Plain-language summary: We use the information needed to create and store your designs, run purchases and credits, keep the service safe, and help when something fails. We do not sell personal information.
1. Who this policy covers
This policy applies to the Shape My Signature website and applications for iPhone, iPad, Android, and Mac (together, the “Service”). Shape My Signature is the name under which the Service is provided. “We,” “us,” and “our” refer to the Service publisher.
Effective date: September 1, 2026.
2. Information we process
Account and authentication
The app can begin with a Firebase anonymous user identifier. If you choose to link Google or Apple sign-in, we receive the account identifiers and profile details those providers make available, such as your email address and display name. We do not receive your Google or Apple password.
Creative input and output
We process the name or word you enter, selected letter, object or visual idea, style choices, generation settings, generated prompt, job status, and finished image. Generated images and related records are stored in Firebase so the app can show your gallery and recover work associated with the same account.
If you choose handwriting reference mode, the app processes a drawing or a locally prepared image from Camera, Photos, or Files. Only the processed image pixels needed for generation are uploaded; the original file and its metadata are not sent. A reference is treated as creative input, not biometric identity data and not a signature-verification record.
Purchases and credits
When purchases are offered, Apple or Google handles payment. RevenueCat processes subscription, product, entitlement, transaction-event, and virtual-credit information needed to validate purchases and maintain the credit balance. We do not receive your full card number.
Device, reliability, and notifications
Firebase App Check and related platform integrity services process device or app-attestation signals to reduce abuse. If you allow notifications, we store a push token and platform information to send generation updates. Firebase Analytics and Crashlytics may process app events, device characteristics, diagnostics, crash traces, and approximate technical location such as country derived from network information, depending on platform settings and consent requirements.
Website
This website does not currently use advertising trackers, marketing pixels, or an email signup form. Firebase Hosting and its infrastructure may process ordinary request data such as IP address, browser type, requested URL, and timestamps for security and delivery.
3. Why we use information
- create, queue, deliver, display, save, and delete signature artwork;
- provide authentication, account linking, gallery recovery, and support;
- validate subscriptions, purchases, entitlements, and credit changes;
- prevent duplicate charges, abuse, fraud, and unauthorized requests;
- send generation-status notifications you have allowed;
- diagnose failures and improve reliability, accessibility, and performance; and
- meet legal, tax, accounting, security, and dispute-resolution obligations.
Depending on where you live, these uses rely on providing the Service you request, our legitimate interests in operating it safely, your consent where required, or compliance with law.
4. Services that process information for us
- Google Firebase and Google Cloud: authentication, database, file storage, server functions, app integrity, hosting, diagnostics, analytics, and messaging.
- OpenAI: prompt assistance and image generation using the text, settings, and optional processed reference pixels required for your request.
- RevenueCat: subscription, entitlement, purchase-event, and virtual-credit processing.
- Apple and Google: sign-in, app distribution, platform integrity, notifications, and store payment processing as applicable.
These providers process information under their own terms and privacy commitments. Information can be processed in countries other than yours. Where required, we rely on provider safeguards and lawful transfer mechanisms.
We may also disclose information when required by law, to protect users or the Service, or as part of a business transfer with appropriate safeguards. We do not sell personal information.
5. Retention, recovery, and deletion
Account records and completed creations are generally kept while your account remains active or until you delete them. Operational, security, purchase, and credit records may be retained longer where needed for settlement, fraud prevention, legal compliance, or dispute handling.
An account-deletion request starts a seven-day recovery period. New generations and purchases are paused during that period, and you can cancel the request in the app before permanent deletion begins. After the deadline, the process removes the Firebase Authentication account, private Firestore account data, stored generation images, and the associated RevenueCat customer, subject to retry-safe completion and legally required records.
Deleting an account or uninstalling the app does not cancel an Apple App Store or Google Play subscription. Cancel it separately in the store that billed you. See Delete your account and data for instructions.
6. Your choices and rights
You can choose whether to link a Google or Apple account, add a handwriting reference, allow Camera/Photos access, or enable notifications. Platform settings can revoke those permissions. The app provides controls to delete individual creations, delete all creations, and schedule account deletion.
Depending on your location, you may have rights to access, correct, delete, restrict, or receive a copy of personal information, and to object to or withdraw consent for certain processing. Email us to make a request. We may verify that the request belongs to you and may keep information where law permits or requires.
Children
The Service is not directed to children below the minimum digital-consent age in their country and is never intended for children under 13. If you believe a child provided personal information without appropriate permission, contact us so we can review and remove it.
Security
We use access controls, private storage rules, authenticated backend operations, app-integrity checks, encryption in transit, and limited access to protect information. No online system can guarantee absolute security.
7. Contact and policy changes
For privacy questions or requests, email support@shapemysignature.app. Please do not send passwords, Apple credentials, Google credentials, or full payment-card information.
We may update this policy when the Service, providers, or legal requirements change. We will update the effective date and provide additional notice in the app when a change is material.