Privacy Policy

1. Data Controller

Max Freytag · Valparaisostr. 6 · 22761 Hamburg · Deutschland · dailygestures.support@gmail.com

If you have questions about your data, contact us at the email above.

2. Data We Collect

Account Data

When you sign up via Google or email/password we store your email address, display name, and a Firebase UID. This data is processed based on Art. 6(1)(b) GDPR (contract performance).

Practice & Study Data

We store metadata about your drawing sessions: category, reference mode, tool used, duration, timer mode, and timestamps. This enables your Stats page and helps us improve the product (Art. 6(1)(f) GDPR — legitimate interest).

Sketchbook Data

Drawings you save are stored as JPEG images in Firebase Cloud Storage, along with thumbnails and metadata (category, tool, dimensions, timestamps). Stored under Art. 6(1)(b) GDPR.

Donations

DailyGestures is free to use. Signed-in users are shown an optional Ko-fi donation panel on the home screen. This panel is embedded directly from Ko-fi (ko-fi.com) in an iframe, so while it is displayed Ko-fi receives your IP address and may set its own cookies in your browser, governed by their privacy policy. If you choose to donate, the payment is processed entirely by Ko-fi on their platform — we never receive or store your payment details. See Ko-fi's Privacy Policy.

Local Storage

Tool settings, app preferences, and cookie consent state are stored in your browser's localStorage. Drawing recovery data (layers, session metadata) is stored in IndexedDB. This data never leaves your device unless you explicitly save to the cloud.

3. Cookies & Analytics

Essential Cookies

Firebase Authentication sets cookies required for sign-in sessions. These are strictly necessary and exempt from consent under Art. 5(3) ePrivacy Directive.

Analytics (Opt-In)

With your consent, we use Firebase Analytics (Google LLC) to collect anonymous usage data: page views, feature usage, and session metrics. No personal data is sold or shared. You can withdraw consent at any time via Settings → Cookie Settings. Legal basis: Art. 6(1)(a) GDPR (consent).

4. Third-Party Processors

• Google / Firebase (USA) — Authentication, Firestore database, Cloud Storage, Analytics. Data processed under EU Standard Contractual Clauses.
• Ko-fi Labs (UK) — Embedded donation widget and payment processing for voluntary donations, shown on the home screen to signed-in users. See Ko-fi Privacy Policy.
• Unsplash, Inc. (Canada) — Reference images for drawing practice. Only search queries are sent; no personal data is shared.
• Vercel, Inc. (USA) — Hosting and serverless functions.

5. Data Retention

Account and sketchbook data are retained for as long as your account exists. Study statistics are retained indefinitely for analytics purposes but can be deleted upon request. When you delete your account, all associated data (profile, studies, sketchbook images) is removed within 30 days.

6. Your Rights (GDPR)

Under the GDPR you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten", Art. 17)
• Restrict processing (Art. 18)
• Data portability — receive your data in a structured format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time without affecting prior processing (Art. 7(3))
• Lodge a complaint with your local Data Protection Authority

To exercise any of these rights, email dailygestures.support@gmail.com.

7. Children's Privacy

DailyGestures is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

8. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Continued use of DailyGestures after changes constitutes acceptance of the revised policy.