Effective Date: October 3, 2026 · Last Updated: October 19, 2026
Arbito LLC ("we," "us," or "our") makes Arbito Market and runs the Arbito account service it connects to at id.arbito.co (together, the "Service"). Arbito Market is the points companion for the Arbito apps: it shows the points you have earned in each app, lets you convert your own points between apps, and lets you spend them on avatar cosmetics. It also holds your Arbito account settings.
Arbito Market is free. It has no in-app purchases, no subscriptions, no ads, and no third-party analytics or crash-reporting SDK. Points are earned only: they cannot be bought, sold, cashed out, or sent to another user, they have no monetary value, and they are not cryptocurrency.
The Arbito Account Privacy Policy covers sign-in for every Arbito app. This policy covers the same account in more detail, plus your wallet, swaps, avatar, and leaderboards.
When you sign in to an app with your Arbito account, we record that you allowed it and what it may access, so you can review and revoke that access in Arbito Market (Account → App access).
Arbito Market does not collect your location, contacts, health data, or advertising identifiers, and does not track you across other companies' apps or websites. It has no third-party analytics or crash-reporting SDK and no push notifications. Our servers retain sign-in and point activity, and request/error logs (including IP addresses, browser/device type and sometimes account identifiers) to operate, secure and diagnose the service. You may choose a saved avatar or submit an optional account photo where available.
Where picture settings are available, you can choose initials, a saved avatar design, or a photo you select. Arbito stores your picture choice, avatar design, uploaded picture derivatives, review status, and picture reports or blocks. The same selected picture is used by your connected Arbito apps; editing it does not make a private task list, workout, or profile public.
Uploaded photos are processed on Arbito's server to remove embedded metadata and make square versions. We do not keep the original upload. We use Cloudinary to store the processed shared profile pictures. When you choose a new shared photo, supported apps show it privately to you while other people keep seeing your previous public picture. It is available only to you and authorized reviewers until approval. Approval makes it public automatically if it is still your chosen photo; choosing another picture first cancels that switch. Older apps may require explicit selection after approval. If a photo is not approved, your previous picture remains public and returns in your own view; review status is available in picture settings. An approved public profile photo is accessible to anyone with its image link, even if another part of an app is private. Your saved avatar remains available when you choose a photo.
You can remove a photo or switch to initials in picture settings. Switching to an avatar or initials keeps a saved photo private for reuse; use Remove photo to delete it. Choosing another approved photo removes the previous retained photo; review decisions can also remove a picture. Account deletion schedules removal of stored picture files. Removal from active display happens before file cleanup; supported app and server caches normally revalidate within five minutes; offline or saved copies can remain longer, and copies another person saved may remain outside our control. Restricted recovery backups may retain removed data until their applicable retention period expires. Review and safety records are used to operate and protect the account service. Contact support@arbito.co to report a picture or ask about removal.
We do not use your data for advertising, and we do not sell it.
| Who | What |
|---|---|
| Anyone | Your public profile (username, avatar, bio, and join date) and your rendered avatar image. Leaderboards show your rank, username, avatar, and the leaderboard's value (such as a points total) unless you turn on Account → Hide me from leaderboards. |
| An Arbito app you sign in to | Your user ID, username, avatar, and bio; your email address only if the app asked for it when you signed in; and, for apps that use points, your balance in that app's points. |
| Our team | Account and sign-in records, to support you and protect the service. |
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Cloudinary (through the Arbito account service) | Stores processed shared pictures and restricted account/picture identifiers for restore safety | Cloudinary Privacy Policy |
| Railway | Hosts our servers, database, and server logs | Railway Privacy Policy |
| Resend | Delivers our account emails (your email address and the message) | Resend Privacy Policy |
| Apple | Sign in with Apple, if you use it | Apple Privacy Policy |
| Sign in with Google, if you use it | Google Privacy Policy | |
| Have I Been Pwned | Checks whether a new password appears in known breaches. Only the first 5 characters of a one-way hash of the password are sent; never the password or your email. | HIBP Privacy |
We may also disclose information if the law requires it, or to a successor if the business is transferred, under this policy.
Data is encrypted in transit (HTTPS). Passwords are hashed with bcrypt, one-time and recovery codes are hashed, and authenticator secrets are encrypted. Sign-in uses short-lived signed tokens, with rate limits on sign-in and optional two-factor and passkeys. No method is perfectly secure, but we work to protect your information.
You can see your balances and history in the app, hide yourself from leaderboards, revoke connected apps, and delete your account at any time. Depending on where you live, you may also have the right to request a copy of your data, correct it, restrict or object to how we use it, or receive it in a portable format.
Send requests to support@arbito.co. We respond within 30 days.
Arbito accounts are for people 13 and older, and sign-up asks you to confirm that. We do not knowingly collect information from children under 13. If you believe a child under 13 has an account, email support@arbito.co and we will delete it.
We are based in the United States, and our service providers may process your information in the United States and other countries. Where the law requires it, we rely on appropriate safeguards for those transfers.
If we change this policy in a meaningful way, we will update the date at the top of this page and, where appropriate, tell you in the app.