Privacy

This page describes the cookies, browser storage, and third-party services The Arch Public uses on archpublic.com, and the choices you have about them, including your right under the California Consumer Privacy Act (CCPA/CPRA) to opt out of the sale or sharing of your personal data. To exercise that right, use Do Not Sell or Share My Personal Information. We also honor the Global Privacy Control (GPC) browser signal automatically. For the personal information we collect across the platform and how we use it, see our Privacy Policy.

These first-party cookies make the site work. They are not shared with third parties (the HubSpot and Clarity cookies are listed below, with those services):

• privacy-opt-out: records your “do not share” preference for 12 months. Set when you opt out on this page or when your browser sends the GPC signal.
• sb-*: your sign-in session (Supabase authentication). Kept while you are signed in.
• imp-marker / imp-jti: set only during an administrator support session on your account, so the session is visibly marked and time-bounded.
• archpub_booking_origin: remembers which of our pages you clicked a booking link on, for up to an hour, so we can credit that page for the booking. Not shared. It is cleared as soon as you reach the confirmation page, and it is not set at all if you have opted out.

We keep a few interface preferences in your browser’s local storage. They never leave your device:

• archpub_asset_class: your selected product view (All / Crypto / Stocks / ETF).
• archpub_live_prices_order: how you ordered the live prices panel.
• paid-esign-dismissed: remembers, for the current tab session only, that you dismissed an agreement-signing prompt.

Our public pages (never the signed-in dashboard) load five third-party tags: the Meta Pixel, the Google Ads tag, Google Analytics, the X (Twitter) pixel, and HubSpot’s tracking code. They report your visit (the page viewed, and technical details such as IP address and browser) to Meta, Google, X Corp, and HubSpot for ad measurement, attribution, and site analytics, and they may set their own cookies governed by those companies’ privacy policies. This is the “sharing” the CPRA gives you the right to stop: opt out here and none of the five loads at all, including the no-JavaScript tracking image, and neither does the session replay service described next. Imported marketing pages served at their own address on this site may also carry the advertiser’s own Meta pixel, Google Analytics measurement id, and X pixel, loaded by the same tags and covered by the same opt-out, and on the confirmation page shown after a booking made from that page. Such a page may also load its content from its own data service, which receives your IP address as any image host would. Imported marketing pages also carry our own first-party page analytics: we record the page viewed, where the visit came from (the referring site or campaign, remembered for the rest of that visit), how long a page was read and how far it was scrolled, where on the page it was clicked (a point on the page, never what was clicked or typed), whether a call was booked from that page (on the booking calendar shown inside the page too), your country, your browser’s language and the kind of device and browser, under a random identifier kept in your browser tab for that visit only, on our own analytics store with no IP address stored, under the same opt-out and Global Privacy Control. We also store any form you submit on one of those pages, show it to our team, and keep it for one year, whether or not you have opted out, because you chose to send it.

HubSpot’s tracking code sends HubSpot the full address and title of the page you are on (for an imported marketing page, its address on this site, not what happens inside the page), the page you came from, your screen size and language, the buttons and links you click (their text, where they lead, and where on the page you clicked them), and an identifier HubSpot computes from your browser’s characteristics. It does not read what you type into our forms, and it does not load on the two-factor challenge, the agreement signing, the broker connection, or the opt-out page. HubSpot keeps a visitor identifier in a cookie, and if you book a call with us, HubSpot may connect your earlier visits to the contact record that booking creates in HubSpot. The HubSpot Privacy Policy applies to this data.

HubSpot’s tracking code sets four cookies on archpublic.com:

• hubspotutk: a visitor identifier, kept for six months, so return visits are counted as the same visitor.
• __hstc: when your first, previous, and current visits began and how many visits you have made, kept for six months.
• __hssc: the current visit and how many pages it has viewed, kept for 30 minutes.
• __hssrc: marks that your browser started a new session, deleted when you close the browser.

Our public pages up to the dashboard door (the home page, Concierge, the newsletter signup, the Library and its case studies, the Terms and privacy pages, and the sign-in and sign-up pages, the Get Started pages among them) load Microsoft Clarity, which records how visitors use a page: scrolling, clicks, taps, and pointer movement, replayed as session recordings and aggregated into heatmaps. It does not load on the signed-in dashboard, the two-factor challenge, the agreement signing, the broker connection, or the opt-out page, and a recording that began on a sign-in or sign-up page ends when you reach the dashboard. Text you type into any field is never captured, and where a page shows a typed email address, phone number, or name back to you, that text is masked too. Our Clarity project is connected to our Google Analytics property: each recording’s playback link is stored in Analytics as a session dimension, and Clarity reads Analytics segments to filter recordings. Microsoft’s handling of this data is governed by the Microsoft Privacy Statement. Opting out here stops Clarity from loading at all.

Clarity sets two cookies on archpublic.com:

• _clck: a pseudonymous visitor id and your Clarity preferences, so return visits are attributed to the same visitor.
• _clsk: joins the pages of one visit into one recording.

Microsoft may also set its own cookies on Microsoft domains while Clarity runs: CLID, ANONCHK, MR, MUID, and SM. These identify a browser across Microsoft services and synchronize that identifier between Microsoft domains; Microsoft uses them for advertising, site analytics, and operational purposes across its own services, under the statement linked above.

Some pages embed YouTube videos in YouTube’s privacy-enhanced mode (youtube-nocookie.com), which does not use viewing activity for personalized ads. Video thumbnails are proxied through our own servers, so your browser does not contact YouTube until a video plays. When one does play (automatically as you scroll, or by your click if you have opted out), YouTube may collect playback data under Google’s privacy policy.

Some of our marketing pages also play YouTube videos inside the page, from youtube.com or youtube-nocookie.com. On those pages the video player connects to YouTube as soon as the page shows it, and YouTube receives your IP address, your browser details and the name of the site showing the video; it may set its own cookies inside the player and collect playback data under Google’s privacy policy. If you have opted out, the page is not allowed to connect to YouTube until you press play on a video.

You book a call with our team on HubSpot Meetings, a scheduling service operated by HubSpot, in one of two ways. A booking link opens HubSpot’s own booking page in a new tab. Some of our marketing pages also show HubSpot’s booking calendar inside the page itself. When that calendar loads, your browser connects to HubSpot, which receives your IP address, your browser details, the name of the site showing the calendar and the part of the page’s address after the question mark, where campaign tags such as utm_source travel. HubSpot may set its own cookies inside the calendar; they are HubSpot’s, not ours, which is why they are not in the first-party list above. The same HubSpot account runs the tracking code described above, so a booking and your visits to this site may be connected on HubSpot’s side. The HubSpot Privacy Policy applies to the calendar, to anything you enter in it, and to the booking page. If you have opted out, the calendar is not loaded and the page is not allowed to connect to HubSpot: you get a button that opens HubSpot’s booking page in a new tab instead. When you book on the calendar, we record that a call was booked from that page and nothing you entered, as part of the page analytics described above.

California residents have the right to opt out of the sale or sharing of personal information: exercise it at Do Not Sell or Share My Personal Information or by enabling Global Privacy Control in your browser. They also have rights to know, correct, and delete personal information we hold. To exercise those, email [email protected] from the address on your account so we can verify the request. When we delete personal information on a verified request, we keep the records we are legally required to retain, such as agreement acceptances, compliance records, and order history. We do not use the tracking described here on signed-in dashboard pages.