Privacy

Privacy policy

Last updated: November 2, 2026

Illustrarium is developed and operated by Sergey Epifanov. This policy covers the Illustrarium iOS app, its shared-game services, and illustrarium.com. For privacy questions or requests, email hello@sergeyepifanov.com.

Visiting this website

This is a static information site. It does not create a player, connect to the live canvas, process purchases, or include analytics scripts, advertising, sign-in, contact forms, or application-set cookies. The flower is a fixed illustration, not a live feed.

Cloudflare Pages hosts and delivers the website. Cloudflare processes connection and request information such as IP address, browser information, requested URL, time, and security events to deliver and protect it. Cloudflare may maintain operational logs under its service settings and policies. This is separate from app gameplay data. Following an external link or sending an email involves that service’s own processing. See Cloudflare’s privacy policy.

Your player and shared artwork

Shared play uses a persistent Firebase Authentication guest account, without requiring your name or email address. “Guest” does not mean unidentifiable within the service: a unique player ID links your activity, paint balance, farming and daily-challenge state, purchases, recovery credentials, and relevant security controls.

The backend stores pixel coordinates, colors, placement prices, ownership identifiers, operation identifiers and timestamps, overpaint activity, moderation reports and captured marks, and player restrictions. Other players can see the current canvas and the player identifiers associated with visible marks, and receive activity when their pixels are painted over. Do not put personal or confidential information in a public artwork.

The shared backend now also stores private linked placement history, separate from public canvas reads. It records ownership periods and prior color/price information so deletion can restore a valid predecessor without changing a newer player’s work. Existing visible placements were preserved through a non-destructive history backfill. Earlier missing historical placements cannot be reconstructed.

Recovery and information on your device

The app stores authentication credentials through Firebase and the device Keychain, along with preferences, canvas position, cached artwork and activity, hidden-player preferences, and pending operation or purchase state as needed. A recovery code lets you regain the same player. The server stores a hash of the code, not a readable copy. Possession of the code gives access to the player, so keep it private.

The local-preview mode stores its sample artwork and changes on your device and does not connect to shared gameplay or purchases. A separately configured purchase-testing build can contact RevenueCat and Apple even though its test canvas is local. Device and operating-system backup or credential-retention behavior is controlled separately by your Apple settings.

Purchases

Apple handles App Store checkout and payment information. Illustrarium does not receive your payment-card details. RevenueCat validates transactions, manages permanent color entitlements and purchase restoration, and provides purchase-history dashboards and analytics to the developer.

RevenueCat processes an app customer identifier associated with your player, transaction and product identifiers, purchase history, entitlement status, store/environment, and technical context such as app version, operating-system version, locale, and currency. Our backend keeps customer mappings and transaction-grant records to deliver purchased benefits once and prevent replay or fraud. No advertising identifier is intentionally supplied and no advertising integrations are included in the app.

Paid colors unlock colors permanently; paint packs are consumable. Deleting a player does not delete Apple’s transaction records. Apple and RevenueCat process their respective service data under Apple’s privacy policy and RevenueCat’s privacy policy.

Notifications and technical data

If you enable overpaint notifications, the app registers a device/installation identifier and push token with Firebase Cloud Messaging and Apple Push Notification service. The backend associates that registration and your notification choice with your player to deliver alerts. Push messages include an activity identifier so the app can open the relevant event. Device-local reminders use the operating system’s notification scheduling.

Firebase Authentication, Installations, App Check and Messaging also process technical identifiers, attestation and security signals, and diagnostic or service-usage information to authenticate requests, protect the backend, and operate and improve their services. Cloud infrastructure processes request metadata and security/error logs, including connection information such as IP addresses. We use rate-limit and abuse-control records to protect the shared service. Firebase’s SDK manifests disclose some diagnostic and messaging service analytics even though we do not include a separate Firebase Analytics or Crashlytics product. See Firebase’s privacy and security information.

Adults and age admission

Illustrarium is intended for adults 18 and older. The upcoming iOS admission flow asks Apple’s Declared Age Range service for an age range. An adult range permits play; an under-18 range denies it without a self-declaration override. If Apple is unavailable, unsupported, or sharing is declined, the app asks “Are you 18 or older?” and uses your answer. Apple is the only external age provider used by this flow.

This implementation does not request your date of birth or identity document. The returned range, declaration method, and session eligibility remain in memory, and are not uploaded to Firebase or RevenueCat. A device-only Boolean remembers a known under-18 denial across launches and player deletion; it has no player ID or exact age and can be updated by a later qualifying Apple adult result. Before admission, ordinary onboarding does not initialize shared gameplay or purchase services. Explicit deletion of an existing player is an exception so restricted users can erase their data.

This flow is pending release and signed-device acceptance. It is not a guarantee that children cannot access the service. If you believe a child has provided personal information, contact the developer.

Why data is used and who receives it

Data is used to provide and recover shared play, display artwork and activity, fulfill purchases, deliver requested notifications, investigate reports, respond to support, and prevent abuse or duplicate grants. Where applicable, the legal bases are performing the service you request, legitimate interests in operating and securing it and handling support, consent where required for optional features, and compliance with legal obligations where they apply.

Service providers include Google/Firebase for authentication, database, backend functions, app attestation, messaging and operational logs; RevenueCat for purchase management and purchase analytics; Apple for purchases, age-range responses and push delivery; Cloudflare for this website; and email providers for correspondence you send. Authorized operators may access records needed for support, moderation, security, and service operations. Information may also be disclosed when required by law or to address fraud, abuse, or threats to safety.

Providers operate internationally, so information may be processed outside your country, including in the United States and other countries where they operate. Google, RevenueCat and Cloudflare describe their transfer safeguards, including applicable contractual safeguards, in their privacy and data-processing terms. We do not sell personal information or use it for cross-app advertising tracking.

Retention and deletion

Player records remain while needed to operate your player and the persistent artwork, unless deleted. Restorable history in the new rollback system has no arbitrary time or depth cutoff: it remains while reachable and needed for valid rollbacks; disconnected history can be pruned. Recovery credentials and push registrations remain until replaced, removed, or erased with the player. Request-limit counters are configured to expire after 24 hours, although database cleanup may occur later.

For the current beta, request player deletion through Support. The upcoming “Delete player and data” action is available in the app source under About the canvas and on restricted onboarding. The backend and existing-canvas history backfill are enabled. The new app flow still requires release and end-to-end service/device acceptance before it can be relied on in a released build.

That automated flow disables player access, revokes recovery and sessions, removes the player’s associated private records, activity and report references, recovery credentials, notification registrations and customer mappings, requests RevenueCat customer erasure, and clears account data on the requesting device. Visible pixels roll back to the previous valid placement or become empty; already-overpainted marks do not replace newer work. Cleanup can remain pending while jobs or processor erasure retry. Firebase Auth deletion waits for a 65-minute token-safety interval. Other devices may retain previously cached data until they reconnect and handle deletion.

Minimal hashed transaction markers prevent an already-consumed purchase being granted again. Hashed deletion barriers, completion receipts and necessary rollback boundaries prevent stale-session recreation and verify completion. These minimized control records have no fixed expiry while needed for those integrity purposes; a hash is not a guarantee of irreversible anonymization. Apple retains its own purchase history. Operational logs, provider backups, and support correspondence are separate from the live player database: they follow service settings, provider policies, and the need to handle requests or incidents. No universal fixed log/backup deletion deadline has been verified, and this policy does not promise immediate erasure from backups. Contact us for help with a specific request.

Your choices and rights

You can manage notification permission in iOS Settings and notification choices in the app, rotate your recovery code, hide contributors, report content, and request deletion. Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent where processing relies on it, or complain to your local data-protection authority. Withdrawing consent does not affect prior lawful processing.

Send requests to hello@sergeyepifanov.com. We may need to verify your relationship to the player or correspondence without asking you to publish credentials. Because guest accounts do not require contact details, identifying a lost player may be difficult. We will explain any data that must be retained and the reason.

Support messages and policy changes

If you email us, your address, message, attachments and voluntarily supplied troubleshooting details are used to respond and handle related follow-up. Share only what is necessary. You can ask for correspondence to be deleted.

This page will be updated when Illustrarium’s practices or rollout status change. The date above identifies the latest revision. Contact Sergey Epifanov at the address above with questions.