ArbiScan is provided by DCMA Technology Limited. This notice covers optional accounts and shared mobile/web subscription access, in addition to our mobile privacy policy.
Sign-in information
Amazon Cognito in Singapore manages your email account, email verification and password authentication. You may instead sign in with Google. Google provides an account identifier, email address and verification status through Cognito; we request only basic sign-in information, not access to Gmail, Drive or your contacts. ArbiScan does not receive your Google password. Email/password requests travel over HTTPS to our account service and Cognito; passwords are not stored in ArbiScan's account database or web session store.
Shared subscriptions
When you choose to link your mobile device, our service binds your account identifier to the existing RevenueCat customer identifier. RevenueCat and your original app store remain responsible for purchase verification and payment records. Linking does not create a new subscription, change its billing channel, or share payment-card details with us. Connecting Google to an existing account requires signing into both accounts. Matching email addresses alone do not merge purchases.
For a new web subscription, we create an opaque billing identifier for your signed-in account. RevenueCat and Stripe receive this identifier and your account email to process and verify the subscription. Stripe handles payment-card details; ArbiScan does not receive or store your full card number. Verified subscription status is shared across web and supported mobile apps using the same ArbiScan account. A mobile installation is not required to subscribe or use Pro on the web.
Storage and retention
Account-to-purchase mappings, verification results and OAuth requests are stored in encrypted AWS DynamoDB tables. OAuth requests expire after ten minutes. Processed billing webhooks are retained for thirty days and link audit records for ninety days; expiry-based removal may take additional time. Account and purchase mappings remain while required to provide and protect shared access. Backups can retain earlier records. Web authentication tokens are encrypted on our server; your browser receives only a Secure, HttpOnly session cookie with a maximum seven-day lifetime. The mobile app stores account credentials in operating-system secure storage. Signing out removes the local session and revokes its refresh token.
Your choices
Guest access remains available. Saved filters and bookmarks stay on your device. Signing out or deleting the app does not cancel a subscription. Cancel web subscriptions through Stripe using Manage subscription in your account; Apple and Google subscriptions remain managed through their original store. To request access to or deletion of account data, contact support@dcma.app using your account email; we will verify ownership before acting. Stripe, store and RevenueCat transaction records follow their own retention requirements. Do not send passwords, payment-card details or exchange API keys.