1. Who We Are
1.1 MyMiniStudio is operated by HobbyAspirations Ltd., an Ontario, Canada corporation. We are the controller of personal information handled through the MyMiniStudio applications and myministudio.app (the “Service”). Contact for anything in this policy: [email protected].
1.2 The short version: we collect what we need to run accounts, purchases, and support, and little else. Your painting projects live on your device. We do not sell personal information and we do not run third-party advertising or analytics trackers. We do use our own first-party usage analytics and automatic crash reports to improve the Service, and you can turn each of them off in Settings.
2. What We Collect
2.1 Account data: email address and authentication data, managed through our authentication provider. We store your account profile (for example, beta approval status and which features your account is entitled to). If you use the Service before creating an account, we give it an anonymous account: a random identifier with no email or name, so the projects and settings you make there stay yours. If you then create an account, the anonymous one becomes your account, under the same identifier.
2.2 Purchase data: records of what you bought, when, through which channel, and the resulting entitlements. Payments are processed by Apple (in-app) or Stripe (web). We never receive your full card number; for web purchases we receive transaction records from Stripe (such as amount, currency, and a receipt reference).
2.3 Support and correspondence: emails and messages you send us, and beta feedback you provide.
2.4 Technical data: standard server and security logs from our hosting and backend providers (such as IP address, request time, and user agent), used for operating and protecting the Service.
2.5 Crash reports: when the app crashes or hits a serious error, it sends us a crash report so we can fix the problem. A report holds technical details: your device type and memory, operating system, browser, and graphics chip; the app version; the mode and tool you were using and their settings; the names and sizes of the parts in the open scene; and the last lines of the app’s internal log. It is linked to your account when you are signed in. It does not include your models, images, or paint data. Crash reports are on by default, and you can turn them off in Settings (Crash reports).
2.6 Usage analytics: if you leave usage analytics on (you can turn it off any time in Settings), we collect a record of how you use the Service so we can improve it. This covers which features and modes you use, actions like imports, exports, and shares, and counts such as how many projects, paints, or colours you have. Each record is linked to your account. We do not collect the content of your work: not your models, images, paint data, or the names of your projects and files. This analytics is our own and first-party. We do not sell it, we do not share it with anyone, and we do not use it to track you across other apps or websites.
2.7 Optional diagnostics: the Service includes opt-in diagnostic instrumentation (for example, paint telemetry that records technical data about brush strokes). This data is stored on your device and reaches us only if you export it and choose to send it to us.
2.8 Refund window usage: when you buy on the web, the Refund Policy lets you get a refund within 14 days of the purchase if you have used the Service for less than 3 hours since it. To apply that rule, the app counts the minutes in which it was open on your screen and you were using it, and sends that one number to us during those 14 days. It counts nothing else (not what you did, or where), it runs only after a web purchase and only for those 14 days, and it is not part of usage analytics. The analytics setting does not turn it off, because it is part of the purchase terms you agree to when you buy. We keep the number with the purchase record (see 8.1).
3. What Stays on Your Device
3.1 Your projects, imported models, paint data, and content caches are stored locally on your device. We do not receive them. Marketplace models you license are downloaded to a protected local cache on your device.
3.2 If we introduce features that move any of this off your device (such as cloud sync or project sharing), we will update this policy first and the feature will be clearly presented in the Service.
4. How We Use Information
4.1 To provide the Service: accounts, sign-in, entitlements, delivering purchased content, and support.
4.2 To process purchases, apply the Refund Policy (including the refund window usage in 2.8), answer payment disputes, and prevent fraud and abuse, including enforcing content protection.
4.3 To improve the Service, using our first-party usage analytics and crash reports (each of which you can turn off), diagnostics you choose to share, and aggregated backend usage.
4.4 To meet legal obligations, including tax and accounting record-keeping.
4.5 To send Service emails (account, purchase, and security messages). Marketing email, if we ever send it, will be opt-in and every message will have an unsubscribe link.
5. Who We Share It With
5.1 Service providers who process data for us: Supabase (authentication, database, and content storage), Cloudflare (hosting and content delivery), Resend (sending our emails), Apple (in-app purchases), and Stripe (web payments). Each provider processes data under its own contractual and security commitments.
5.2 Marketplace artists receive aggregated sales reporting about their models. We do not give artists your name, email, or other personal details.
5.3 We may disclose information where the law requires it, to protect the rights and safety of users, artists, or the Company, or as part of a corporate transaction (such as a sale of the business), in which case this policy continues to apply to the transferred data.
5.4 We do not sell personal information, and we do not share it with third parties for their own advertising.
6. Legal Bases and Your Rights
6.1 We handle personal information under Canada’s PIPEDA, and where EU or UK data protection law applies, we rely on: performance of a contract (running your account and purchases, including the refund window usage in 2.8), legitimate interests (security, fraud prevention, service improvement, and crash reports, which you can turn off), consent (optional diagnostics, marketing), and legal obligation (tax and accounting records).
6.2 You can delete your account yourself in the app (Account settings, Delete account). You can also ask us to access, correct, export, or delete your personal information, and you can withdraw consent for anything based on consent, by emailing [email protected]. We answer within 30 days. Deleting your account removes access to purchases attached to it, so the app asks you to confirm first.
6.3 You can complain to your data protection authority: in Canada, the Office of the Privacy Commissioner; in the EU or UK, your local supervisory authority.
7. International Transfers
7.1 Our providers process data in Canada, the United States, and the European Union. Our account, entitlement, and usage-analytics data is hosted by Supabase in the United States. Where data protection law requires safeguards for international transfers, we rely on our providers' standard contractual clauses and equivalent mechanisms.
8. Retention
8.1 Account data is kept while your account exists and deleted or anonymized after account deletion, except purchase and transaction records (including the refund window usage number kept with them), which we keep for seven (7) years for tax and accounting law, and records we need to keep for security or legal claims.
8.2 Diagnostics stored on your device are under your control; delete them in the Service settings.
8.3 Usage analytics records are kept for up to fourteen (14) months, then deleted. Before deletion we may combine them into aggregate, non-identifying reports (totals and trends with no account identifiers), which we keep to understand the Service over time.
8.4 Crash reports are kept for up to fourteen (14) months, then deleted.
9. Cookies and Local Storage
9.1 The Service uses cookies and browser storage only for essential purposes: keeping you signed in, remembering settings, and caching content so the Service works offline. We do not use advertising or cross-site tracking cookies. You can clear browser storage at any time; note that clearing it on the web app removes locally stored projects.
9.2 If usage analytics is on, the app also keeps a small analytics record on your device until it is sent to us. Turning analytics off in Settings stops this and clears any records not yet sent.
10. Children
10.1 The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has an account, contact us and we will delete it.
11. Security
11.1 Data is encrypted in transit. Backend access follows least-privilege rules (users can only read their own records; sensitive writes happen only server-side). Premium content is encrypted at rest. No system is perfectly secure; if a breach affects your personal information, we will notify you and the authorities as the law requires.
12. Changes
12.1 We will post updates to this policy with a new “Last updated” date, and give notice in the Service or by email for material changes.