Draft — not yet reviewed. This privacy policy is a working draft for the product owner's legal review. It was written by reading the app's own code and infrastructure, so it is accurate about what the software does, but it has not been checked by a lawyer and is not legal advice.

Two things must be settled before this is published as binding: the name and address of the operating legal entity, and a review against the privacy law of every place the app is offered.

The short version

Your training happens on your phone and stays there. The app has no account unless you choose to make one, and a guest account sends nothing to a server at all. This website sets no cookies and runs no analytics. There are no adverts anywhere, and nothing is sold or shared with data brokers.

This website

What it does not do

painterseye.app sets no cookies, loads no third-party scripts, fonts or trackers, and runs no analytics. There is no advertising, no tracking pixel and no "sign in with" button. Nothing you read on this site is recorded.

The contact form

When you send a message through the form on the home page, these three things go into an email to the person who runs Painter's Eye:

the name you typed,
the email address you typed, and
your message.

The email is sent through Amazon Simple Email Service and lands in a normal mailbox, where it is kept for as long as it is useful to answer you and then deleted. Your address is used to reply to you and for nothing else: no mailing list, no newsletter, no sharing. The form also sends one number — how many milliseconds the page was open before you pressed Send — and one hidden field that must be empty. Both exist only to turn away automated spam, and neither is stored.

The small program that handles the form writes nothing to its log but the name of an error when one happens. It does not log your message, your name, your email address or your IP address, and those logs are deleted automatically after one month. This website keeps no access logs.

AWS processes this on our behalf and sees the request in transit. Everything is served over HTTPS.

The app

What stays on your phone

Everything you do in a lesson — every answer, every score, your progress, your settings and the optional display name in Settings › You — is written to a database on the phone itself. Training does not need a network connection and does not wait for one. The display name is never sent to a server or to analytics.

If you train as a guest

A guest has no account and no server record of any kind. The app generates a random identifier for the installation so it can tell one install from another; it is not your device's hardware identifier, and it disappears when you delete the app.

If you sign in

Signing in uses Apple or Google through Amazon Cognito. The app asks those providers for one thing: your email address. It does not ask for your name, profile picture, contacts or anything else, and it never sees your Apple or Google password.

What is then stored on our servers, and nothing more:

your email address, held by Cognito;
an account identifier;
which provider you signed in with;
when the account was created and when it was last used; and
the random installation identifiers of the phones you have signed in on.

Your training data is not on our servers. Syncing between phones does not exist yet; when it does, this page will say so before it ships.

Sign-in tokens are kept in the phone's own secure keychain, never in ordinary app storage, and are revoked when you sign out.

Usage data

The app can send anonymous product events — which lesson was started, which was finished, which question people find hard — to PostHog, an analytics service, to work out what to improve. It never sends your individual answers, your name, your email address or your location. Automatic capture, session recording, location lookup and personal profiles are all switched off.

Whether this is on by default depends on where you are. In the EU and EEA, the UK, Switzerland, Quebec, Brazil, South Korea, China, India, Turkey, and anywhere the app cannot tell, it is off until you say yes, and the app asks once. Everywhere else it is on with a notice and can be switched off. Either way the switch is Settings › Privacy › Share anonymous usage data, and you can change your mind at any time.

Sharing your training history on purpose

Settings › Beta testing has a separate, off-by-default option to send your full training history so default difficulty can be calibrated. It sends only when you tap the button, never automatically, and it is a different thing from the anonymous usage data above.

Crash reports

Crash reporting is not switched on in the current builds. If it is turned on before release, this page will be updated first.

What the app never asks for

No contacts, no location, no microphone, no camera, no advertising identifier, and no cross-app tracking of any kind.

Children

Painter's Eye is not aimed at children and does not knowingly collect anything from anyone under 13.

Deleting your account and your data

In the app, open Settings › Account › Delete account… and confirm. That does two things, in this order:

erases everything stored for you on our servers, including your sign-in identity, and
wipes the training data on the phone and starts it over.

There is no waiting period and nothing is archived. If you are offline or the server cannot be reached, nothing is deleted and the app tells you so, so you can try again.

Two narrower options sit alongside it, under Settings › Your data: Delete training data… clears your lessons but keeps your settings, and Reset all data… returns the app to how it was on the day you installed it. Both are local only. The same section has Export my data…, which hands you your own training history as a file.

A guest has nothing on a server to delete; deleting the app removes everything. If you would rather someone did it for you, or you want a copy of what is held, write to us with the contact form and say so.

Your rights

Depending on where you live you may have the right to see what is held about you, to correct it, to have it deleted, to object to how it is used, and to complain to your data protection authority. Deletion and a copy of your own data are both buttons in the app, so you do not have to ask anyone. For anything else, use the contact form.

The identity of the data controller, the legal bases relied on, and the retention periods above must be confirmed and named before this page is final.

Changes

If this policy changes in a way that affects what is collected, the app will say so before the change takes effect, not after.