Privacy Policy

When you create an account, ChemArche stores your name, email address, password hash, account role, and timestamps. When you use account features, it stores the chemistry content you choose to save, including saved molecules, simulations, notebooks, calculations, favorites, and settings.

Authentication uses first-party Auth.js cookies. The application also uses first-party browser storage for the privacy choice and, when you explicitly use those features while signed out, selected tool preferences, local calculator saves, recent molecule searches, and molecule-selection convenience.

We use account and saved-content data to operate the requested workspace, authenticate users, protect the service, preserve user-selected preferences, and investigate security or operational issues. We do not currently operate analytics, marketing trackers, third-party authentication, marketing email, or payment processing in this build.

ChemArche uses a PostgreSQL database through its configured hosting provider and Auth.js/Prisma application infrastructure. The server can request public chemistry reference data from PubChem when a molecule lookup requires it. Production error, performance, and security-event monitoring uses Sentry with centralized data scrubbing, limited sampling, and no session replay. Monitoring can receive an opaque user or request identifier, route path, browser/runtime metadata, and technical error details, but is configured to exclude passwords, tokens, cookies, request bodies, email addresses, and saved notebook content. These providers may process information needed to perform their services. ChemArche does not sell personal information or use it for cross-context behavioral advertising in the current build.

Authenticated users can download a machine-readable export of their account content or permanently delete their account from the Account page. Deletion removes the account and related application content from the active database according to the data model; limited backup copies may remain until they expire under the provider's backup lifecycle. You can also manage browser privacy choices through Cookie Settings.

Account content is retained while the account remains active, unless you delete it or it is removed through the application. Security and operational records may be retained for a limited period where needed to protect the service or investigate abuse. We use reasonable technical and organizational safeguards, but no system can guarantee absolute security.

ChemArche is not designed for children under 13, and it does not intentionally collect personal information from them. If ChemArche materially serves additional jurisdictions or institutions, its privacy practices will be reviewed for the relevant requirements before that launch.

We may update this policy as the product changes. The version and dates above identify the current policy.