Privacy policy for Nicola's Number Canvas

1. Information we collect

We collect information in four main categories:

• Account and identity data: email address, Firebase user ID, sign-in method, email verification status, and—if you use Google Sign-In—basic account data needed to authenticate you.
• Profile data: username, bio, avatar photo, or emoji/color avatar settings that you choose to use in the social experience.
• Content and community data: captions, hashtags, comments, comment replies, likes, follows, reports, notification read state, post completion events, and search queries you submit inside the app.
• Canvas and device-side data: imported photos, generated templates, progress, thumbnails, settings, blocked-user lists, local notification preferences, and local caches stored on your device.

2. How we collect it

• Directly from you: when you create an account, edit your profile, import a photo, upload an avatar, comment, search, follow someone, report content, or publish a post.
• From app actions: when the app syncs likes, completions, notification state, or other account activity needed to run the feed.
• From sign-in providers: when Firebase Authentication or Google Sign-In confirms your identity.
• From Apple system services: when you use iCloud sharing, StoreKit purchases, photo selection, or local notifications.

3. How we use data

• To create, save, reopen, and sync digital paint by number canvases.
• To operate accounts, verify email addresses, and keep social actions tied to the right profile.
• To run the feed, search, comments, likes, follows, notifications, moderation tools, and completion counts.
• To let you share projects privately, publish canvases publicly, or import canvases that other people shared with you.
• To show optional rewarded ads, honor a Remove Ads purchase, and keep the service stable and secure.

4. What stays private and what becomes public

If you only create canvases locally, your imported photos, progress, and working files stay on your device. If you choose to use the social feed, your public-facing profile and post activity become visible to other users.

• Public or discoverable data can include: username, bio, avatar, public posts, preview images, captions, tags, comments, follow relationships, like counts, completion counts, and users who liked or completed a post.
• Moderation reports are for safety: report submissions are used to review abuse, spam, or harmful content and are not intended as a public social feature.
• Source photos are treated differently: the app’s social-post export is configured to exclude the original source photo and instead upload derived canvas data and preview assets.

5. Third parties and service providers

Nicola's Number Canvas currently depends on third-party or platform providers for specific features:

• Firebase Authentication and Google Sign-In: account sign-in, token issuance, email verification, and sign-in state.
• Cloudflare: social API delivery, database operations, file storage, uploads, content delivery for social posts and avatars, and related network/security handling for requests sent to the social service.
• Apple CloudKit / iCloud: optional private project sharing and importing shared project files.
• Apple StoreKit: processing and restoring the one-time Remove Ads purchase.
• Google Mobile Ads: loading and showing optional rewarded ads in the free experience.

When service providers process user data for us to run these features, we require them to protect that data in a manner consistent with this policy and Apple’s platform requirements. Some providers may also process data under their own published terms and privacy notices when you use their services through the app.

6. Ads, purchases, notifications, and safety checks

• Rewarded ads: if you use ad-supported features, Google Mobile Ads may receive technical and advertising-related data needed to serve or measure those ads.
• Current tracking and analytics behavior: the current app build does not request App Tracking Transparency permission, and Firebase Analytics is disabled in the current configuration. If that changes, we will update this policy and the app’s App Store privacy disclosures.
• Remove Ads purchase: payment processing is handled by Apple through StoreKit. We receive entitlement information needed to unlock the feature, not your full payment card details.
• In-app and local notifications: the social system stores in-app notification data such as likes, follows, comments, and read state, and the app can schedule optional local reminders on your device.
• Technical request data: when you use cloud-backed features or ad-supported features, service providers may receive technical request data such as IP address, user agent, and similar network metadata needed for routing, security, fraud prevention, delivery, or measurement.
• On-device safety screening: before a public post is uploaded, the app performs an on-device NSFW check on the original image to reduce unsafe content in the feed.

7. On-device storage and permissions

• Photos: the app may request photo-library access so you can choose source images and avatar photos.
• Current iOS permissions: the current build requests photo-library and notification permissions. It does not request camera, microphone, contacts, or location access.
• Local files: imported photos, generated templates, progress files, display settings, cached exports, and thumbnails are stored in the app’s local storage.
• Local preferences: appearance settings, tutorial state, ad-removal state, blocked-user lists, app-open counts, and local-notification scheduling data may be stored in on-device preferences.
• Local processing: if information is processed only on-device and not transmitted off-device, it is used to power features such as canvas creation, progress tracking, and reminder scheduling.

8. Retention and deletion

• Local canvas data: stays on your device until you delete the canvas, clear the app’s data, or remove the app.
• Public posts and social data: stay in the live service while the account or post remains active, subject to moderation and operational needs.
• Deleting a post: removing a post is intended to remove the post record and its uploaded social files from the live service.
• Deleting your account: the current app build includes in-app account deletion. In your profile, open the more menu and use Delete Account to remove the account, associated posts, social records, and uploaded files tied to that account from the live service. Public caches may take a short period to expire.
• If you can still sign in: use the in-app deletion control first. You do not need to contact support just to request deletion from a reachable account.
• If you cannot access the app: start with the public Privacy Choices page, the Support page, or email stevenstrange1998@gmail.com for privacy or deletion guidance.
• CloudKit shares: optional private shares are also subject to Apple’s iCloud sharing controls and availability.

9. Your privacy choices and controls

• You can use the core canvas-creation features without posting to the social feed.
• You choose whether to publish a canvas publicly, share it privately, or keep it only on your device.
• You can edit your username, bio, and avatar inside the app.
• You can report posts and comments for review, block other users locally on your device, delete your own posts, and delete your account from inside the app.
• You can manage photo access and notification permissions in iOS Settings, sign out, and stop using public social features at any time.
• You can restore or use the Remove Ads purchase to stop rewarded ads.

10. Children’s privacy

Nicola's Number Canvas is not presented on this site as a kids-category app. If minors use the app, they should do so only with permission from a parent or guardian where required by applicable law. Public posting, profiles, comments, and sharing features should be used with extra care.

11. Changes and contact

We may update this policy as the app, backend, or App Store requirements change. When that happens, we will update the effective date on this page.

For account deletion, use the in-app controls first. For privacy questions, deletion help when you cannot access the app, or other requests you cannot resolve in the app, start with the public Support page, Privacy Choices page, or email stevenstrange1998@gmail.com. For purchase-specific issues, also see Purchase Help.