Privacy policy

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) for the app and this website is:

Liviusz Lovasz
Humperdinckstr. 7
80807 München
Germany
Email: lancimator@gmail.com

We are not required to appoint a data protection officer.

Summary

• Solo mode — your photos and montages stay on your device. The one exception is when you tap Share on a finished montage: that single montage image is uploaded so the link in your message can open it, and it is deleted after 90 days (section 1.6).
• Usage statistics — the app records a few events (e.g. "montage completed", "paywall opened") against your random account id (pseudonymous: it names no person, but it does link your events together), on our own server, to understand how the app is used. You can switch this off in Settings → Privacy → Send usage statistics (section 1.7).
• Group mode — photos and a chosen display name are sent to our backend (Supabase) so the people in your room can see them. Photos are auto-deleted from the server shortly after the room is finalized (typically within an hour), and at most 24 hours after a room goes inactive.
• Optional geotagging — if you opt in, GPS coordinates are saved locally with each photo. They are not sent to our servers unless you also opt in to sharing a photo's location with your group room.
• Optional crash reports — off unless you say yes. After your first finished montage the app asks once whether to send anonymous crash reports; you can change your answer anytime in Settings → Privacy (section 1.4).
• Bot protection — when the app first connects to our backend, an invisible Cloudflare Turnstile check may run to keep automated fake accounts out. Cloudflare sees technical device signals (such as your IP address) for that check only (section 1.8).
• We do not sell your data and we do not show ads. The app contains no third-party trackers. This website loads Google Analytics only after you accept cookies, and uses cookieless Cloudflare Web Analytics for basic page counts (see section 6).
• Optional in-app purchases — an optional premium unlock and optional donations (a "tip jar"). Payment is handled entirely by the App Store / Google Play; we never see or store your payment details. All core features remain free.

1. What we collect

1.1 Local storage (always)

The app stores the following on your device only:

• Montages — the grid, target color, frame style, and the cell photos you've taken.
• Settings — theme choice, display name, the random anonymous account id we generate the first time you use Group mode, and your crash-reporting / location preferences.
• Upload queue — pending photo uploads in Group mode, until they succeed or you discard them.
• Notification schedule — when you set a deadline on a group montage, a one-hour-before reminder is scheduled with the device's local notification system. The reminder text contains only the room code — no photos or display names. If you turn on reminders (Settings → Reminders), the daily-color, streak and unfinished-hunt reminders, your chosen reminder time and when you last added a photo to an unfinished hunt are kept on the device too.

Color assist camera — when you take a photo with Color assist (on by default; Settings → Capture), the app analyses the live camera view on your device to measure how close the color in the middle of the view is to your target color. The camera view is never stored or sent anywhere; only the photo you take is kept, like any other photo.

You can clear all of this with Settings → Delete account & all data, or by uninstalling the app.

1.2 Backend storage (only in Group mode)

When you create or join a Group montage, the following is sent to our backend (Supabase, hosted in the EU — Ireland):

• Anonymous account id — a random UUID generated on first launch. We do not ask for your email, phone number, or any other identifying information. An account that has not been used for 90 days and holds nothing on our server (no purchase record, no room membership, no live share link) is deleted automatically, together with everything stored under it, exactly as if you had used Delete account & all data (reports other players filed about the account are kept as described in section 1.12). Your montages on the device are not affected; the app simply creates a new anonymous account the next time it needs one.
• Display name — the name you choose to be shown to other participants in your rooms.
• Room metadata — grid size, target color, frame style, deadline (if you set one), participant list, who owns which cell.
• Photo uploads — each photo you submit to a Group room is uploaded as a JPEG (max 350 KB). Photos are stored in encrypted-at-rest storage and served via short-lived signed URLs to other participants.
• Votes — in Vote-mode rooms, which candidate you voted for per cell.
• Photo notes and comments — if you add a note to a group photo, or comment on someone's photo in a room with photo sharing on, the text is stored with that room and shown to its participants. Notes are removed with the photo; comments are removed with the room, or earlier when you delete them or your account.
• Per-day counters — number of rooms you created and photos you uploaded each day, for abuse prevention. Retained 30 days.
• IP address — like every internet service, our backend sees the IP address you connect from, and Supabase logs it for security purposes according to their own retention policy. We additionally keep a one-way hash of it (not the address itself) in two places, only to stop abuse of room codes: when someone enters a room code that doesn't exist (kept at most 2 days, to limit code guessing), and when a host removes someone from a room (kept with that room, so the removed person can't simply rejoin under a new account).

1.3 Geotagging (opt-in)

If you enable "Save photo locations" in Settings, the app reads the GPS coordinates of each cell photo and stores them on your device. They are used to show your montages on an in-app map. By default these coordinates stay on your device only and are not included in Group-mode uploads. The map background is loaded from the OpenStreetMap tile servers (OpenStreetMap Foundation): to draw it, your device downloads the map squares for the area on screen, so that server sees your IP address and which area is shown — never the photos or their exact coordinates. Downloaded map squares are cached on your device (at most 64 MB) and deleted by Settings → Delete account & all data.

There is a separate, also-optional setting, "Share photo location with my group". If you turn it on, the location of photos you add in a Group room is uploaded alongside the photo so the other participants in that room can see where it was taken on their map. This applies only to Group mode — your solo montage locations are never uploaded. Coordinates shared this way are stored with the group photo and are removed when that photo is deleted from our backend (shortly after the room is finalized — typically within an hour — and at most 24 hours after a room goes inactive; see section 2).

You can turn either setting off at any time. Turning off sharing stops new uploads; existing coordinates on the device remain until you delete the photo or the app.

1.4 Crash reports (opt-in)

Crash reporting is off unless you agree to it. After you finish your first montage the app asks you once ("Help fix crashes?"), and you can turn it on or off at any time under Settings → Privacy → Send crash reports. If you agree, the app sends anonymous error reports to Sentry (sentry.io) when it crashes or freezes, and when an important action fails — sharing a montage, uploading a group photo, creating a montage, a purchase, or taking a photo. A report contains the error and its stack trace, the OS version, the device model, the app version, and the random anonymous account id. Before a report leaves your device the app strips file paths, internal ids, links and tokens, e-mail addresses and the device name; reports never contain your photos, montages, room codes, display names, location, or device identifiers like IMEI / advertising id. No performance traces, screenshots or tap logs are collected. Turning the setting off stops reporting immediately.

1.5 Notifications

If you create a group montage with a deadline, the app schedules a one-hour-before local reminder using the system notification service. Reminders are off until you turn them on (after your first finished montage, or under Settings → Reminders): a daily note naming the color of the day at the time you choose, an evening heads-up on days your streak would otherwise break, and a nudge a day after your last photo when a hunt is still unfinished. The color of the day is calculated on the device, so these need no server either. The system asks for notification permission the first time you turn any of them on; you can revoke it, or switch each reminder off, at any time. All reminders are scheduled and fired entirely on your device — nothing is sent to a push server.

1.6 Shared montage links (when you tap Share)

When you share a finished montage, the app uploads that one composed montage image (a JPEG reduced to at most 1080 pixels, typically under 150 KB) to our backend together with its target color and color name, and puts a link to it in your message (for example https://colorcollectapp.com/m/?id=…). Anyone you send the link to can open the montage in the app or see it on that web page. The upload starts as soon as you tap Share (so the link is ready when the share sheet opens) and the link is kept for re-sharing the same montage. The individual cell photos, their locations, and your display name are not uploaded. The link id is random and unguessable; links are not listed or searchable. The image and its record are deleted automatically 90 days after sharing. You can take one link down earlier with Stop sharing link on that montage (the link stops working at once and the image is deleted from our server, typically within an hour; a copy someone's browser or a web cache already holds may stay visible for up to an hour), or all of them with Settings → Delete account & all data. If you are offline, the montage is shared as an image without a link and nothing is uploaded.

1.7 Usage statistics (pseudonymous)

To understand how the app is used, it records a small number of events on our own backend (Supabase, EU), keyed only by your random anonymous account id. That id names no person, but it links your events to each other, so these statistics are pseudonymous rather than anonymous: a montage was completed or shared, a group room was created or joined, the premium screen was opened (and from where), the outcome of an in-app purchase attempt (which product, and whether it succeeded or was cancelled — never payment details), the price the premium screen showed and the country of your store account as reported by Google Play or the App Store, that the store could not load a price, that the promo-code screen was opened (never the code itself), whether a premium purchase could be confirmed with the store, plus similar steps such as first launch, finishing the intro, starting a hunt (e.g. from the color of the day), taking a photo (for a Color assist photo, also how close its color was: great, close or far), picking a target color from a photo or the camera, opening the app from a reminder and changing the reminder settings (which reminders are on and at what time), sharing an invite, opening a shared link, and the type of error when a photo, upload or montage fails. Each event also records the device platform (Android or iOS), the app version and the device language/region setting, and the time it happened. On a store test device (Google Play's automated pre-launch testing, or a TestFlight / App Review build) events are additionally marked as such, so they can be left out of the statistics. Events logged while offline are kept on the device (at most two weeks) and sent when the connection returns. Events carry no photos, display names, locations or free text. You can turn usage statistics off at any time in Settings → Privacy → Send usage statistics: the app then drops any events it has not sent yet and sends no more until you switch it back on. They are not shared with anyone and no third-party analytics SDK is used. Individual events are deleted after 180 days, or earlier when you use Settings → Delete account & all data. Before an old month's events are deleted, they are added up into monthly totals per event and platform (for example "montages shared on Android in August: 120, by 80 people") that contain no account id, so they cannot be traced back to you and are kept for long-term trends.

1.8 Bot protection (Cloudflare Turnstile)

To stop automated scripts from creating large numbers of fake accounts and overwhelming the service, the app may run a Cloudflare Turnstile check when it first creates your anonymous account on our backend (for example when you create or join a Group room, share a montage link, or the app sends its usage statistics). The check runs invisibly in a hidden web view inside the app — nothing is shown on screen and you don't have to do anything.

For this check, Cloudflare, Inc. receives technical signals from your device, such as your IP address, the web view's browser (User-Agent) details and connection characteristics, and uses them to tell people apart from bots and to improve its bot detection. The check only returns a one-time token, which our backend verifies; we do not receive or store the signals themselves, and no photos, display names, locations, montages or account ids are sent to Cloudflare. Turnstile is not used for advertising or to track you across apps or websites.

Cloudflare's processing is described in the Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/) and Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/).

1.9 Invite links opened before the app is installed

If you follow a group invite or a shared-montage link before you have the app, the web page passes that link on so the app can open it once installed. On Android it is attached to the Google Play download as the install referrer, which the app reads once, on its first launch. On iPhone, tapping the download button copies the link to your clipboard; the app reads the clipboard only when you tap "Got an invite or link? Paste it" (or the paste button on the Join screen). The link is used only on your device to open that room or montage — joining then works exactly as in section 1.2, and if the invite carries the inviter's anonymous account id, the room records that you joined through their invite. Apart from that, the clipboard contents are not stored or sent anywhere. From the install referrer the app additionally keeps only its campaign tags — the utm_source, utm_medium and utm_campaign values Google Play attaches (for example google-play / organic, or the name of an ad campaign) — and logs them once as a usage statistic (section 1.7) so we can see which channels bring people to the app; nothing else from the referrer is stored or sent.

1.10 Invite rewards

When a friend joins a group room through your invite link and then adds a photo there (or, in an "everyone their own color" room, submits their montage), our server records one invite credit: your anonymous account id, your friend's anonymous account id, the room and the time. Three credits unlock the Prism frame on your device. Each friend can be credited to only one person, and the app can only read your own count ("2/3 friends joined") — never who the friends are. Credits are kept until you use Settings → Delete account & all data, which deletes the credits you earned and removes your id from any credit you gave a friend. The cached count and the unlock are also saved on your device.

1.11 Rematch invites

When someone in a finished group room taps Play again with this group, our server creates the new room and records one invite for each other member of the old room: the new room, the invited member's anonymous account id, the inviter's anonymous account id, the old room and the time. Invited members see the invite on the app's home screen and in My rooms (and, if the old room is still open in the background, as a local notification); nobody outside the old room is invited. An invite disappears when you join or dismiss it, stops showing after 7 days, and is deleted together with the new room (see section 2) or when you use Settings → Delete account & all data.

1.12 Reports and blocks

To keep group rooms safe, you can report a photo, comment, player or shared montage, and block a player (see the Terms of Service).

• A report stores what was reported (its id, the room, and the account id of whoever posted it), your anonymous account id, the optional reason you typed and the time. Reports go only to the developer, who reviews them; the person you reported is not told who reported them. A photo or comment reported often enough is hidden for everyone in the room.
• A block stores your account id, the blocked player's account id, the display name they had when you blocked them (so you can find them in Settings → Blocked players) and the time. Only you can see your block list; the blocked player is not told.
• Text checks — display names, room names, photo notes and comments are checked against a list of offensive words when they are saved, and refused if they match. Nothing is stored about a refused text.

2. How long we keep things

3. Who can see your data

• Local data — only you.
• Group-room photos and votes — only the participants of the room you're in. Anyone with the 6-character room code can join the room and see its contents, so treat the code like a password — only share it with people you want in the montage.
• Cloudflare — receives only the technical signals needed for the bot-protection check in section 1.8, never your photos, names or montages.
• Reports — what you report, and your reason, reaches only us (section 1.12).
• We (the operators) — We do not routinely access user data and do not share it with anyone beyond the service providers listed below.

We use these service providers, each bound by a data processing agreement (or, for Google Play and the App Store, acting under their own terms as payment platforms):

• Supabase, Inc. — backend database, storage and server functions, hosted in the EU (Ireland). Supabase support staff can technically access the database in the course of providing the hosted service.
• Functional Software, Inc. (Sentry), USA — crash reports, only if you opt in (section 1.4).
• Cloudflare, Inc., USA — bot protection in the app (section 1.8) and cookieless page statistics on this website (section 6.2).
• GitHub, Inc. (a Microsoft company), USA — hosts this website (section 6.2).
• Google Ireland Ltd. / Google LLC — Google Analytics on this website, only if you accept cookies (section 6.2).
• Google Play (Google Ireland Ltd. / Google LLC) and the App Store (Apple Inc.) — downloads and purchases.
• OpenStreetMap Foundation — map tiles (section 1.3); an independent service, not a processor.

4. International transfers

Our backend is hosted on Supabase in the EU (Ireland). If you're outside the EU, your data is transferred to and stored in the EU. The bot-protection check (section 1.8) is processed by Cloudflare, Inc. on its global network, so those technical signals may be processed outside the EU, including in the United States. The same applies to opt-in crash reports (Sentry), this website's hosting (GitHub) and page statistics (Cloudflare), and Google Analytics if you accept it. Transfers to the United States rely on the EU-U.S. Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5. Your rights

You can:

• Delete everything in one tap — Settings → Delete account & all data. This wipes every montage, photo, room, setting, and the anonymous account id on this device, and asks our backend to delete every server-side row tied to your anonymous account (participations, photo uploads, votes, abuse-prevention counters, shared montage links, usage statistics, and the auth record itself). This action cannot be undone.
• Delete only local data — uninstall the app, or use the in-app delete buttons next to individual montages.
• Request server-side deletion by email — if the in-app deletion fails (e.g. you have no internet at the time), email lancimator@gmail.com with the anonymous account id from Settings and we will purge the server-side data manually within 30 days.
• Export your data — montages live on your device and can be saved to your gallery via the share sheet. To request a copy of server-side data, email the support address above.

Under the GDPR you also have the right to access the data we hold about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (data portability, Art. 20), and to withdraw any consent at any time without affecting processing done before (Art. 7(3)).

Right to object (Art. 21 GDPR): where we rely on legitimate interests (section 5.1), you can object at any time on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds. For usage statistics you can simply switch them off in Settings.

Because the app does not ask who you are, please include the anonymous account id from Settings → Privacy → Account ID with any request so we can find your data. We answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, https://www.lda.bayern.de), Promenade 18, 91522 Ansbach, Germany.

5.1 Why we may process your data (legal bases)

• To provide what you asked for (Art. 6(1)(b) GDPR) — Group rooms, uploads, votes, comments, shared montage links, invite and rematch features, and checking a premium purchase with the store.
• Your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for access to your device) — crash reports, sharing photo locations with your group, reminders, and Google Analytics on this website. You can withdraw consent at any time with effect for the future, using the in-app setting or the "Cookie settings" link at the bottom of every page on this website.
• Our legitimate interests (Art. 6(1)(f) GDPR) — keeping the service secure and free of abuse (bot protection, per-day counters, hashed IPs, text checks, reports and blocks, server and hosting logs, cookieless page statistics), understanding how the app is used so we can improve it (usage statistics, which you can switch off in Settings), and reading invite links you followed before installing (section 1.9). You can object to this processing at any time (section 5).

6. Cookies & trackers

6.1 In the app

The app does not use advertising identifiers or third-party trackers. The only third-party code that runs is the invisible Cloudflare Turnstile bot check described in section 1.8, which Cloudflare may support with its own strictly necessary cookies inside that hidden web view; it is used only to tell people apart from bots, never for advertising or tracking. We do not integrate Facebook SDK, Google Ads, or similar.

6.2 On this website

Hosting. This website is hosted on GitHub Pages (GitHub, Inc.). When you open a page, GitHub's servers process your IP address, the page requested, the time, and your browser's User-Agent to deliver the page and to protect the service; GitHub keeps these server logs under its own policies. Legal basis: our legitimate interest in delivering a secure website (Art. 6(1)(f) GDPR).

Cookieless page statistics. We use Cloudflare Web Analytics to count page views, referrers and load times. It sets no cookies, does not use local storage or fingerprinting, and does not track you across sites or visits; Cloudflare receives your IP address and browser details with each page view and reports only aggregated numbers to us. Legal basis: our legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR). See Cloudflare's privacy policy.

Google Analytics (only with your consent). If you press Accept on the cookie banner, this website loads Google Analytics (GA4) to understand aggregate traffic — for example how many people visit, which pages they view, and roughly where visitors come from. Google Analytics sets cookies (named _ga and _ga_*, kept for up to 2 years) to do this. Until you accept, the Google Analytics script is not loaded at all, so nothing is sent to Google. If you press Decline (or ignore the banner), it stays off. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Your choice is remembered in your browser's local storage (key cc_consent) so we don't ask again. You can change it at any time with the Cookie settings link at the bottom of every page; declining after accepting stops Google Analytics and deletes its cookies.

We use analytics only in aggregate. We do not use it for advertising, ad personalization, or to build a profile of you — ad_storage, ad_user_data, and ad_personalization stay denied even after you accept. Google processes this data as described in Google's privacy policy. The website does not integrate Facebook SDK, Google Ads, or similar.

7. In-app purchases

ColorCollect offers optional in-app purchases: a one-time premium unlock and a set of optional donations (a "tip jar"). There are no subscriptions, and purchasing is never required — all core features are available for free.

All in-app purchases are processed entirely by the platform's own payment system — Google Play Billing on Android and the App Store on iOS. We never receive, see, or store your payment card or billing details; the store handles the transaction and only tells the app whether a purchase succeeded.

When you buy the premium unlock, the app records that purchase in a flag stored locally on your device so it can remember your entitlement. Because Premium also lets you make a group room Premium for everyone in it (the "Host Pass"), the app sends the store's purchase reference for the premium unlock — the Google Play purchase token or the App Store transaction id, never payment details — to our backend (Supabase, EU). The backend asks Google Play or the App Store to confirm the purchase and then stores the product, the purchase reference, the store environment (e.g. test or production) and the time of the check, keyed by your random anonymous account id. It is re-checked periodically, so a refunded or revoked purchase stops unlocking Premium rooms. Whether a room is Premium is stored with the room and deleted with it. The purchase record is deleted when you use Settings → Delete account & all data (restoring your purchases later checks it again). Separately, the outcome of each purchase attempt (product, price shown and result, no payment details) and whether a premium purchase could be confirmed are recorded in the usage statistics described in section 1.7. Donations are consumable and unlock nothing — they are simply a way to support development.

For your purchase history, refunds, and the data the store itself collects to process payments, see Apple's and Google's respective privacy policies.

8. Children

The app is rated for ages 12 and up. Group rooms and share links are not based on consent, but if you are under 16 you should use them only with a parent or guardian's permission (Terms of Service § 2). We do not knowingly collect data from children under 13. If you believe a child has used the app, email us and we will delete the relevant account.

9. Changes to this policy

Material changes will be announced in the app's release notes and reflected in the "Last updated" date at the top of this document.

10. Contact

Questions, complaints, or deletion requests: lancimator@gmail.com