Privacy Policy

1. Who is responsible for your data

Brushpool is run by Lorenzo Rossi, an individual based in Italy, who is the data controller for the personal data described in this policy.

You can reach him about anything in this policy, including any of the rights listed in section 8, at privacy@brushpool.com.

2. What we collect

• Your email address and password. The password is never visible to us — it is handled by Firebase Authentication and stored only as an irreversible hash.
• Your username, avatar, and optional bio.
• The drawings you publish, which pools they belong to, and the drawings you save as drafts on your own device.
• Likes, reactions, comments (which are themselves drawings, not text), follows, and the list of people you have blocked.
• Your language preference.
• If you turn on notifications, a token identifying your browser or device — not you.
• Technical information collected automatically by our providers to keep the service working and secure, such as IP address and device or browser type.
• Anonymous usage statistics (Vercel Web Analytics): which pages are visited, the country, and the kind of device. No cookies, nothing that identifies you, and never used to follow you to other websites.

3. Why we use it, and on what legal basis

Under the GDPR every use of your data needs a legal basis. These are ours:

• To run the app for you — your account, your drawings, the feed, follows, achievements and brushpoints. Basis: performance of the contract you accept when you create an account (Art. 6(1)(b)).
• To keep the community safe — reviewing every drawing before it becomes public, handling reports and blocks, preventing spam and automated sign-ups. Basis: our legitimate interest in a safe service, and yours in using one (Art. 6(1)(f)).
• To email you about your account — confirming your address, resetting your password. Basis: performance of the contract (Art. 6(1)(b)).
• To send notifications — only if you have turned them on. Basis: your consent, which you can withdraw at any time from Settings (Art. 6(1)(a)).
• To understand how the app is used — anonymous page statistics. Basis: our legitimate interest in improving the service (Art. 6(1)(f)).

We do not sell your personal data, we do not use it for advertising, and no decision about you is made automatically.

4. Who else handles your data, and where

We run no servers of our own. Three providers process data on our behalf, under contract and only on our instructions:

• Google (Firebase) — accounts, database, image storage, notifications.
• Vercel — hosting of the website and anonymous statistics.
• Resend — sending account emails.

All three are based in the United States, so your data is transferred outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

5. How long we keep it

• Your account and everything in it — for as long as the account exists. Delete the account and it goes with it, immediately (see section 8).
• Drawings you delete yourself — removed straight away, images included.
• Reports of abuse — kept after the reporting account is gone, because a record of what was reported is what makes moderation work. They contain only the username of whoever reported.
• Technical logs kept by our providers — for the periods those providers set, which we do not control.

6. What stays on your device

Brushpool keeps some things in your browser rather than on a server: unfinished drawings you have not published, your language choice, and a copy of what you have already seen so the app opens quickly. None of it is sent to us, and clearing your browser data removes it.

7. What other people can see

Your username, avatar, bio, published drawings, and who you follow are public — visible to anyone, including people without an account, and to search engines. The list of people you have blocked is private and is never shown to anyone, including the person blocked. Your email address is never public.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it. Where a use rests on your consent, you can withdraw that consent at any time without affecting what was done before.

Two of these you can exercise yourself, without asking anyone: username, avatar, bio and language change from Settings, andSettings → Delete account removes your account and its content permanently, in one go.

For anything else, write to privacy@brushpool.com. If you believe your data is being handled improperly you also have the right to complain to your national data protection authority — in Italy, theGarante per la protezione dei dati personali(garanteprivacy.it).

9. Age

You can look at Brushpool at any age, without an account and without us collecting anything about you.

To create an account and publish, you must be at least 14. That threshold exists because of data protection law, not because of the drawings: below it, an account needs a parent's verified consent, which Brushpool is not set up to collect. If we learn that an account belongs to someone younger, we delete it.

10. Changes to this policy

If we change anything that matters, we will update the date at the top of this page.

11. Contact

Questions about this policy or about your data:privacy@brushpool.com.