Privacy Policy

1. Data Controller

Max Freytag · Valparaisostr. 6 · 22761 Hamburg · Deutschland · dailygestures.support@gmail.com

If you have questions about your data, contact us at the email above.

2. Data We Collect

Account Data

When you sign up via Google or email/password we store your email address, display name, and a Firebase UID. This data is processed based on Art. 6(1)(b) GDPR (contract performance).

Practice & Study Data

We store metadata about your drawing sessions: category, reference mode, tool used, duration, timer mode, and timestamps. This enables your Stats page and helps us improve the product (Art. 6(1)(f) GDPR — legitimate interest).

Sketchbook Data

Drawings you save are stored as JPEG images in Firebase Cloud Storage, along with thumbnails and metadata (category, tool, dimensions, timestamps). Stored under Art. 6(1)(b) GDPR.

Payment Data

When you subscribe to Pro or VIP, payment is processed by Stripe, Inc. We store your Stripe customer ID, subscription status, and billing period end date. We do not store credit card numbers or bank details — those are held exclusively by Stripe. See Stripe's Privacy Policy.

Local Storage

Tool settings, app preferences, and cookie consent state are stored in your browser's localStorage. Drawing recovery data (layers, session metadata) is stored in IndexedDB. This data never leaves your device unless you explicitly save to the cloud.

3. Cookies & Analytics

Essential Cookies

Firebase Authentication sets cookies required for sign-in sessions. These are strictly necessary and exempt from consent under Art. 5(3) ePrivacy Directive.

Analytics (Opt-In)

With your consent, we use Firebase Analytics (Google LLC) to collect anonymous usage data: page views, feature usage, and session metrics. No personal data is sold or shared. You can withdraw consent at any time via Settings → Cookie Settings. Legal basis: Art. 6(1)(a) GDPR (consent).

4. Third-Party Processors

• Google / Firebase (USA) — Authentication, Firestore database, Cloud Storage, Analytics. Data processed under EU Standard Contractual Clauses.
• Stripe, Inc. (USA) — Payment processing for subscriptions. See Stripe Privacy Policy.
• Unsplash, Inc. (Canada) — Reference images for drawing practice. Only search queries are sent; no personal data is shared.
• Vercel, Inc. (USA) — Hosting and serverless functions.

5. Data Retention

Account and sketchbook data are retained for as long as your account exists. Study statistics are retained indefinitely for analytics purposes but can be deleted upon request. When you delete your account, all associated data (profile, studies, sketchbook images, Stripe subscription) is removed within 30 days.

6. Your Rights (GDPR)

Under the GDPR you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten", Art. 17)
• Restrict processing (Art. 18)
• Data portability — receive your data in a structured format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time without affecting prior processing (Art. 7(3))
• Lodge a complaint with your local Data Protection Authority

To exercise any of these rights, email dailygestures.support@gmail.com.

7. Children's Privacy

DailyGestures is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

8. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Continued use of DailyGestures after changes constitutes acceptance of the revised policy.