Sketcha — Privacy Policy

1. The short version

Sketcha is an offline-first drawing and animation app. It has no user accounts, no sign-up, no advertising and no cross-app tracking.

Your drawings, documents, layers, brushes, brush kits, palettes, imported fonts, imported audio and imported photos never leave your device. Sketcha does not upload them anywhere, and we cannot see them.

Sketcha communicates with a server for exactly two things:

• Sketcha Pro purchases. A small amount of purchase-related data is processed by RevenueCat (our subscription-entitlement provider) and by Apple or Google (who take the payment). Described in detail in section 4.
• Anonymous usage statistics and crash reports. Which features get used, which exports fail and which crashes happen — under a random identifier that is not connected to you — processed by Firebase Analytics and Firebase Crashlytics (both Google products). Described in detail in section 13. It never includes your artwork, your file names or anything you typed, and one switch in Settings turns it off completely.

2. Who we are

Sketcha is published by Gambit, based in Türkiye. For the purposes of the EU/UK General Data Protection Regulation (GDPR) and of Türkiye's Personal Data Protection Law No. 6698 (KVKK), Gambit is the data controller (veri sorumlusu) for the limited purchase data described in section 4 and for the anonymous statistics and crash reports described in section 13.

You can reach us at hello@getsketcha.com.

3. What we do NOT collect

We want to be specific, because "we care about your privacy" means nothing on its own. Sketcha contains no advertising SDK, no cross-app tracking SDK and no data-broker integration of any kind, and it contains no code capable of sending us your artwork or anything you have written. Concretely, we do not collect:

• Your artwork. Drawings, canvases, layers, strokes, animation frames, scenes, thumbnails and exported images or videos are created and kept on your device only.
• Your assets. Custom brushes, brush textures, .sketchakit / .sketchabrush brush kits, colour palettes, imported fonts, imported SVG and PSD files and imported audio tracks stay on your device.
• Photos you import. See section 5.
• Your name, email address, phone number, postal address or date of birth. There is no account and no registration form — there is nowhere to type them.
• Your contacts, calendar, microphone, camera, health data or messages. The app does not request access to any of these. On iOS the app declares exactly one privacy permission string, for the photo library; on Android it declares only internet access and Google Play billing.
• Your precise or approximate location. No location permission is requested and no location API is used.
• Advertising identifiers. The app never requests the iOS IDFA or the Android advertising ID, and never calls the App Tracking Transparency prompt, because it does no tracking. (On Apple platforms it does ask Apple's own AdServices API for a Search Ads attribution token, which is campaign-level information and not an advertising identifier — see section 8.)
• Your artwork, in any form, for any purpose. Nothing you draw, type, import or export is ever transmitted — not to us, not into a crash report, not into a usage statistic. Section 13 explains how that is enforced in the code itself rather than merely promised here.

What we do collect is limited to two things, and both are set out in full below: the purchase data in section 4, and the anonymous usage statistics and crash reports in section 13. Neither carries your name, your email address, an account, an advertising identifier or any part of a document — and the collection described in section 13 can be switched off entirely in Settings → Privacy.

4. Sketcha Pro purchases

Sketcha offers an optional paid upgrade, Sketcha Pro (monthly subscription, yearly subscription, or a one-time lifetime purchase). To sell it, unlock it and restore it on your other devices, the app uses RevenueCat, a subscription infrastructure provider, together with the Apple App Store or Google Play Billing.

Apart from the anonymous statistics and crash reports in section 13, this is the only part of Sketcha that talks to a network.

4.1 What is processed

When you open the paywall, make a purchase, or tap "Restore purchases", the following is processed:

We do not send RevenueCat your name or email address. The app never calls RevenueCat's user-identification or subscriber-attribute functions, and never enables its advertising-identifier collection.

On Apple platforms the app additionally enables Apple's own AdServices attribution-token collection, so that RevenueCat can tell us whether an App Store search advert led to a download. That token is campaign-level, it is not the IDFA, and it cannot identify you — section 8 explains it in full.

4.2 What we can see

Through RevenueCat and through App Store Connect / Google Play Console we can see anonymous, aggregated commercial data — how many subscriptions are active, revenue, churn, trial conversion, refunds. We cannot link any of it to you personally, and we cannot see anything you have drawn.

4.3 If you never buy anything

If you never open the paywall and never purchase, nothing in this section applies to you beyond the entitlement check: the purchase SDK is initialised only in order to display prices and to check whether this installation already holds an entitlement. The statistics in section 13 are a separate matter, governed by the switch described there.

4.4 Legal basis

• GDPR: performance of a contract (Art. 6(1)(b)) — we cannot deliver a paid entitlement without processing the purchase record; and our legitimate interest (Art. 6(1)(f)) in preventing fraudulent or duplicated entitlements.
• KVKK: Art. 5(2)(c) — processing directly related to the establishment and performance of a contract; and Art. 5(2)(f) — our legitimate interests, on condition that your fundamental rights are not harmed.

4.5 Retention

RevenueCat retains subscriber records for as long as the entitlement and our account with them exist, so that a lifetime purchase or an active subscription can still be restored years later. Apple and Google retain transaction records under their own policies and their own statutory accounting obligations. We retain no separate copy.

RevenueCat's privacy policy: https://www.revenuecat.com/privacy/ Apple's privacy policy: https://www.apple.com/legal/privacy/ Google's privacy policy: https://policies.google.com/privacy

5. Photo library access

Sketcha can insert a photo as a drawing layer, load a reference image, or pick a colour from a photo. To do that, iOS and Android ask for your permission the first time. On iOS the request reads:

"Add reference images to your drawing."

This access is entirely user-initiated. Sketcha never opens your photo library on its own, never scans it, never indexes it, and never reads any photo you did not personally select in the system picker.

When you select a photo, the app decodes it and copies the pixels into your Sketcha document on the device. The photo is not uploaded, not transmitted, and not shared with us or with anyone else. Sketcha only ever imports photos — it does not request permission to write to your photo library.

You can withdraw photo access at any time in iOS Settings → Sketcha or Android Settings → Apps → Sketcha → Permissions. The rest of the app keeps working; only photo import stops.

6. Files you import, export and share

• Import. You may import fonts (.ttf, .otf), vector files (.svg), layered files (.psd), audio tracks, and brush kits (.sketchakit, .sketchabrush) through the system file picker. As with photos, the app only ever sees the single file you chose, and copies it into the app's own storage.
• Export. Exported PNG, GIF, MP4 and brush-kit files are written to a temporary folder inside the app's own sandbox and then handed to the system share sheet.
• Share. When you use the share sheet, you choose the destination — Messages, Files, Photos, Drive, another app. From that moment the file is governed by the privacy policy of whatever destination you picked. Gambit is not a party to that transfer and receives no copy.

7. Where your work is stored, and how to delete it

All of your content is stored in Sketcha's private application storage on your device:

• Documents (.pdraw files) and their thumbnails
• Brush library, brush textures and brush kits
• Colour palettes
• Imported fonts
• Imported audio
• A small local settings file (for example, whether you dismissed a promotional banner)

None of it is encrypted by Sketcha itself beyond the file protection your operating system applies to app-private storage.

To delete your data:

• Delete an individual drawing from the gallery inside the app.
• Or delete the Sketcha app. Uninstalling removes the entire application container, including every document, brush, palette, font and imported file. This is irreversible and we cannot recover any of it, because we never had a copy.

A note on Android backup. The Android build currently permits Android's system backup (android:allowBackup="true"). If you have Android Backup enabled in your device settings, your operating system may copy Sketcha's app data into your own Google account backup, or transfer it during a device-to-device migration. That is a transfer between you and Google under Google's privacy policy — Gambit has no access to it. You can disable it in your Android system backup settings.

Deleting purchase records is different, and is covered in section 11.

8. No tracking, no advertising, no data sales

• Sketcha displays no advertising and contains no ad SDK.
• Sketcha does not track you across apps or websites, and holds nothing that could be used to. Because we perform no tracking as Apple defines it, the App Tracking Transparency prompt is not shown and no advertising identifier is requested.
• Apple Search Ads attribution. On Apple platforms Sketcha does ask the operating system for an AdServices attribution token and passes it to RevenueCat, so that we can tell whether an App Store search advert led to a download. AdServices is Apple's own attribution API: it returns campaign-level information, it is not the IDFA and not any advertising identifier, it requires no App Tracking Transparency prompt, and it cannot identify a person or follow you into another app or website. Sketcha still never calls RevenueCat's device-identifier collection, and there is no third-party attribution SDK in the app.
• The anonymous statistics in section 13 are first-party measurement only. They are never combined with data from other companies, never used for advertising or advertising measurement, and never linked to an advertising identifier or to any cross-app or cross-site profile.
• We do not sell, rent or trade personal data, and we do not share it with data brokers.
• We do not share data with third parties for their own marketing, advertising, profiling or data-brokerage purposes. RevenueCat, Firebase Analytics and Firebase Crashlytics act as processors on our documented instructions, not as independent recipients free to use the data for their own ends.
• We build no behavioural profiles and make no automated decisions with legal or similarly significant effects about you.

9. Children

Sketcha is not directed at children under 13 (nor under the higher age of digital consent where local law sets one, e.g. up to 16 in parts of the EEA). We do not knowingly collect personal data from children.

Because the app has no accounts and collects no personal profile information, it does not gather age data at all. If you believe a child has made a purchase or that we hold data relating to a child, contact hello@getsketcha.com and we will act promptly. Purchases and refunds are administered by Apple or Google, who also offer parental controls (Screen Time / Ask to Buy, Family Link) and their own refund routes.

10. Where data is located and international transfers

Your artwork stays on your device, in your country, wherever that is.

The purchase data in section 4 and the statistics in section 13 are different.

• RevenueCat, Apple and Google operate servers outside Türkiye and outside the EEA, primarily in the United States. Making a purchase therefore necessarily involves a cross-border transfer of the limited purchase data described above.
• Firebase Analytics and Firebase Crashlytics are Google products. Google processes this data on Google Cloud infrastructure globally, including in the United States. Google Analytics for Firebase offers data-location configuration options in the Firebase console, but no specific data location has been configured for this project, so no region-restricted claim (such as "EU-only") can be made here.

• For EEA/UK users (GDPR): transfers rely on the recipients' Standard Contractual Clauses and equivalent safeguards under Art. 46 GDPR, and, where applicable, the EU–US Data Privacy Framework.
• For users in Türkiye (KVKK): the data in sections 4 and 13 is transferred abroad within the meaning of KVKK Art. 9. Where an adequacy decision or a standard contract notified to the Turkish Data Protection Authority (KVKK Kurulu) is not available, the purchase transfer takes place on the basis of your explicit consent, which you give by choosing to complete a purchase. For the statistics, you can prevent the transfer outright and at any time by switching Settings → Privacy → "Anonymous usage statistics" off. If you do not wish your purchase data to be transferred abroad, do not purchase Sketcha Pro — with that switch off and no purchase made, the app contacts none of these services.

11. Your rights (GDPR and KVKK)

11.1 Under Türkiye's KVKK (Art. 11)

You have the right to:

• learn whether your personal data is being processed;
• request information about it if it has been processed;
• learn the purpose of processing and whether it is used consistently with that purpose;
• know the third parties, in Türkiye or abroad, to whom it is transferred;
• request correction of incomplete or inaccurate data, and request that any correction be notified to those third parties;
• request erasure or destruction of your data under the conditions in Art. 7, and request that this be notified to those third parties;
• object to a result produced against you solely by automated analysis;
• claim compensation for damage arising from unlawful processing.

11.2 Under the GDPR

You have the rights of access, rectification, erasure, restriction of processing, objection, data portability, and the right to lodge a complaint with your national supervisory authority.

11.3 How to exercise them, given there is no account

This is important. Sketcha has no accounts and no logins, so we have no way to look you up by name or email. To act on a request about purchase data, we need something that identifies the purchase record — please email hello@getsketcha.com and include, as applicable:

• the RevenueCat anonymous app user ID, if you can retrieve it;
• and/or your Apple or Google order / transaction ID from your store receipt;
• the store you purchased from, the approximate date, and the product (monthly, yearly or lifetime).

We will respond within 30 days (KVKK: at the latest within 30 days; GDPR: within one month, extendable by two further months for complex requests). If we genuinely cannot identify you from what you provide, we must tell you so and may be unable to act on the request (GDPR Art. 11 / Art. 12(2)).

To exercise rights against Apple or Google in relation to your payment and store account, please use their own privacy request channels — we have no access to those records.

For all locally stored content, you exercise your erasure right directly and immediately by deleting documents in the app or by uninstalling it.

For the anonymous statistics and crash reports in section 13 there is nothing for us to look up. The only identifier attached to them is a random ID that lives on your device and that we cannot connect to you, to your purchase, or to anything you could put in an email — which is exactly why it was designed that way. The effective and immediate remedies are in your hands: switch Settings → Privacy → "Anonymous usage statistics" off, which stops the collection and shuts both services down, and delete the app, which destroys the identifier itself. If you nevertheless want us to try, email us the random ID — the app stores it in analytics.json in its own storage — and we will pass an erasure request to Google for the Firebase Analytics and Firebase Crashlytics data.

Turkish users may also apply to us in the form prescribed by the Communiqué on the Procedures and Principles of Application to the Data Controller, and may complain to the Kişisel Verileri Koruma Kurumu if dissatisfied with our reply.

12. Security

• Your content never travels over a network as a result of anything Sketcha does, which removes the largest category of risk entirely.
• Content is stored in the app's private sandbox directory, protected by the file-level protections your operating system provides for app-private data. Enabling a device passcode, biometric lock and device encryption is the single most effective thing you can do to protect your work.
• All traffic Sketcha sends — to RevenueCat and the stores, and to Firebase Analytics and Firebase Crashlytics — is encrypted in transit over TLS/HTTPS.
• Our RevenueCat API keys are public client-side keys injected at build time. Firebase Analytics and Firebase Crashlytics are configured from google-services.json (Android) and GoogleService-Info.plist (iOS) — build-time configuration files identifying the Firebase project, not secret API keys in the traditional sense. None of these can be used to read data back out; they can only be used to send data in.
• Imported brush kits are validated and size-limited before being unpacked, to reduce the risk from a malformed or hostile file.
• No system is perfectly secure. We cannot guarantee absolute security, and you remain responsible for backing up your own work (see the Terms).

13. Anonymous usage statistics and crash reports

Sketcha collects a small and deliberately anonymous set of product usage statistics and crash reports. We use them for one purpose: to see which features are actually used, which exports fail, and which crashes real devices hit, so that we can fix them. Together with the purchase traffic in section 4, this is everything Sketcha sends over a network.

You can turn it off entirely, at any moment, with one switch — see 13.6. It never contains your artwork, your file names, or anything you typed.

13.1 Who processes what

Gambit is the data controller for this processing. Firebase Analytics and Firebase Crashlytics are processors: they may use the data only to provide the service to us, not for their own purposes, and neither is a data broker.

13.2 The only identifier: a random install ID, plus Firebase's own installation ID

The app generates the same single identifier it always has, and nothing else that could distinguish you: a random UUID, generated on your device by a cryptographically secure random number generator the first time you launch Sketcha, and stored in a small file (analytics.json) inside the app's own private storage.

• It is not derived from your device, your hardware, an account or you. It is drawn from random bytes and from nothing else.
• It is not the iOS IDFA, not the iOS IDFV and not the Android advertising ID. Sketcha never requests any of those.
• It rides along as a property on the hand-written events described in 13.3, so that events and crashes can be lined up with the same installation.
• Deleting Sketcha deletes it. A reinstall mints a new one, and the two can never be reconnected — not by us, and not by Google.

In addition, the Firebase SDK itself manages its own identifier under the hood: a Firebase Installation ID / App Instance ID, automatically generated per installation by the Firebase Analytics and Crashlytics SDKs. It is likewise a random, per-install identifier — not the IDFA, not the Android Advertising ID, not derived from the device or an account — and it resets on uninstall/reinstall exactly like our own random UUID does. It exists independently of the UUID described above; Firebase generates and manages it automatically as part of the SDK, and we do not disable it.

We never call any Firebase user-ID or setUserId function, so no person profile tied to an identity is ever created by us. Firebase holds no name, no email address, and no IP address that we have attached.

The RevenueCat anonymous app user ID described in section 4 is a separate identifier, generated by RevenueCat, and it is not shared with Firebase.

13.3 What Firebase Analytics receives

A fixed vocabulary of roughly 52 events, every one of them written into the app's source code by hand. They record things such as: a document was created, opened, duplicated or deleted; a tool or a brush was selected; a layer or an adjustment was added; an export started, completed or failed; the paywall was shown and a purchase succeeded, failed or was cancelled; a Sketcha Space feature was used; a settings screen was opened; the app was opened, installed, updated or sent to the background.

Each event carries a handful of short, low-cardinality labels, and every number is placed into a bucket before it is sent. We receive "2-5" layers, "1-5m" of drawing time, "le2048" pixels — never the exact figures, because an exact canvas size or an exact stroke count is itself a fingerprint. Alongside each event ride a few constant properties: the app version and build number, the platform (ios / android), a device class (phone / tablet), the major operating-system version only ("18", never "18.1.1 (22B91)"), your device's language code, whether this installation holds Sketcha Pro, and a bucketed count of how many times the app has been launched.

What is never sent, by construction:

• document names, layer names, scene names, brush names or file paths;
• any text you typed into a document;
• colours, palettes, strokes, thumbnails or any pixel of your artwork;
• error messages, which can contain a folder or document name — only a fixed category token such as network, io or timeout is sent;
• any free-form string whatsoever.

That last point is enforced in code, not merely in this policy: before anything is sent, a sanitiser drops every property value that is not a short ASCII token — at most 48 characters, no spaces — so a mistake on our side cannot turn into a leak of your content.

Equally deliberately, we disable Firebase Analytics' automatic screen-view tracking and do not enable session replay (Firebase Analytics has no session-replay feature) or any autocapture-style automatic event collection. Nothing you tap is captured unless we wrote an event for it by hand. Firebase Analytics' own app-lifecycle events — first open, app update, session start — are on by default.

13.4 What Firebase Crashlytics receives

When Sketcha crashes, or hits an error it did not expect, Crashlytics receives a crash report: the exception type and the message the code produced, a stack trace, the device model, the operating-system version, the app version and build, and a short trail of the recent event names described in 13.3, so that we can see what the app was doing at the time.

What Crashlytics never receives:

• Screenshots. Crashlytics does not capture screenshots — it does not have a screenshot-capture feature to begin with, so there is nothing to disable.
• The view or widget hierarchy. Crashlytics does not capture UI-hierarchy dumps — it does not have that feature either.
• Any user identity we did not choose to attach. We never call Crashlytics' setUserId or set custom identity keys, so Crashlytics holds no name, email address or account identifier for you.

13.5 Retention

Firebase Analytics' own default retention for user-level and event-level data is 14 months, and Firebase Crashlytics retains crash data for 90 days, after which the respective service deletes it. We keep no separate copy of either. Because the data carries no identifier that can be traced back to you, we cannot single out and delete "your" records on request — see 13.6 and section 11.3 for what you can do instead.

13.6 How to turn it off

Open Settings → Privacy in Sketcha and switch "Anonymous usage statistics" off. The switch ships on.

Turning it off takes effect immediately, and for every future launch:

• Firebase Analytics collection is disabled at the SDK level (via setAnalyticsCollectionEnabled(false)) — not merely muted inside the app.
• Firebase Crashlytics collection is disabled at the SDK level (via setCrashlyticsCollectionEnabled(false)), which also discards anything still queued and not yet sent.
• Neither service sends anything again unless you switch it back on.

Two further guarantees hold regardless of the switch:

• Nothing is sent before your stored answer has been read. On every launch Sketcha reads the setting from disk before it starts either service, so an opted-out installation transmits nothing at all — not even a crash report from the first frame.
• The Firebase SDKs are only ever wired up through our own gate. Firebase configuration (google-services.json / GoogleService-Info.plist and the generated firebase_options.dart) initialises the Firebase SDK, but our own code still gates whether Analytics/Crashlytics collection is turned on, based on the stored setting read before either service starts.

The one thing that is sent when you switch the toggle off is the fact that you switched it off — a single analytics_opt_out event, sent immediately before the shutdown. After that, silence.

13.7 Legal basis, and your right to object

• GDPR: our legitimate interest (Art. 6(1)(f)) in understanding how our own app is used and in keeping it from crashing — balanced against the design choices set out above: no identity, no content, no profiling, no advertising use, and a switch that ends the processing outright. Where consent (Art. 6(1)(a)) is the applicable basis, the Settings switch is the consent, and turning it off withdraws it with effect for the future.
• KVKK: Art. 5(2)(f) — our legitimate interests, on condition that your fundamental rights and freedoms are not harmed.
• You may object at any time, without giving a reason, by switching the toggle off. Nothing else about the app changes when you do: no feature is withheld, and you are not asked again.

14. Third-party services we use

Services that receive data:

Software components that do NOT send data anywhere. For completeness, apart from purchases_flutter (RevenueCat), firebase_core, firebase_analytics and firebase_crashlytics above, the app is built with open-source components that operate purely on-device: Flutter and Riverpod (app framework and state), path_provider (file locations), image and archive (PNG/GIF encoding and kit packing), image_picker, file_selector (system pickers), share_plus (system share sheet), audioplayers (local audio playback), flutter_quick_video_encoder (on-device MP4 encoding), flutter_svg (local SVG rendering), intl (formatting) and url_launcher (opening a link in your browser). None of these transmits your data to us or to anyone else.

url_launcher is used only to open external links in your own browser or store app: this privacy policy, the terms of use, and the Apple or Google subscription-management page. Opening such a link takes you to a third-party site governed by that site's own policy.

15. Changes to this policy

If we change how Sketcha handles data — for example if a future version added an account system, a cloud feature, or a new processor alongside the ones in section 14 — we will update this policy, change the effective date at the top, and, for any material change, surface a notice in the app before the change takes effect. Continuing to use Sketcha after a change means you accept the updated policy.

16. Contact

Gambit — Türkiye Email: hello@getsketcha.com

For data-protection matters, please put "KVKK/GDPR request" in the subject line so it is routed correctly.