Paletto: Privacy Policy

Effective date: 2026-10-23

Paletto: Color by Number ("Paletto", "the app") is a coloring game for Android and iOS. This policy explains what data the app handles, why, and what choices you have. It is written to be read, not to hide anything: if something is not listed here, the app does not do it.

Publisher and data controller: Oleksandr Kurinnyi. Contact: oleksandr.kurinnyi.work@gmail.com.

What stays on your device

Your settings, the album you chose, the list of pictures you have started or finished, which areas of each picture you have colored, how you painted each one (time, number of sessions, wrong taps, Find and zoom counts), the days you finished the daily picture, your booster counts and the time of your daily reminder are stored in the app's private storage on your device. Downloaded pictures and their prepared versions are cached there too, so you can continue offline. We cannot see this data. Uninstalling the app deletes it. On Android the app opts out of Android's cloud backup, so progress is not restored on a new phone; on iOS the app's data is part of your own device backup (iCloud or computer) if you have one turned on.

What the app downloads

When the app starts and while you play, it requests the list of albums and daily pictures and the picture files from our content server (hosted on Fly.io, with the images stored at Tigris); the next pictures you will need are downloaded ahead so you can play offline. These are ordinary web requests: like any web request they reveal your IP address and technical details such as the app's user agent to the servers that handle them, and the servers may keep ordinary operational logs. The app does not send an account, a device identifier or any information about your play with these requests. We use the logs only to run and secure the service.

Anonymous statistics and crash reports (only if you allow it)

To understand where players stop, which pictures are too hard or too long, whether the daily picture and its reminder are useful, and to fix crashes and download problems, the app can send:

• gameplay events: a picture started, continued, left or finished (the picture's id, its album and position, its computed difficulty, how much of it was colored, the time spent painting, how many times it was opened, and counts of taps on the wrong color, uses of Find and zooming in); an album chosen or finished; a daily picture finished (how many days in a row); a picture saved or shared; a setting changed (sound, vibration, theme, preview style, palette filter); your answer to the reminder question, the reminder turned on or off and its hour, the app opened from the reminder; a picture or the picture list that could not be downloaded (a short reason code such as "offline" or "timeout"); that you turned the statistics on. Events contain no text you typed, no picture you colored and nothing that identifies you;
• a few summary properties: rough counts of finished pictures, finished albums and days in a row (for example "5-9"), whether the reminder is on, the preview style and the theme;
• information that the analytics service adds by itself: first launch, sessions and time in the app, app updates, device model, operating system version, app version, language, an approximate location (country, region, city) derived from the IP address, and a random app-instance identifier generated by Firebase that is not linked to your name or to your other apps. Google Analytics does not log or store the IP address itself;
• crash reports (Firebase Crashlytics): the crash trace, device model, OS version, free memory and disk space, orientation, the state of the app when it crashed, a random Crashlytics installation identifier, and the recent analytics events listed above; also problems the app recovered from (for example a picture that could not be prepared).

This is done with Google Firebase (Analytics and Crashlytics), provided by Google. Google acts as our processor and may process the data in the United States and other countries. The app does not read or send the Android advertising ID, the Android device id (SSAID) or the iOS advertising identifier (IDFA), does not track you across other companies' apps or websites, and does not use any of this data for advertising.

You decide:

• In the European Economic Area, the United Kingdom and Switzerland, and wherever the app cannot tell your region from your device settings, nothing is sent until you agree when the app asks (once, after you have opened your first picture). Our legal basis is your consent.
• Elsewhere the statistics are on by default and you can turn them off at any time.
• Everywhere you can change your mind in Settings, in the statistics switch. Turning it off stops sending immediately, for both statistics and crash reports.

Statistics are kept by Firebase for a limited period (at most 14 months), crash reports for 90 days. Because they are not linked to your identity, we cannot look up or delete the data of one particular person; resetting the installation (uninstalling the app) breaks any link with the earlier identifier.

Notifications

The daily reminder is optional. It is a local notification scheduled on your device at the time you choose: there is no push server, no push token and nothing is sent to us. You can switch it off in Settings or in the system settings. The app asks for notification permission only when you turn the reminder on.

Photos

If you tap "Save" on a finished picture, the app adds the image to your photo library. It can only add; it cannot read, list or upload your photos. If you tap "Share", the image goes to the app you choose in the system share sheet, and that app's own privacy policy applies. We never receive it.

Ads and purchases

This version of the app contains no ads and no in-app purchases. If ads are added in a future version, this policy will be updated first and, where the law requires it, the app will ask for your consent before showing personalized ads.

Children

Paletto is not directed at children under 13 (under 16 in the EEA) and we do not knowingly collect personal data from them. If you believe a child has provided personal data, write to oleksandr.kurinnyi.work@gmail.com and we will help.

Your rights

Depending on where you live (for example under the GDPR or the UK GDPR) you may have the right to access, correct, delete or export your personal data, to object to its processing and to withdraw consent at any time (withdrawing does not affect what happened before), and to complain to your data protection authority. We hold almost no data that can be linked to you; to use these rights, or to ask any question, write to oleksandr.kurinnyi.work@gmail.com.

Security

Connections to our server use HTTPS. Data on your device is kept in the app's private storage, protected by the operating system.

Changes

If this policy changes, we publish the new version at this address with a new effective date. Material changes will be announced in the app.

Contact

oleksandr.kurinnyi.work@gmail.com