Privacy Policy

Last updated: October 22, 2026

This policy covers the megastructure.ai website, purchases of our software, and the Arc desktop application. It sets out what each one collects and why.

The short version

  • Arc is local-first: your rooms, messages, tasks, and artifacts stay on your machine.
  • The Arc app contains no telemetry, analytics, or crash reporting.
  • We don’t display ads in Arc, and we don’t sell personal data for money.
  • On the website, ad measurement (the X Pixel) and site analytics (PostHog) run only for visitors in the United States who haven’t opted out. A Global Privacy Control signal opts you out automatically, and you can opt out under Your privacy choices.
  • Payments are handled by Lemon Squeezy, our merchant of record; we receive the order details needed to deliver and support your license, never your full payment details.

1. Who is responsible

Megastructure Corp, a Delaware corporation registered to do business in California, is the data controller for the processing described here. Contact: support@megastructure.ai.

2. The website

Every visitor

The site is hosted on Vercel. Like any web host, Vercel produces standard server logs (including IP addresses) that we rely on for security and operations. We use Vercel Web Analytics for aggregate page statistics; it is designed not to use cookies or track visitors across sites. Your light/dark theme preference is stored in your browser’s localStorage and never sent to us.

Pages with a Buy button also load Lemon Squeezy’s checkout script (lemon.js, from app.lemonsqueezy.com), so checkout can open as an overlay on our page. Lemon Squeezy operates that checkout under its own privacy policy (see section 3). When an order completes in the overlay, our page receives the order confirmation: an order reference and the amount. Our page never receives your payment details.

Visitors in the United States

We work out your country from the approximate, IP-based location that Vercel provides with each request. We use it only to decide what to load, and we do not store it. If you are in the United States, your browser does not send a Global Privacy Control (GPC) signal, and you have not opted out on this browser, the site also runs the following.

X Pixel (X Corp.) records:

  • visits to our pages;
  • clicks on Buy;
  • purchases completed in the on-page checkout (the order reference and amount only, never your name, email, or payment details);
  • the X click identifier (twclid), when you arrive from an X ad.

X sets its own cookies and uses this information to measure our ads. It may also use it to show our ads to people who have visited the site (advertising audiences on X). Under California law (the CCPA, as amended by the CPRA), this can count as “sharing” personal information for cross-context behavioral advertising. You can opt out at any time under Your privacy choices.

PostHog (PostHog, Inc., with data hosted in the United States) records product analytics and session recordings of how you use the site: pages viewed, clicks, scrolling, and movement through the page, so we can see where visitors get stuck. It also records Buy clicks and completed purchases (the order reference and amount). Text typed into fields is masked. PostHog uses a first-party cookie and an identifier in localStorage.

Campaign attribution. When you click Buy, we attach the following to your Lemon Squeezy order as order metadata, so we can tell which ad or page led to a sale:

  • the ad campaign tags from the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content, utm_term);
  • the X click identifier;
  • your PostHog analytics ID (a random identifier).

The campaign tags and click identifier are kept in your browser’s localStorage for up to 30 days. If you buy, your order is therefore linked to that analytics ID. We keep analytics and session recordings for no longer than 12 months (see section 7).

Visitors outside the United States

Neither the X Pixel nor PostHog loads, and no campaign attribution is stored.

3. When you buy Megastructure Arc

Checkout is operated by Lemon Squeezy as merchant of record, including when it opens as an overlay on our page. Lemon Squeezy collects the information needed to process your payment (name, email, billing details, payment method) under its own privacy policy; we never see your full payment details.

From each order we receive the basics: your name, email address, country, the product purchased, and the license key and its activation status. We use these details only to deliver the product, operate your license, and provide support, and we don’t add you to marketing lists.

If you are in the United States and haven’t opted out, your order also carries the campaign attribution described in section 2 (campaign tags, the X click identifier, and the PostHog analytics ID) as order metadata, so we can tell which ad or page led to the sale. When the order completes, the X Pixel receives only the order reference and the amount, never your name, email, or payment details.

4. The Megastructure Arc app

Arc stores everything it knows — rooms, messages, tasks, artifacts, decisions — in a local SQLite database on your machine. We have no access to it. The app sends no telemetry, no usage analytics, and no crash reports.

Arc contacts our services for updates and licensing:

  • Update checks. Arc periodically contacts our update service with a signed, license-scoped credential so the service can confirm update eligibility and return a cryptographically signed update manifest. The credential contains a license identifier, a one-way hash of the purchase email, an activation identifier, the Arc edition, and update-entitlement information. It does not contain the raw license key, room contents, messages, project files, or AI-provider credentials. Like any web request, the service also receives standard request metadata such as your IP address. Update checks can be turned off — or back on — at any time in Arc’s settings.
  • License activation. When you activate Arc, the app sends your license key and a machine identifier to our license service, which verifies them with Lemon Squeezy. This enforces the activation limit and is stored only to operate your license. When Arc is online, it may periodically revalidate license status the same way. Offline launches use the signed local license file, so Arc keeps working normally without online verification on boot.

Arc does not require AI-provider credentials: the agents you connect to Arc use their own accounts under their own providers’ terms. If you choose to add a hosted model connection so Arc can run agents itself, Arc sends those seats’ prompts to the provider you selected, using credentials you supply. Your credentials are used only for the requests you initiate and are never sent to Megastructure; local model inference can stay on your machine. Web tools make the separate requests described below.

Managed agents can search the web and read pages on any model, including local models, in Safe and Full Access rooms. Search sends the query to DuckDuckGo; only when it is unavailable does Arc try a search through a saved OpenRouter or Anthropic connection using that connection's key. Page reading contacts the requested websites without cookies or logins. Safe reads public addresses only; Full Access also permits local and LAN pages and website navigation in the room browser. These requests send search terms or page requests to the selected services and destinations, rather than to Megastructure.

5. Email

If you email support@megastructure.ai (or contact@), we keep the correspondence as long as needed to help you and to keep a record of the request.

6. Who we share data with

We share data only with these companies:

  • Vercel — website hosting and aggregate analytics.
  • Lemon Squeezy — checkout, payments, and licensing.
  • X Corp. — advertising measurement and advertising audiences, for visitors in the United States only.
  • PostHog — site analytics and session recordings, for visitors in the United States only.
  • Our update-hosting provider — update file delivery.

We do not sell personal data for money, and we don’t use data brokers. Because X may use what its pixel records to show our ads to people who visited the site, the X Pixel can count as “sharing” personal information under California law. To opt out, use Your privacy choices below or a browser that sends Global Privacy Control.

7. Retention

Order and license records are kept for as long as your license is active and as required for tax and accounting obligations. Support correspondence is kept as long as it is useful for helping you.

Site analytics and session recordings are kept only as long as they help us improve the site, and no longer than 12 months. Campaign attribution stays in your browser for up to 30 days; if you buy, the attribution attached to your order is kept with the order record.

8. Your rights

Depending on where you live (for example under GDPR or the CCPA), you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to certain processing. Email support@megastructure.ai and we’ll handle it. For payment data, Lemon Squeezy is an independent controller, so requests about payment records can also be made to them. You also have the right to complain to your local data-protection authority.

If you live in California, you also have the right to opt out of the sale or sharing of your personal information. We honor a Global Privacy Control signal as an opt-out, and you can also opt out under Your privacy choices or through the “Do Not Sell or Share My Personal Information” link in the site footer.

9. Your privacy choices

The site honors Global Privacy Control automatically. If your browser sends a GPC signal, the X Pixel and PostHog do not load, and no campaign attribution is stored.

You can also turn ad measurement and site analytics off with the control below. Turning it off stops the X Pixel and PostHog from loading in this browser. The setting applies only to this browser, so repeat it on any other browser or device you use. Outside the United States, neither loads either way.

Advertising measurement and site analytics on this browser

The “Do Not Sell or Share My Personal Information” link in the site footer brings you to this section.

10. Age eligibility

Arc is a professional agent-coordination tool for users 16 and older. We do not design, market, sell, or offer Arc for use by children under 16. If you are under 16, do not buy, activate, or use Arc, and do not send personal information to us. If a parent or guardian believes a child has provided personal information to Megastructure, contact us at support@megastructure.ai and we will delete it or take the required corrective steps.

11. Changes

If we change this policy, we’ll update the date at the top and note material changes on this page.

12. Contact

support@megastructure.ai