Privacy Policy – Procreate Brushes

The short version

• There are no accounts. We never ask for your name, email address or password.
• Your favourites, download history and app settings stay on your device.
• We use analytics to see which brushes people open and download, and a payments SDK to know whether a subscription is active.
• We do not sell personal data, do not run ad networks, and do not use the advertising identifier (IDFA).
• Questions or a deletion request: exesalle@gmail.com.

Who is responsible

The website and the app are operated by an independent developer (contact: exesalle@gmail.com), acting as the data controller for the processing described below. There is no company registration behind this project; the contact address above is the single point of contact for any privacy request.

What the app stores on your device

The following is written to the app’s own storage on your iPad or iPhone and is never uploaded to us:

• brush sets you marked as favourites;
• your download history — the name and date of each set you downloaded (the .brushset files themselves are deliberately not kept, they live inside Procreate after import);
• a cached copy of the catalogue listing so the app opens without a network round trip;
• the artist type you pick during onboarding, used to phrase the interface;
• small flags: whether the notification prompt was already shown, whether the review prompt was shown, which weekly free set is current.

This data is removed when you delete the app. If you use iCloud or encrypted device backups, it may be included in that backup, under Apple’s terms rather than ours.

What the app sends out

Analytics — AppMetrica (Yandex). The app reports product-usage events: app launch, screen opened, search performed (including the text of the search query and the number of results), category or tag selected, brush preview opened, brush download started / completed / failed, brush added to or removed from favourites, brush shared, paywall opened and closed, plan selected, purchase started / completed / failed, purchase restored, notification permission answer, weekly free set shown and downloaded. The AppMetrica SDK adds its own technical context to every event: an SDK-generated device identifier, device model, OS version, app version, language, coarse network type and approximate region derived from the IP address. We use this to understand which parts of the catalogue are worth expanding and where the app is failing people; we do not try to identify individuals from it.

Purchases — RevenueCat and Apple. When you open the paywall or buy a subscription, the RevenueCat SDK exchanges data with RevenueCat’s servers: an anonymous app-user identifier it generates, the App Store receipt, the product identifier, and the resulting entitlement state. Payment itself is handled entirely by Apple — we never see your card details, billing address or Apple Account. See RevenueCat’s privacy policy and Apple’s privacy policy.

Content delivery. Brush previews, catalogue data and .brushset archives are downloaded from our content delivery hosts. As with any web request, the server sees your IP address, the requested file and the standard request headers.

Notifications

The app uses local notifications only, to remind you when the free set of the week changes. They are scheduled on the device itself — there is no push server, no device token is registered, and nothing about your notification schedule leaves the device. You can decline the prompt or turn notifications off at any time in iOS Settings; the rest of the app keeps working.

What the website collects

The website has no accounts, no sign-up form and no newsletter. It does use:

• Google Analytics 4 and Google Tag Manager — page views and standard traffic measurement, including a cookie-based identifier, approximate location from the IP address, referrer, device and browser. See Google’s privacy policy.
• Yandex.Metrika — page views, click map and bounce accuracy. Session recording (“Webvisor”) is switched off, so mouse movement, scrolling and form input are not recorded. See Yandex’s privacy policy.
• A share counter. When you use a share button, the page sends one anonymous line to our own server: the platform you shared to, the page type, the page address, the interface language, the host part of the referring page, and a salted daily hash of your IP address used only to collapse duplicate clicks. The raw IP address is not stored, and the hash cannot be reversed or matched across days.
• Server logs. The web server keeps standard access logs (IP address, time, requested URL, user agent) for operations and abuse handling.

The site does not currently show a cookie consent banner. If you are in a region where you would expect one, you can block these scripts with your browser’s tracking protection or an extension before browsing, or contact us at exesalle@gmail.com.

What we never collect

Neither the app nor the site asks for or accesses your precise location, camera, microphone, photo library, contacts, calendar or health data. The app does not request App Tracking Transparency permission, does not read the advertising identifier (IDFA), contains no advertising SDKs, and does not build cross-app advertising profiles. We do not sell personal data or share it with data brokers.

Why we are allowed to do this (GDPR/UK GDPR)

Where the GDPR applies, our legal basis is:

• Contract — for processing needed to deliver what you asked for: serving the catalogue, downloading a brush set, and validating a subscription so paid content unlocks.
• Legitimate interest — for product analytics and server logs, to keep the service working, understand which content is useful and detect abuse. We keep this to aggregate, non-identifying use.

You have the right to access, correct, delete, restrict or object to this processing, and to data portability. Because we hold no account and no name or email address, the practical way to exercise most of these rights is to write to exesalle@gmail.com with enough context (roughly when you used the app, and from where) for us to locate the relevant records with our analytics providers. You may also complain to your national data protection authority.

Where data goes

Our providers process data outside your country: AppMetrica is operated by Yandex, Google Analytics and Tag Manager by Google, RevenueCat in the United States. Data is transferred under each provider’s own safeguards and terms, linked above. If that is not acceptable to you, do not install the app and block the site’s analytics scripts in your browser.

How long data is kept

On-device data lasts until you delete the app. Analytics events are retained under our providers’ default retention windows. The share log is written to monthly files and kept for operational analysis. Server access logs rotate on the hosting provider’s schedule.

Children

The app and the site are not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with data, write to exesalle@gmail.com and we will remove what we can.

Changes

When the app or the site starts or stops doing something described here, this page is updated and the date below changes. Material changes will also be reflected in the App Store listing. Continuing to use the service after an update means you accept the current version.

Contact

Privacy questions, data requests and complaints: exesalle@gmail.com. The app is listed on the App Store here.