Privacy Policy

1. Who we are

MechItAll LLC, Florida, USA ("we," "us") makes artograffi and is the controller of the personal information described here. Contact: contact@mechitall.com. This policy applies to the artograffi app and its web pages, not to other apps or sites we link to.

2. Information we collect

Account and profile

• Sign-in details: email and password, a phone number, or your Google account (name, email and profile photo from Google, if you sign in that way). Passwords are handled by Firebase Authentication; we never see them.
• Profile details you add: display name, username, photo, background, bio, accent color, music, QR style, the "what do you want to use artograffi for" answer, an optional contact email, and a Ghostograffer alias if you use one.
• A unique account ID, the date you joined, which version of these legal documents you accepted and when, and settings such as notification preferences, muted and blocked users, and close artograffers.

Content you create

• Drawings and meshtograffs (3D stroke coordinates), photos, bursts, videos, audio clips, titles, captions, access windows and visibility choices.
• Galas (collections), vault items and their files, community events you organize, and live drawing sessions.

Social activity

• Messages (text, photos, voice notes, shared pieces, reactions), friend relationships, appraisals (likes), critiques (comments), favorites, views, and titles you earn.
• Reports you submit about content or users, and reports others submit about you.

Location

Precise location when you save a piece, look for nearby content, organize an event, or use proximity alerts. See section 3.

Camera, microphone and media

Used only when you use the related feature. See section 4.

Device, usage and diagnostics

• A push-notification token for your device.
• App usage analytics (screens opened and specific actions) via Firebase Analytics, linked to an app-instance ID.
• Crash and performance diagnostics via Firebase Crashlytics and Performance Monitoring: device model, OS and app version, technical logs and stack traces. To help us fix problems, crash reports may also include your account ID, display name and username, and an approximate location rounded to about 1 km.
• App integrity signals from Google Play Integrity / Firebase App Check, used to confirm requests come from the real app.

Stored only on your device

Preferences such as theme, language, accessibility options, chat wallpapers you pick, brush presets, and app lock settings (your PIN is stored only as a salted hash). Biometric unlock is handled by your phone; we never receive fingerprint or face data.

3. Location, specifically

• When: the app asks for location the first time a feature needs it. You can allow it while using the app, allow it once, or decline. Location features stop working until you allow it, but the rest of the app still works.
• Tagging: saving a piece stores the coordinates where you saved it. To show a friendly place name ("near Main Street"), those coordinates are sent once to OpenStreetMap's Nominatim service and the resulting place name is stored with the piece. Our servers also send the coordinates (never your name or account) to Open-Meteo for the weather at that moment and to Wikipedia for the nearest landmark, and store both with the piece.
• Event forecasts: an event's location and date are sent from our servers to Open-Meteo to show its weather forecast and sunset time.
• Nearby: to find nearby art, hotspots, live sessions and events, your current location is sent to our servers, which return only what's within range. Who can see what is enforced on our servers.
• Event address search: when you organize an event and search for an address, what you type is sent to OpenStreetMap's Nominatim service to find matching places.
• Proximity alerts: if vault, community-event or audio-guide alerts are on, the app checks your position while it's open, and shows a small radar symbol on screen while it does. Only if you turn on "Keep watching in the background" (off by default) does it keep checking while the app is in the background; Android then requires an ongoing "Watching for nearby vaults & events" notification. We don't use the "Allow all the time" background location permission, and checking stops if you turn the alerts off or close the app.
• We don't try to figure out your home address, and we don't use location for advertising.

4. Camera, microphone and media, specifically

• AR drawing: the live camera feed is processed on your device (Google ARCore for tracking, MediaPipe for hand and body tracking). The live feed isn't uploaded; only what you save is.
• Photos, bursts and videos you capture and choose to save are uploaded.
• Trace image and Wireframe capture detect edges on your device and save the resulting strokes, not the source image.
• Upload media uploads the files you pick from your device.
• Microphone is used only while you record a voice message or an audio clip. The app doesn't listen in the background.
• Voice messages up to 60 seconds are sent to Google Cloud Speech-to-Text after sending, and the transcript is stored with the message so everyone in the chat can read it.
• QR scanning processes the camera image on your device.

5. Automated content review

To keep the community safe, some content is analyzed automatically after you save or post it:

• Photos, thumbnails and previews are sent to Google Cloud Vision (SafeSearch) and videos to Google Cloud Video Intelligence, which return likelihood scores for adult and violent content.
• Critiques (comments) are sent to Google Cloud Natural Language text moderation, which returns categories such as "toxic."

Pictures of saved pieces are also described automatically: Google Cloud Vision labels what they show (for example "mural" or "dog") so pieces can be found by search, and Anthropic's Claude writes a one-sentence description for screen readers and, when you tap Suggest titles, title ideas. Anthropic doesn't use this content to train its models.

A flagged photo or video is hidden from others until an administrator reviews it, and the result (flagged, reason, decision) is stored with it. A flagged critique is removed. Google processes this content on our behalf to provide these services. You can ask a person to review any automated decision by emailing contact@mechitall.com.

6. Translation

• Messages: translated entirely on your device with Google ML Kit. Message text isn't sent anywhere to be translated.
• Critiques (comments): when you tap Translate, that comment's text is sent to Google Cloud Translation and the translation is returned to you. We don't store the translation.

7. How we use information, and our legal bases

We don't sell personal information, don't share it for cross-context behavioral advertising, don't show ads, and don't use your content to train third-party AI models.

8. When information is shared

With other people, as you choose

Content is shown according to the visibility you pick. Your display name, username and profile photo are visible to people you interact with (or your alias, in Ghostograffer mode). Public web pages for a profile or piece (for example, opened from a QR code) show the details visible on that page. Anything set to "Only me" isn't shown to anyone else.

Service providers

These providers process data to provide their services to us, under their own data-protection terms.

Legal and safety

We may disclose information if required by law, or if we believe in good faith it's needed to protect someone's safety, prevent fraud or abuse, or protect our rights. Apparent child sexual exploitation material is reported to NCMEC as required by U.S. law.

Business transfers

If MechItAll is involved in a merger, acquisition or sale of assets, information may be transferred as part of that deal, and this policy will continue to apply to it.

9. How long we keep information

When you delete your account, we delete your profile, content, galas, vault items, engagement and relationships, and remove you from conversations. A few copies may remain briefly in caches or in other users' previously received messages.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy, including in a portable format;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing, including processing based on legitimate interests;
• withdraw consent where we rely on it (for example, by turning off a permission);
• not be discriminated against for exercising these rights; and
• complain to your data-protection authority.

U.S. state privacy laws (such as California's) give similar rights. We don't sell or share personal information as those laws define it.

Many of these you can do yourself in the app (see section 12). For anything else, email contact@mechitall.com. We may need to verify that the request is yours, and we'll respond within the time the law requires (generally 30 to 45 days). You can appeal a decision by replying to our response.

11. Your controls

12. Children

artograffi isn't intended for children under 13, and we don't knowingly collect their personal information. Users under the age of digital consent in their country need a parent or guardian's permission. If you believe a child under 13 has given us information, contact contact@mechitall.com and we'll delete it.

13. Security

We encrypt data in transit, enforce access rules on our servers (not just in the app), verify app integrity, and limit who can access data. You can add a PIN or biometric lock in the app. No system is perfectly secure, so we can't guarantee absolute security. If we learn of a breach affecting you, we'll notify you as the law requires.

14. International transfers

We're based in the United States, and our providers may process data in the U.S. and other countries. Where EU or UK law requires, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework commitments of our providers.

15. Changes to this policy

We'll update the "Last updated" date when we change this policy. For material changes, we'll notify you in the app and ask you to review the new version.

16. Contact

MechItAll LLC, Florida, USA. Email: contact@mechitall.com