Privacy Policy
Effective from: March 2026
Simon Sketch collects only what it needs to work: your email for the account, your coin balance and the photo you upload for a portrait. We show no ads, do not track you and never sell data.
1. Controller
Simon Sanda s.p., Velika Pirešica 27R, 3310 Žalec, Slovenia, registration number 9583866. Contact: info@simonsanda.com.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email, internal account id, sign-up date | Account and sign-in with an emailed code | Performance of a contract (Art. 6(1)(b) GDPR) |
| Coin balance, coin use, guide records (time, number of steps drawn) | Coins and refunds | Performance of a contract |
| Purchases: pack, transaction id, date | Crediting purchased coins | Performance of a contract |
| The photo you upload for a portrait | Drawing the portrait steps with AI | Performance of a contract |
| A hashed (one-way) form of your email | Preventing free coins from being claimed repeatedly | Legitimate interest (Art. 6(1)(f) GDPR) |
| Messages you send us | Answering your question or issue | Legitimate interest |
| Website: email and (optional) name on the waitlist | Telling you when the app launches. Kept until launch plus at most 6 months, or until you withdraw consent. | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
3. Portrait photos
Your photo is sent to our server and on to our AI provider Google (Gemini API), which draws the steps. We do not store the photo on our server. Google processes it as our processor under the paid Gemini API terms. Only upload your own photo or a photo of someone who has agreed.
4. Data that stays on your phone
Finished guides, Collections, tracing images, photos of your drawings, mash-up history and settings are stored only on your phone. We have no access to them. The app uses the camera and gallery only when you start it.
5. Wikipedia
When you open a word description in the Mash-up game, the app loads the text and image directly from Wikipedia. Wikimedia Foundation then sees your IP address and the word. The Wikimedia privacy policy applies.
6. Processors and transfers outside the EU
| Processor | Role | Location |
|---|---|---|
| Supabase Inc. | Servers, accounts, database | EU (Frankfurt, eu-central-1) |
| Google (Gemini API) | Drawing portrait steps | EU / USA |
| Google (Workspace) | Sending sign-in code emails | EU / USA |
| Google Play | Payments (Google is the seller and does not share card details with us) | EU / USA |
| RevenueCat Inc. | In-app purchase records | USA |
| HighLevel Inc. (GoHighLevel) | Website and waitlist | USA |
Transfers to the USA rely on EU standard contractual clauses or the EU–US Data Privacy Framework.
7. Retention
We keep account data until you delete your account. On deletion we erase your email, coins and guide records. We keep only the hashed form of your email, from which the email cannot be read. Google Play keeps purchase records as the seller under its own rules. Server logs (no photos) are kept for up to 30 days.
8. Children
The app is for users aged 13 and over. Users under 15 need the consent of a parent or guardian (Art. 8 GDPR and the Slovenian ZVOP-2). If we learn that a child under 13 has an account, we delete it.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Write to info@simonsanda.com; we reply within 30 days. You can complain to the Slovenian Information Commissioner (ip-rs.si) or your local data protection authority.
10. Security
Connections are encrypted (HTTPS). In the database each user can only see their own data, and only our server can change it.
11. Changes
We tell you about important changes in the app or by email. The effective date is at the top.