StepArtPrivacy Policy
Last updated: 18 October 2026
This policy explains what data the StepArt mobile app (“StepArt”, “the app”) and its servers collect, why, who it is shared with, how long it is kept and how you can have it deleted. StepArt is developed and operated by [OWNER — full name or company, country] (“we”). Contact: support@stepart.app.
In short: you do not create an account with a name, email or password. StepArt works with a random identifier. We do not sell your data and do not show personalised ads.
1. Data we collect
| Data | Why |
|---|---|
| Account identifier — a random ID created on your device by the Apphud SDK, and our internal user ID and random multiplayer ID linked to it | To keep your progress, energy, purchases and unlocked lessons on our server and recognise your device on its next start. |
| Age group — child, teen or adult (we never store your birth year or age) | To decide which features, ads and purchases are allowed (see section 5). |
| App activity — lessons opened and completed, scores, energy and coin balances and their history, unlocked lessons and cosmetics, daily rewards | To run the app: open lessons, count your progress, give rewards. |
| Purchases and subscription — subscription status, product, store, expiry date, purchase transaction IDs | To give you what you paid for and restore it. Payment details stay with Google Play; we never see your card. |
| Drawings in multiplayer — the strokes of drawings made in multiplayer modes, the lesson and timing | Other players draw next to recordings of earlier players (“with anyone” mode). Recordings are stored under a pseudonymous ID, without your name. |
| Multiplayer profile — display name (randomly generated, you can change it), avatar, colour and brush trail you choose | Shown to the other players in a live match. |
| Usage analytics — app events such as onboarding answers, lessons started and finished, paywall views, and our user ID | To understand what works and improve the app (Firebase Analytics, see section 3). |
| Technical data — IP address, device platform, request time in server logs | Security, rate limiting and troubleshooting. |
We do not collect your name, email, phone number, contacts, location, photos or microphone. StepArt does not use the advertising ID: its collection is switched off in Firebase Analytics, ad personalisation signals are off, and the Apphud SDK runs without collecting device identifiers.
2. Data stored only on your device
Your drawings in progress, finished pictures and their thumbnails, settings, streak, achievements and collection are stored on your device. If you turn on “save to gallery”, finished pictures are saved to your phone's gallery. This data may be included in your Android device backup, depending on your device settings.
3. Who we share data with
- Google Play (Google LLC) — app distribution, payments and subscriptions.
- Apphud — subscription management: receives the random account ID and your purchase and subscription information. Apphud privacy policy.
- Firebase Analytics (Google LLC) — usage analytics, without the advertising ID. Google privacy policy.
- Google AdMob — only for users in the child and teen age groups who choose to watch a rewarded video; requests are tagged as child-directed / under the age of consent, so ads are not personalised.
- Hosting — our servers run at Timeweb Cloud; encrypted backups are stored in Cloudflare R2.
- Other players — see your multiplayer display name, avatar, colour and, in “with anyone” mode, the strokes of your recorded drawings, but never your account identifiers.
We do not sell or rent personal data. We may disclose data if required by law.
4. How long we keep data
- Account data (identifiers, age group, progress, balances, purchases): while you use StepArt, until you ask us to delete it.
- Sign-in sessions: until they expire; revoked ones are removed after 7 days.
- Rewarded-video records and multiplayer entry records: 90 days.
- Records used to avoid counting a lesson twice: 30 days. Store notifications about subscriptions: 7 days.
- Multiplayer drawing recordings: until you delete your account.
- Server logs: rotated, kept only for a few days.
- Encrypted backups: up to 3 months.
5. Children
StepArt asks for your age before anything else and stores only the age group. Under-16 users see no interstitial ads; rewarded videos for them are served by Google AdMob in child-directed mode and are never personalised. Purchases and external links require a parental check for anyone who is not an adult, and changing the age always does. If you are a parent and believe your child has given us data, contact us and we will delete it.
6. Your rights and deleting your data
You can ask us to access, correct or delete your data.
In the app: Settings → Account → Delete account. This deletes, at once, your account and everything linked to it on our servers — progress, balances, opened lessons, items and your multiplayer recordings — and then erases the app’s data on your device.
Without the app: follow stepart.app/delete-account, or write to support@stepart.app with the subject “Delete my data” and your user ID (Settings → Account → User ID). We delete the account and everything linked to it within 30 days and confirm by email. Multiplayer recordings carry only a random pseudonym: once the account is gone, nothing links them to you any more.
Data stored only on your device is removed when you uninstall the app. Deleting your account does not cancel a subscription — cancel it in Google Play.
7. Security
All traffic between the app and our servers is encrypted (HTTPS). Sign-in tokens are short-lived and stored on the server only as hashes. Backups are encrypted before they leave the server.
8. Changes
We may update this policy. The date at the top shows the latest version; important changes will also be announced in the app.