is Google or a code sent to your email. There is no password to steal, guess or reuse. Your identity is taken only from a validated sign-in token. A request cannot claim to be somebody else by putting a different identifier into the request. The role that writes a consent record cannot read the consent log, and the role that reads it cannot write one. Neither half can do both. Voice recordings are encrypted at rest under a key held in our own account.
If there is a breach of security safeguards involving your personal information that presents a real risk of significant harm, or in Quebec a risk of serious injury, we will notify the Office of the Privacy Commissioner of Canada and, where it applies, the Commission d'accès à l'information, any other authority the law of your country requires, and affected individuals, as soon as feasible.
No method of transmission or storage is completely secure, and we do not claim otherwise.
We build every control on this page for real, and we test the ones a test can catch. What we cannot do, and what no business handling information like this can honestly promise, is guarantee that it will never be exposed. The tools available to attack a system like this one change faster than any single defense stays ahead of, permanently. What is described above is the strongest setup we know how to build today, kept current as that changes. It is not a guarantee, and we are not going to call it one.
This matters for anything you write here. Go in with your eyes open: assume that anything you type into any online service, including this one, could someday be exposed, and do not put in writing what you would not be willing to say to someone directly. That is not a reason to avoid this service. It is the reason we are telling you plainly, rather than letting a page of controls above read as a promise it cannot make.
This service is for people 14 and over. It is not directed at children, and we do not knowingly collect information from anyone under 14, or under a higher age that the law where they live sets for using an online service without a parent or guardian. If you think we hold information about someone under that age, write to privacy@arrowmem.ca and we will look into it. You can also delete your own account at any time. Paid plans are for adults.
We may update this policy. The date at the top will change, and the version recorded against a new consent will change with it.
Questions about this policy, or a request about your own information, go to privacy@arrowmem.ca.
For help using ArrowMem, write to support@arrowmem.ca. Questions about your personal information go to privacy@arrowmem.ca.
ArrowMem Inc., operating as ArrowMem. 1300B-350 Bay St., Toronto, ON, Canada M5H 2S6.
This version is English. A French version is required before this service is offered in Quebec, and for users in Quebec the French is the operative text.
This is a separate system from the ArrowMem app. Nothing you write in the app, and nothing in your account or your vault, is reachable through it, and it does not read from or write to the same data.
Anyone can call ten tools with no account and no key. They return information about ArrowMem, ArrowBridge, our packs and the Data Dignity Standard, or read diagnostics you choose to send about your own setup. We do not require, store or collect anything about you to answer them.
Four tools require a paid key. Getting one means paying through Stripe, the same processor named elsewhere in this document. We do not see or store your card details. What we hold is a fingerprint of your key, never the key itself, a call count against your plan's limit, and a record of the Stripe payment that issued it.
The key is shown to you once, immediately after payment, and is not recoverable from us if you lose it. A lost key is replaced, not restored.
Calling the API from an automated tool or agent on your own behalf is expected and normal; that is what the API is for.
Is It Really Me lets someone who has your family link ask, from their own phone, whether it is really you on a call they are on. Your phone is what answers. It is part of Guard, not of the ArrowMem app: it does not read, and cannot reach, anything in your account or your vault.
To set it up you give us one mobile number, the one to be reached. That number is not written into any table, any log, or any file we keep. It is encrypted with a key held in our own key service and placed inside the family link itself, so the link is where it lives. When a text has to go out, the number is decrypted in memory for that one send and nothing is written down afterwards.
The encryption is bound to the key it was set up under. The same encrypted number copied onto somebody else's link does not decrypt: our key service refuses it, because the identity bound into the ciphertext no longer matches.
The push channel your phone listens on is not stored either. What we keep beside your key is one random token, a fingerprint pointing at your current family link, and three times: when the relay was set up, when your machine last called us, and when we last paged you for going quiet. The channel name is worked out from that token with a secret held outside the database, at the moment a notification is sent, and never written back. Someone reading the database alone gets a random number, not a channel and not a route to a device. The last two of those times are what the watchdog reads to decide your monitor has gone silent.
The honest limit of that control, stated rather than left for you to discover: we hold both the database and the secret, so we are able to work out the channel name. A channel on this kind of service is public once its name is known, so anyone who can work it out could read or send a notification on it. What that gets them is one of a small set of fixed sentences written in advance. There is no way to put a message of your own, or of ours, into that channel, because no notification body is ever built from anything anybody typed. An answer to a real check cannot be faked that way: the answer travels back through us, tied to a single-use token.
When a check is running, what we hold is one row that carries a fingerprint of each of the two single-use tokens, whether it is still waiting or has been answered, and the times. It carries no name, no number, no phone, no account, and nothing about the call. It carries no link to the person who asked. The check stops being answerable ten minutes after it starts, and the row itself is removed by the database's own expiry, which can lag by up to two days after that point.
We collect nothing about the family member who asks. They give us no account, no name and no number; opening the link is the whole of it. The page they wait on tells them only whether the check is waiting, answered yes, answered no, or expired, and nothing else at all.
There are limits on the volume, and they are there partly for your protection: three asks in fifteen minutes through one family link, and separately, for the alerts your own machine sends about itself, at most six an hour. Every text sent spends one call from your own plan, and a request refused for hitting a limit sends nothing and costs nothing.
If you also let Guard's monitor reach you by text for its own alerts about your machine, the choice of channel and the encrypted number sit in files on that machine, beside its key, and not on our servers. The alerts themselves are the same fixed sentences: that something changed, that something cleared. Never what changed, never a file, never a machine name.
Anyone holding your family link can cause your phone to be paged, so treat it as a credential. You can replace it whenever you want: a new link is issued, the old one stops resolving, and you can replace the push channel separately from the link, so losing one does not force you to redo the other. This sits against your Guard key rather than against an ArrowMem account, so deleting an ArrowMem account does not by itself end it. Replacing the link, or writing to privacy@arrowmem.ca to have the key revoked, is what ends it.
Paste Guard is a free browser extension, separate from the ArrowMem app and from your account. It watches the message box on a short, named list of AI chat sites and tells you when what you are about to send looks like a card number, a Canadian social insurance number, a US social security number, a passport line or a secret key, and asks you before it goes.
We are describing it here rather than leaving it unmentioned, because an extension that reads what you type is exactly the thing you are entitled to be told about by the company that sells you privacy.
It makes no network calls of any kind. It has no server, no account and no way to reach us. That is not only a promise: a check that runs over the built extension before it is packaged fails the build if any means of making a network request appears in it. What it asks your browser for is narrow, and here it is in full: the named sites, the browser storage described below, and the standard permission covering the tab you are on when you click its button, which it uses only to ask itself whether it is watching that tab.
It reads the message box and nothing else, through one documented rule per site. It does not read the rest of the conversation, the page around it, your cookies, or any other field. Text you are about to send is examined in your browser and thrown away; what a check reports is a category, never the text that matched.
The only things it stores are on your own machine, in the browser's own storage for the extension: which site you told it to stay quiet on and until when, and whether you switched the health wording check on. There is no content in that, and none of it leaves your machine.
The health wording check is off unless you turn it on. It looks for a short, fixed list of labels, written out in the extension's own README, never a guess about your symptoms.
On-device model. On a phone that supports it, you can download a language model to the phone. The file comes from Hugging Face. The app checks it against a fixed value before using it, and deletes it if it does not match. Hugging Face can see that the phone downloaded the file, as any website sees a visit. That request carries the phone's IP address and goes to Hugging Face, a company that may process it outside Canada, under its own privacy notice. Once the model is on the phone, a turn it answers is made on the phone: your words and the answer stay there and we do not receive them. If you switch to a cloud option in the same chat, the whole chat so far, including answers made on the phone, is sent with that message. To use it, the app asks our server whether your account may, which identifies your account but sends none of your words. Two things can still leave the phone: the app refreshes its list of crisis resources, which sends none of your words, and, if you have turned on Sync, what you keep, including chats you save, goes to your own Google Drive as the Sync section describes.
If anything in this document contradicts What happens to your words, this document governs and the other page is wrong. Tell us and we will fix it.