Brushka

Privacy Policy.

A short, plain-language summary of what data Brushka collects, how we use it, and your rights.

Effective: 12 May 2026 · Version 1.0

1. Who we are

The Brushka iPad application (“Brushka”, the “App”) is operated by Aleksei Artemev, an individual developer based in the Socialist Republic of Vietnam (“we”, “us”, “our”). For the purposes of the EU General Data Protection Regulation (GDPR) we act as the data controller for the limited information described below.

Questions or requests about this policy:
support-brushka@appto.you

2. What this policy covers

This policy applies to the Brushka iPad app and to the legal pages hosted at brushka.vercel.app. It does not cover Apple’s App Store, the Apphud subscription platform, or any third-party site you may reach via an external link. Those services have their own privacy policies and apply when you interact with them.

3. Information we do not collect

• We do not ask for your name, email address, phone number, or any other contact information inside the App.
• We do not offer or require user accounts, sign-up, or login.
• We do not access your photo library, microphone, camera, contacts, calendar, or location.
• We do not display third-party advertising and do not share any data with ad networks.
• We do not sell personal information to anyone.

4. Information processed automatically

To run the App and process subscriptions, a limited amount of technical information is processed by us and our service providers:

4.1 Catalog requests to our server

The App fetches the public catalog of brushes, stamps, palettes and fonts from brushka.vercel.app. These requests are served by Vercel, which acts as our hosting provider and records standard server logs (IP address, request path, timestamp, user-agent, HTTP status). Logs are kept by Vercel for a short period for the sole purpose of diagnostics and abuse prevention, and we do not link them to any individual.

Legal basis (GDPR): legitimate interest (Article 6(1)(f)) in operating the service.

4.2 Subscriptions and analytics — Apphud

We use Apphud, Inc. to manage and analyze auto-renewable subscriptions sold through the App Store. When you open the App, Apphud’s SDK generates a vendor-scoped device identifier (Apple’s IDFV) and processes:

• App version, operating system version, device model, and country (from the App Store storefront);
• Subscription events received from Apple (purchase, renewal, cancellation, refund);
• The Apphud paywall identifier and the product you selected.

Apphud does not receive your name, email address or Apple ID. It acts as our processor for subscription receipt validation and analytics. See Apphud’s policy for retention and your rights against Apphud as a processor.

Legal basis (GDPR): performance of a contract (Article 6(1)(b)) — managing the subscription you purchased; and legitimate interest in measuring subscription performance (Article 6(1)(f)).

4.3 Payments — Apple

All purchases inside the App are processed by Apple through your Apple ID and the App Store. We never receive your credit-card number, billing address, or full Apple ID. From Apple we receive only an anonymized transaction receipt that confirms whether your subscription is currently active. Apple’s own privacy policy governs payment processing: apple.com/legal/privacy.

4.4 Local data on your device

The App stores the following on your iPad only — none of this leaves the device:

• A cached copy of the public catalog (SwiftData).
• Your locally-marked favorites.
• Cached preview images and downloaded brush/stamp/palette/font files in the App’s Documents and Caches folders.
• A flag indicating whether you have completed onboarding (UserDefaults).

You can remove all of this at any time by deleting the App or by using Settings → Clear cache inside the App.

5. How long we keep information

We do not retain personal information on our own servers. Vercel access logs are kept by Vercel for the period stated in its policy (typically up to 30 days). Apphud retains subscription analytics for as long as needed to operate the subscription service and as required by tax/accounting rules. Apple retains payment records under its own retention schedule.

6. International transfers

Vercel and Apphud are based in the United States and may process the technical information above in the United States or other jurisdictions. Where you are in the European Economic Area, the United Kingdom, or Switzerland, transfers are protected by the providers’ Standard Contractual Clauses or equivalent safeguards published in their own policies.

7. Your rights

7.1 European Economic Area, United Kingdom, Switzerland (GDPR / UK GDPR)

If you are a resident of these jurisdictions, you have the right to:

• access the personal data we hold about you (Article 15);
• request correction of inaccurate data (Article 16);
• request erasure (Article 17);
• request restriction or object to processing (Articles 18, 21);
• data portability (Article 20);
• withdraw any consent at any time;
• lodge a complaint with your national data protection authority.

Because we do not collect direct identifiers, we may need additional information to locate any data linked to your device (for example, your Apphud user ID, which you can find by contacting us from the email tied to your Apple ID purchase receipt). Without such information we may be unable to fulfil the request — Article 11 GDPR.

7.2 California residents (CCPA / CPRA)

In the last 12 months we have not sold or shared personal information as those terms are defined under the California Consumer Privacy Act. We collect only the device-level technical information described in Section 4, and we do not use it for cross-context behavioral advertising. You have the right to know, delete, and correct, and the right not to be discriminated against for exercising your rights. Submit requests to the contact email above.

7.3 Other jurisdictions

If your local law gives you additional rights (for example, Brazil’s LGPD or Canada’s PIPEDA), please contact us and we will respond in accordance with the applicable law.

8. Children

Brushka is intended for users aged 13 and over. We do not knowingly collect information from children under 13. If you believe a child has used the App and provided information to us, contact us and we will delete it.

9. Security

Our backend uses TLS for all data in transit. Catalog data is public and contains no personal information. Local data on your iPad is protected by the standard iOS data-protection class associated with your device passcode. No system is perfectly secure, so we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy when we change how the App works or to reflect new legal requirements. The “Effective” date at the top of this page indicates the version in force. Material changes will be highlighted inside the App or on this page.

11. Contact

If you have any question about this Privacy Policy or want to exercise your rights, write to us:

Aleksei Artemev — Brushka
support-brushka@appto.you