Privacy policy
Last updated: November 9, 2026
This policy explains what Arcane Engineering LLC ("we") does with your information on our website and on our project pages.
The short version: the website has no analytics, no tracking and no cookies. The project pages use your Google account once, to learn who you are. What you write in a request is stored on GitHub and read by AI agents.
What this covers
- The website: www.arcane.engineer, apps.arcane.engineer and the.arcane.engineer, which all serve the same site.
- The project pages: the pages where invited clients sign in, send requests and follow their progress, at apps.arcane.engineer/requests/.
It doesn't cover other sites we link to, such as Cal.com, LinkedIn or Marco Lamina's blog. It also doesn't cover docs.arcane.engineer, which holds documentation for an earlier product and uses Google Analytics. It also doesn't cover cold email we send to people at companies we think we can help. If you got one, reply and we'll stop, or ask us to delete your details.
When you visit the website
- No cookies, analytics or ads. The home page and the brand page set no cookies and run no scripts.
- Our host's logs. Each visit writes your IP address, the page, the time, your browser's description and the page you came from to logs at Heroku, our host. The logs don't include your email address. They hold only the most recent 1,500 lines, so how long a line lasts depends on traffic, and they aren't sent anywhere else.
- Google. Our pages load their styles and logo from Google's storage service, so Google sees your IP address and browser on each page.
- Heroku's network reports. Our host asks your browser to send it a small sample of reports about connection problems.
- Links. Booking a call happens on Cal.com. It learns nothing about you until you click the link, and then its own terms apply.
- One exception. Marco's own inbox page, at /inbox/, isn't for visitors, but anyone can open the address. It loads a script from Telegram, so Telegram sees your IP address and browser if you open it.
When you sign in to the project pages
We ask Google for your name, email address and basic profile, and nothing else. Google also sends your full name and picture, which we don't keep. We get no access to your mail, files or calendar, and we can't read anything of yours at Google after you've signed in. We discard Google's access token straight after sign-in.
- What we keep: your email address and first name, in a signed cookie in your own browser. There's no account database on our server.
- The invite list: if you're invited, we keep your email address, name, time zone and a short label for you in a private setting at our host. We enter these ourselves.
- If you're not invited: we show your email address back to you and don't store it. Our log records only that someone was turned away.
We don't sell your information or use it for advertising.
Cookies on the project pages
| Cookie | What it's for | How long |
|---|---|---|
sessionid | Keeps you signed in | 30 days, or until you sign out on that device |
csrftoken | Protects forms from forgery | About a year |
Neither one tracks you. We use no other cookies.
When you send a request
Please read this part, because it's where your own words go.
AI agents read your requests. Arcane Engineering is run by one person, Marco Lamina, working with a team of AI agents. The agents working on your request read it and act on it, and Marco doesn't read every step before they do.
Your request is stored on GitHub as an issue in a private repository, with your name and our label for you. Your email address isn't included. It stays there until someone deletes it. We set no time limit.
Your request can be copied. An agent can quote it in our other issues, code changes and internal notes, and on the computer the agents run on. Most of these places are private, but not all of our repositories are. If something has to stay confidential, tell us before you send it.
These outside services can see what you write:
| Service | What it sees | When |
|---|---|---|
| Heroku | Your request, in passing, because it runs the site | Always |
| GitHub | The full text | Always |
| Anthropic (Claude) | Whatever the agents working on your request read | Always |
| OpenAI | Request text and call audio | If Marco's voice assistant looks up your request on a call |
| Telegram | The item, as a message to Marco | If your request becomes a question for him |
| Google and other image tools | A description of your request | If we do design work for it |
| ElevenLabs | A script that mentions your request | Only in audio tests, which aren't a regular part of our work |
| Search tools, such as Exa | Search terms an agent writes, which could echo your request | If an agent searches while working on it |
AI training. The settings that would let Anthropic and OpenAI train their models on this material are off. Under their published terms, they keep it for about 30 days, and longer if their safety systems flag it or the law requires it. We can't control or verify what these services do beyond their terms.
If you email or meet with us
The project pages don't feed these, but if you deal with us outside them, your contact details and what you say may be held in Gmail, in our meeting-notes tools (Otter and Recall.ai) and in Attio, our customer records.
Getting your information removed
Write to privacy@arcane.engineer and a person will handle it. There's no form for this yet.
- Your access ends as soon as we remove you from the invite list. Any cookie left in your browser stops working.
- Your requests can be deleted from GitHub.
- Logs drop off by themselves.
What we can't fully remove: quotes in our code history, which we don't rewrite; copies in other issues that we can't find; what's in the agents' working records; and what outside services hold under their own terms. We'll tell you what we removed and what we couldn't.
Changes
If this policy changes, we'll update this page and its date. If a change affects invited clients, we'll tell them.
Contact
Arcane Engineering LLC, privacy@arcane.engineer