Privacy

Android privacy policy

Last updated: November 4, 2026

Illustrarium is developed and operated by Sergey Epifanov. This policy covers the Illustrarium Android app and the shared services it uses. Website visitors and iOS users can read the general privacy policy. For privacy questions or requests, email [email protected].

Android access and device storage

You can explore the canvas and use the player access options presented in the app. Eligible guests can participate without provider registration where guest access is available. Continue with Google saves or restores a player using Google Credential Manager and Firebase Authentication. Linking an unused Google identity preserves the guest; linking an identity with an existing player offers a confirmed merge. Purchase availability for guests depends on the access options offered to that player.

The Android app stores authentication state, preferences, camera position, color-only cached artwork, hidden-contributor choices, pending operations, and relevant purchase or notification state in private app storage. Guest recovery capabilities are encrypted using a non-exportable Android Keystore key; the server stores a hash of the recovery secret. Recovery rotates that secret. Linking or deletion prevents guest recovery from reopening the account. Backup and device-transfer rules exclude the app's data. Ordinary app updates retain local state, while uninstalling, clearing app data, device loss, or a storage failure can remove it. Save a guest with Google for cross-device recovery. A replacement guest does not automatically inherit a lost player's artwork, paint, purchases, or another device starter grant.

Android age confirmation and terms

Illustrarium is for adults aged 18 and older. On the welcome screen you confirm whether you are 18 or older and separately accept the Terms of Service and Community Guidelines before participating. Android age admission is a self-declaration; we do not verify your age through your Google account or request a date of birth or identity document. The app saves the coarse adult or underage decision locally. The age answer is not sent to Firebase or RevenueCat; terms acceptance is recorded separately against your player. An underage answer denies participation. If you believe a child has supplied personal information, contact us.

Before admission, the welcome screen can download a small view of the same public color-only artwork used on the website. Google receives the connection information needed to deliver it, and the HTTP cache can retain the public file. This does not create a player, initialize Firebase, enable purchases, or register notifications. You can access privacy information and the external account-deletion request path without accepting the terms or confirming adulthood.

Play Integrity and device recall

Firebase App Check uses Google's Play Integrity service to attest Android requests. Integrity checks can include app recognition, package and signing information, app version, Play licensing, device-integrity verdicts, and request-bound tokens. We use these results to protect the shared service against tampering, fraudulent grants, and abuse, rather than for advertising.

For guest access protected by device recall, Google stores a small device-associated state recording starter eligibility, provider-sign-in requirements, or restrictions. That state can survive app reinstallation or device reset and is separate from the local guest credential. Device recall does not give Illustrarium a readable permanent hardware identifier or your Google Account identifier. Relevant security state can remain after player deletion to prevent repeated starter grants or evasion; deletion does not require you to register with Google, although further participation can require sign-in. Contact Support if a restriction is mistaken or needs review. See Google's device-recall information.

Your player and public artwork

A player identifier links your public nickname, artwork ownership, paint balance, farming and challenge progress, activity, purchases, and account restrictions. The service stores pixel coordinates, colors, placement prices, ownership and operation identifiers, and timestamps. Canvas coordinates describe positions in the artwork, not your physical location. Other players can see the shared artwork, contributor identifiers and public nicknames, rankings, and activity involving their pixels. Do not put personal or confidential information in a public artwork.

When you sign in with a supported provider, Firebase Authentication processes the provider identifier, authentication tokens, and profile information returned by that provider, which can include your name and email address. Your provider name and email are not used as your public nickname. The app assigns an editable nickname such as Guest19364.

Private linked placement history records ownership periods and earlier color and price information. It allows player deletion to restore a valid predecessor without overwriting a newer player's work. Reports include the selected mark, surrounding artwork, relevant player references, the reason and explanation you submit, and review information. Reports are reviewed and can lead to content removal or account restrictions. Hiding a contributor changes your view on that device; it does not remove their artwork for everyone.

After you accept the Terms of Service and before your first shared-canvas contribution, we record the accepted version and a server-recorded acceptance time against your player. Account linking and merging preserve applicable acceptance records and their original contributor references. Your age declaration is separate from this acceptance record; we do not upload an exact age or date of birth.

Purchases

Apple handles App Store checkout on iOS; Google handles Google Play checkout on Android. Illustrarium does not receive your payment-card details. RevenueCat validates transactions, manages permanent color entitlements and eligible restoration, and provides purchase-history dashboards and analytics to the developer.

RevenueCat processes an app customer identifier linked privately to your player, transaction and product identifiers, purchase history, entitlement status, store and environment, and technical context such as app version, operating-system version, locale, and currency. Our backend keeps customer mappings and transaction-grant records to deliver purchased benefits once and prevent replay or fraud. Paid colors are permanent unlocks while your player and the relevant service remain available; paint packs are consumable. Restoration does not grant consumed paint again.

Deleting your player does not erase the store's transaction records or itself request a refund. For purchase or refund help, visit Support. See Apple's privacy policy, Google's privacy policy, and RevenueCat's privacy policy.

Notifications and technical information

If you enable overpaint notifications, the app registers an installation identifier and push token with Firebase Cloud Messaging; iOS delivery also uses Apple Push Notification service. The backend associates that registration and your notification preferences with your player. A push message can include an activity identifier so the app can retrieve the relevant event. Paint-ready reminders are scheduled locally by the operating system. You can change notification choices in the app and permissions in your device settings.

Firebase Authentication, Installations, App Check, Messaging, and backend infrastructure process technical identifiers, app and operating-system information, attestation signals, service-usage information, request metadata including IP addresses, and security or error logs as needed to authenticate requests, deliver notifications, operate their services, and prevent abuse. Exact SDK processing depends on the service and configuration. Illustrarium does not include a separate Firebase Analytics or Crashlytics product, advertising integrations, or intentional advertising-identifier collection. See Firebase's privacy and security information.

Security

App requests to the shared service use encrypted HTTPS connections. Firebase authentication and App Check protect backend requests; server-side authorization controls access to private player records. Administrative access is restricted to authorized operators who need it for support, moderation, security, or service operations. Guest recovery secrets are protected in device storage and represented by hashes on the server. These safeguards reduce risk but cannot guarantee absolute security. Never send passwords, recovery secrets, or verification codes in a report or support email.

Purposes, legal bases, and recipients

We use account, artwork, progress, and purchase data to provide shared play and the benefits you request; where applicable, this processing is necessary to perform our contract with you. Security, abuse prevention, purchase replay controls, moderation, service maintenance, and support rely on legitimate interests in protecting and operating the service, except where a legal obligation requires processing. Optional features rely on consent where applicable; you can withdraw that consent without affecting earlier lawful processing. Terms acceptance is not blanket consent to unrelated personal-data use.

Service providers include Google/Firebase for authentication, database and backend hosting, app attestation, messaging, and operational logs; RevenueCat for purchase management and purchase analytics; Apple and Google for their platform and store services; Cloudflare for website hosting and security; and email providers for support correspondence. Authorized operators can access records needed for their duties. Other players receive the public artwork, contributor information, and relevant gameplay activity described above. Information may also be disclosed when required by law or to address fraud, abuse, or threats to safety.

Providers operate internationally, so information can be processed outside your country, including in the United States. Their privacy and data-processing terms describe applicable transfer safeguards, including contractual safeguards. We do not sell personal information or use it for cross-app advertising tracking. The Terms of Service explain contribution licensing and artwork reuse; that licence does not authorize retaining or reusing personal data contrary to privacy law.

Retention

Player records, progress, and linked ownership history remain while needed to operate your player and the persistent canvas, unless erased through deletion. Reachable history has no arbitrary time or depth cutoff while needed for valid rollbacks; disconnected history can be pruned. Acceptance records remain with the player, including applicable merged-player references, and are erased with that player. Notification registrations remain until replaced, removed, or erased. Any legacy recovery hashes remain private until removed with the player.

Private administration logs record player creation, successful placements, paint rewards, moderation actions and reasons, relevant identifiers, coordinates, color or price changes, and event times. They are configured to expire after 90 days, although database cleanup can occur later. Player deletion also removes associated gameplay and moderation log entries. Request-limit counters are configured to expire after 24 hours, with asynchronous cleanup.

Minimal hashed transaction markers prevent repeat grants for already-consumed purchases. Hashed deletion barriers, completion receipts, and necessary rollback boundaries protect against stale-session recreation and verify deletion. These minimized records remain while needed for those integrity purposes and have no fixed expiry; hashing does not necessarily make data anonymous. Necessary device restriction state can also remain as described in the platform sections. These controls do not preserve an active player or usable wallet.

Operational logs, provider backups, and support correspondence are separate from the live player database. They are retained according to service settings, provider policies, and the need to resolve a request, dispute, or security incident. Backup copies are removed or overwritten through provider processes rather than immediately with the live record. Contact us for information about a particular request.

Delete your player and associated data

In Android, open About Illustrarium and choose Delete account. In iOS, open About the canvas and choose Delete player and data. Confirm the deletion request. If you cannot access the app or have uninstalled it, use the deletion-request instructions on Support to contact us without reinstalling. We may need to verify your relationship to the player without asking for your password or recovery secret.

When an in-app request is accepted, access is disabled and sessions are revoked. Background cleanup removes the player's private records, activity and report references, recovery credentials, notification registrations, acceptance records, and customer mappings, and requests RevenueCat customer erasure. Deleting a merged player covers its absorbed guest records and associated processor customers. Visible pixels roll back to a previous valid placement or become empty; already-overpainted marks do not replace newer work.

Deletion is not immediate: Firebase Authentication removal waits at least 65 minutes for token safety, and artwork rollback and processor cleanup can take longer while jobs run or retry. The in-app status remains pending until the automated cleanup completes. Other devices can retain cached data until they reconnect and handle deletion. Contact Support if a request remains pending or you need an update on an email request. The limited security, purchase, backup, and legal retention described above still applies; store purchase records are controlled separately by Apple or Google.

Your choices and rights

You can change your public nickname, manage notifications, hide contributors, report content, and request deletion. Depending on applicable law, you can request access, correction, erasure, restriction, objection, or a portable copy; withdraw consent where processing relies on it; and complain to your local data-protection authority. Send a request to [email protected]. We may verify your relationship to the data and will explain any retention required. Guest accounts do not require contact details, so identifying a player after credential loss can be difficult.

Support and policy changes

If you email us, your address, message, attachments, and voluntarily supplied troubleshooting information are used to respond and handle related follow-up. Share only what is necessary; you can request deletion of correspondence. We update this policy when our practices change and bring material changes to your attention as required. The date above identifies this revision.

Visiting illustrarium.com

This static website includes a read-only, cached color-only snapshot of the shared canvas, delivered from Google Cloud Storage and refreshed about once a minute while visible. It excludes player identities, nicknames, prices, and private records. Cached artwork can remain visible briefly after changes or removal. Visiting does not create a player or Firebase guest account, query the gameplay database directly, process purchases, or load Firebase client SDKs. The site has no analytics scripts, advertising, sign-in, contact forms, or application-set cookies.

Cloudflare Pages processes connection and request information such as IP address, browser information, requested URL, time, and security events to deliver and protect the site. Google processes connection information needed to deliver public artwork. These services maintain operational information under their settings and policies. External links and email involve the receiving service's own processing. See Cloudflare's privacy policy and Google's privacy policy.