Privacy Policy.

Last updated 2026-09-26 · Version 7.0 (effective from app v2.7.0) · The Mini Colorbench

Who we are

The Mini Colorbench ("the app") is developed and operated by:

Philipp Buchwald (trading as Pixel Paladin)
Contact: hi@pixel-paladin.de
Support: support@pixel-paladin.de
Website: pixel-paladin.de

What the app does

The Mini Colorbench is a companion app for miniature painters. It stores palettes, paint collections, hobby projects, and notes locally on your device. As of v2.0.0, you can optionally sign in with Google or Apple to enable upcoming community features. Without an account, your data never leaves your phone unless you explicitly:

• export it (manual share-out from a settings action — we never see the export), OR
• send us feedback via the in-app feedback form (you choose what to write), OR
• opt in to community stats (anonymous counts only — see below).

Data we collect

1. Nothing about you (default state)

• No name, email, phone number, address, IP address, location, or other identifying information.
• No account, no login.
• No behavior tracking (no analytics, no ads, no fingerprinting, no advertising ID).
• No selling or sharing of data, because there is no personal data to share.

2. Anonymous community stats — opt-in, default OFF

Unchanged from v2.0. The app shows a consent screen on first launch explaining what gets shared, with a green "Opt in" button and a smaller "No thanks" button. Both choices are persisted; the consent screen never shows again. The choice can be flipped at any time from Settings → Share anonymous stats. Telemetry is off by default until you actively opt in.

What gets sent (only when opted in, at most once per 24 hours):

• A one-way hash of a per-install random ID (SHA-256, computed on your device). The original ID never leaves the device. Two installs — even on the same phone — produce different hashes. The hash cannot be reversed to identify you.
• Ownership counts — for each paint you've marked as owned, a row of {paint id: 1}. No paint names, no order of acquisition, no timestamps.
• Palette view counts — for each palette you've opened, a row of {palette id: count}. No timestamps.
• App version — the version string of the app you're running, e.g. 2.1.1.

This identity layer (the install-id hash) is completely separate from your sign-in account. Even if you sign in with Google, telemetry rows continue to use the install-id hash, never your account. Telemetry rows are NOT deleted when you delete your account.

You can opt back out at any time via the Settings → Share anonymous stats Switch.

3. In-app feedback form — explicit, per-submission

Unchanged from v2.0. When you tap Settings → Send feedback and submit the form, the app sends the text, a type tag (bug / idea / other), the install-id hash, and device info (app version, Android version, device model). No automatic sends; nothing leaves the device until you hit Submit.

Feedback rows live in the same Supabase region (EU/Frankfurt) under the same processor agreement.

4. Account data via Google / Apple sign-in — opt-in (NEW in v3.0)

If you choose to sign in with Google or Apple (Settings → Account), your provider shares the following with us:

• Your display name (the name on your Google or Apple account).
• Your email address — used only for account uniqueness. We never send marketing emails; we have no marketing-email surface.
• Your avatar URL — the public image URL from your provider account, if one exists.

We store these on Supabase (EU/Frankfurt) in a profile row tied to your account. The email is stored in the Supabase Auth system separately, used for account uniqueness only, and never displayed publicly.

What you can add yourself (NEW in v7.0) — optional, public:

On the Profile screen (Settings → Account → Edit display name) you may add:

• Social handles — your handle on Instagram, X, Bluesky, TikTok and YouTube, at most one per platform. We store the handle only, never a link. If you paste a link to your page on one of them, the app keeps just the handle.
• Your country — picked from a list, stored as a two-letter ISO 3166-1 code (for example DE).

Every field is optional and empty until you fill it in. You can change or clear it at any time on the same screen. We store both in your profile row, next to your display name.

Both are public. Every app user, signed in or not, can see them where your name appears in the monthly palette competition:

• Your country shows as a flag next to your name on entry cards, comments, the entry page, the Hall of Fame and a past competition's Top 3.
• Your social handles show on your entry's page and in a past competition's Top 3. Tapping one opens your page on that platform. The app builds that link from the handle itself.

We do not check that a handle is really yours, and we never contact the platforms about it. When someone taps your handle, their phone opens that platform, and that platform's own privacy policy applies. Because nobody checks handles, other users can report a profile (section 6).

Both are deleted with your account (section 5).

What ELSE happens when you sign in:

• A record is created in the Supabase Auth system tied to your Google or Apple identity.
• A stable per-account ID (UUID) is generated. The photo upload pipeline (see section 6) uses this ID to associate uploaded photos with your account. Competition entries, votes, and comments use the same ID.

Sign-in providers — what they receive:

• Google: receives our app's package name (de.pixelpaladin.colorbench) plus a public OAuth client ID. Google may apply its own privacy policy to that interaction — consult Google's Privacy Policy.
• Apple: receives our app's Services ID. Apple may apply its own privacy policy — consult Apple's Privacy Policy.

We never see your password. We only ever receive what Google or Apple choose to share with us based on the permissions you grant.

5. Account deletion (NEW in v3.0)

You can delete your account at any time from Settings → Account → Delete account. Deletion is immediate, permanent, and not reversible. It removes:

• Your sign-in record on our backend.
• Your profile row, and with it your display name, avatar URL, social handles and country.
• All photos you've uploaded — both database rows and the underlying storage files (both thumbnail and full-size versions).
• All local data on this device (owned paints, projects, view history, settings).
• Everything else tied to your account: competition entries, votes, comments and reports (section 6).

Deletion does NOT remove:

• Anonymous telemetry rows you may have opted into — those are tied to your device's pseudonymous install-id hash, NOT your account. The install-id is regenerated after account deletion, so future telemetry from the same device contributes to a fresh anonymous identity.
• Anonymous feedback you submitted before signing in.

We do not retain backups of your account beyond standard Supabase nightly snapshots, which roll off after 7 days.

If you can no longer access the app: email support@pixel-paladin.de with the subject Account deletion request. Include the email address you used to sign in. We will delete the account within 30 days.

The accessible web URL for the deletion procedure (referenced by Google Play's Data Safety form) is:
pixel-paladin.de/projects/colorbench/account-deletion.

6. User-uploaded photos — NEW in v4.0

If you upload a photo via a future in-app photo-upload feature (the pipeline is wired in v2.1 but no UI consumes it yet — a later release will add the surface), the app:

1. Strips all EXIF metadata from the photo on your device BEFORE the photo leaves your phone. EXIF metadata typically includes GPS coordinates, camera model and serial number, and the original capture timestamp. We never see any of it.
2. Resizes the photo to a small thumbnail (320px max edge, ~50 KB) and a mobile-sized version (1080px max edge, ~500 KB), both in WebP format.
3. Uploads both sizes to our Supabase Storage in EU/Frankfurt under the same processor terms as the rest of our backend.
4. Tags each upload with a moderation status defaulting to "pending". Photos are only publicly visible after a manual approval (this matters only when a public-display surface ships in a later release; in v2.1 nothing is publicly visible).

Per-user limits in v2.1:

• Maximum 5 uploads per 24-hour window.
• Maximum 50 photos total per account.

What we DO NOT do with your photos:

• We do not run any image analysis on them (no face recognition, no content classification, no AI training).
• We do not share photos with any third party.
• We do not retain photos that were never publicly approved beyond your own deletion.

Account deletion + photo retention: when you delete your account (section 5 above), ALL your photos are removed in the cascade — both the database rows and the storage files. Photos deleted before the 7-day Supabase backup window may persist in those backups; after 7 days, no copy exists.

Addendum (v6.0, app v2.3.0): competition entries. If you submit a photo as an entry to a monthly palette competition (Home → Competition card → Submit), that photo becomes visible to all app users — anonymous and signed-in — for the duration of the competition AND indefinitely afterwards in the "Past Competitions" archive. Submission is opt-in per competition; we never auto-enrol a photo. Withdrawing a competition entry (from the Entry Detail screen, while the competition is in its "open" state) removes the photo from public view immediately. The photo file itself remains in our Supabase Storage per the retention rules above (cascade-deleted on account deletion) but is no longer linked to any visible entry. Photos visible in competition entries are served via short-lived (1-hour) signed links created by our backend; the storage itself is not publicly readable.

Addendum (v6.1, app v2.5.0): comments and abuse reporting. v2.5.0 adds two opt-in, signed-in-only ways to interact with competition entries:

• Comments. If you are signed in with Google or Apple, you may post short text comments on competition entries while a competition is in its voting phase or archived afterwards. Your comment — the text you write, plus your public display name — is visible to all app users (anonymous and signed-in) the moment you post it. We store the comment text, your account ID, the entry/competition it belongs to, and timestamps in our database (Supabase, EU/Frankfurt). You can delete your own comments at any time, which removes them permanently. Anonymous (not-signed-in) users can read comments but cannot post. We do not run AI/content classification on comment text, do not use it for training, and do not share it with third parties.
• Abuse reports. You may report a competition entry or a comment you find inappropriate (via a "Report" option). A report records your account ID, what you reported, a reason category (spam / offensive / off-topic / other), an optional short note you write, and a timestamp in our database. Reports are NOT public — only you (the reporter) and the admin can see a report you filed. Reporting does not automatically hide content; the admin reviews reports and decides. Filing a report is the data you provide; we collect nothing else from the act of reporting.

Both comments and reports are cascade-deleted when you delete your account (they are tied to your account ID). No new device data, no new third parties, and no automated decision-making are introduced.

Addendum (v7.0, app v2.7.0): reporting a profile. You may now also report another user's profile, for example when it pretends to be someone else, and "impersonation" joins the reason list. The report records the same data as above, with the reported profile as its target, and is private in the same way. To decide, the admin sees the reported profile's display name, flag and social handles. If the admin upholds a report on your profile, your display name, avatar and social handles are cleared; your country stays. You then show as "Anonymous" until you set a name again. You may add your handles again too. The avatar stays cleared.

7. Admin moderation — NEW in v5.0 (invisible to regular users)

If you are designated as an admin (which only happens by direct request to support@pixel-paladin.de and explicit grant by Philipp Buchwald), the app shows you a moderation queue of pending photos uploaded by other users so you can review them before they become publicly visible. Regular users see no part of this surface — the entry point in Settings is gated on a per-account admin flag that defaults to off for everyone.

No NEW data categories are collected from regular users by this feature. Admins are merely granted READ access (within the app) to photos that already exist (uploaded under the conditions described in section 6 above).

8. Crash diagnostics — still none

The app still does not collect crash reports automatically. If we add crash reporting later, we'll update this policy and disclose it in the in-app About screen and the release notes.

9. Google Play Store

When you install the app from Google Play, Google collects standard install telemetry under Google's Privacy Policy. We do not control this and we do not see your individual install/uninstall data — only aggregated counts.

Data we do not collect

• Analytics about feature usage outside the opt-in counts above (no per-screen view tracking, no event funnels, no time-spent metrics).
• Advertising data.
• Device contacts, calendar, or files (the app does not request these permissions).
• Microphone or location (the app does not request these permissions).
• Photo content beyond what you explicitly upload — the app reads photos from your library only after you tap a photo-upload button and grant the library permission; we receive nothing automatically. Camera permission, if granted, is used solely to capture a photo for an explicit upload.

Where the data lives

• Default mode (no sign-in, no telemetry): entirely on your phone, in app-private storage. Uninstalling the app removes it all.
• Opt-in community stats + in-app feedback: Supabase Inc. (eu-central-1, Frankfurt, Germany). Standard processor terms; data not linked to anything that identifies you.
• Account data (signed-in users): same Supabase project, same region, including any social handles and country you add. Tied to your Google/Apple identity. Hard-deletable from Settings → Account → Delete account.
• Uploaded photos: same Supabase project, same region, in dedicated storage buckets for thumbnail and full-size versions. Cascade-deleted with your account.

Your rights under GDPR

As an EU/EEA user, you have the right to:

• Access —
  • For anonymous data (telemetry, feedback): keyed only by the irreversible install-id hash; if you can supply the hash (Settings → Clear all local data shows it), we can return matching rows.
  • For account data (including uploaded photos): email support@pixel-paladin.de with the email tied to your account; we'll provide a JSON export of your profile, photo rows, and future account-linked rows within 30 days.
• Deletion —
  • For anonymous data: provide the hash, we'll delete matching rows. Or uninstall + reinstall the app (new install-id, fresh start).
  • For account data: the immediate path is Settings → Account → Delete account (in-app, no email needed) — this also removes all your uploaded photos. Email support if you can no longer access the app.
• Object / Opt-out —
  • For telemetry: flip Settings → Share anonymous stats off.
  • For account: sign out (your data stays in our backend, ready for sign-in again) or delete (permanent removal).
• Lodge a complaint — with your national data protection authority. The German supervisory authority is the BfDI.

Children

The app is rated for general audiences (PEGI 3 / IARC Everyone). We do not knowingly collect data from children under 13. The sign-in flow is gated behind Settings → Account and is not required to use the app. Google and Apple's own age-of-consent enforcement applies to the OAuth flow.

Changes to this policy

If we update this policy, we will change the "Last updated" date at the top and note the change in the app's About screen. Material changes will be announced in the app's release notes on Google Play.

Changelog

• v7.0 (2026-09-26, effective from app v2.7.0): Section 4 adds two optional, user-entered public profile fields: social handles (Instagram, X, Bluesky, TikTok, YouTube; the handle only, never a link) and country (an ISO 3166-1 code picked from a list). Both are visible to every app user, signed in or not, next to the user's name on competition surfaces, and both are deleted with the account (section 5). Handles are never verified and we never contact those platforms. A section 6 addendum adds the profile as a report target and "impersonation" as a reason; upholding a profile report clears the display name, avatar and social handles, and keeps the country. New collected-data categories: social handles and country, both public and optional. No new device data, no new third parties we share data with, and no automated decision-making.
• v6.1 (2026-06-29, effective from app v2.5.0): Added a section 6 addendum — signed-in users can post public, self-deletable text comments on competition entries, and file private abuse reports against an entry or comment (visible only to the reporter and the admin). New collected-data categories: user-authored comment text and report reason/note, both tied to the account and cascade-deleted on account deletion. No new device data, no new third parties, no automated content classification or decision-making. Anonymous users can read comments but cannot post or report.
• v6.0 (2026-06-09, effective from app v2.3.0): Added the section 6 addendum disclosing that user-submitted competition entries become publicly visible (photo + optional commentary). No new collected-data categories — competition entries are already-uploaded photos under section 6's terms PLUS user-provided commentary text. Disclosed the 1-hour signed-link serving model. Withdrawal during the "open" state removes the entry from public view immediately; the underlying photo follows the section 6 retention rules.
• v5.0 (2026-06-08, effective from app v2.2.0): Added section 7 (admin moderation) — disclosure that admins (one user, Philipp Buchwald) can review pending photos via an in-app moderation queue. No new data categories collected from regular users; admins gain READ access to photos that already exist under section 6's terms. Renumbered the existing "Crash diagnostics" and "Google Play Store" subsections to 8 and 9.
• v4.0 (2026-06-05, effective from app v2.1.0): Added section 6 (user-uploaded photos): EXIF strip on-device, two-size WebP storage, per-user limits (5/day + 50 total), moderation default, cascade-delete on account deletion. Explicitly disclaims face recognition, content classification, AI training, third-party sharing. Updated section 5 (account deletion) to include the photo cascade. Updated "Data we do not collect" to clarify how camera + photo-library permissions are used. Updated "Where the data lives" with the new buckets. Updated GDPR access path to cover photos.
• v3.0 (2026-06-03, effective from app v2.0.0): Added section 4 (account data via Google/Apple sign-in) and section 5 (account deletion). Added the Play Console data-deletion URL.
• v2.0 (2026-05-09, effective from app v1.6.0): Added section 2 (opt-in community stats) and section 3 (in-app feedback form). Both are opt-in/explicit per submission.
• v1.0 (2026-04-24, effective from app v1.0.0): Initial policy. Local-only, no data collection.

Contact

Questions about privacy? Email support@pixel-paladin.de.