This Policy regulates the processing of personal data of users of the «iFutureArt · Paint by Numbers» service (hereinafter «the App»). The App is provided as a mini-app in several messengers and as native applications:

Platform	Technology	Address / bot
Telegram	Mini App (Telegram WebApp SDK)	@Paintbyapp_bot · app.ifutureart.com
MAX	Mini App (MAX Bridge)	id1655495116_bot · max.ifutureart.com
VK	VK Mini App	vk.ifutureart.com
iOS / Android	Native applications	via api.ifutureart.com

This Policy supplements the general policy of ifutureart.ru.

1. Operator

LLC «INTERNATIONAL ART»
INN 1655495116 · OGRN 1231600023710
Address: 420111, Republic of Tatarstan, Kazan, Telmana str., 24
Personal data contact: privacy@ifutureart.ru

2. What data we process

Data sent by the platform when launching the App (initData / launch params / Apple identity token):

• User identifier in the platform (Telegram user_id, MAX user_id, VK user_id or Apple sub)
• First name, last name — if specified in the profile and passed by the platform (VK launch params, for example, do not pass the name — it is fetched separately via VK Bridge with your consent)
• Username — if open in the profile
• Profile photo URL — if provided by the platform
• Interface language code (en, ru, es)
• Email and privateRelay flag — only for iOS/Android users signing in with Apple, and only if you explicitly shared your email

Accounts on different platforms may have separate progress and balances. If you use the account linking available in the App, the result depends on the confirmed link; matching names alone do not link accounts.

Data created during use:

• Picture progress (filled regions, painting time)
• Points history, achievements, debits and credits
• Messages and emoji reactions in collaborative sessions
• Referral connections (who invited, how many invited)
• Settings (theme, language, painting options)
• Share cards with progress (stored up to 7 days)
• APNS / push tokens of devices — for iOS users to deliver notifications
• Technical logs (in case of errors — 30 days)

What we do NOT collect:

• Passwords, PINs, payment card data
• Geolocation
• Phone book contacts
• History of other apps and websites
• Biometrics, face recognition
• IDFA and any cross-app tracking IDs
• Cross-app / cross-website tracking of any kind — we do not follow you across other apps or websites
• Data for advertising networks or data brokers

Apple Privacy Nutrition Label for the iOS app: all collected data is classified as «Data Linked to You» (linked to your ID), «Not Used to Track You» (not used for tracking purposes per App Tracking Transparency).

Stars purchases involve the amount, Telegram payment identifier, credit and possible refund records; purchase evidence includes the accepted terms version, language and server time. We do not receive bank details for Stars payments.

3. Purposes of processing

• App functionality (saving progress, leaderboards, collaborations)
• Sending notifications in the platform you logged in with (Telegram, MAX, or APNS to your iOS device): invitations, reminders, collaboration results
• Aggregated analytics and product improvement
• Security, anti-spam and anti-multi-accounting within a single platform

4. Legal grounds

Data necessary for sign-in, progress and balance storage, purchase fulfilment and support requests is processed to perform the contract with the user (Article 6(1)(5) of Russian Federal Law No. 152-FZ).

Processing necessary to comply with statutory obligations relies on the relevant legal basis (Article 6(1)(2)). Security and abuse prevention may rely on legitimate interests subject to respecting user rights (Article 6(1)(7)). Anonymised aggregate statistics are used for product analysis.

Where a purpose requires consent, that consent must be separate, specific and informed and may be withdrawn. Launching or installing the App, this Policy and accepting purchase terms do not themselves provide it. Contractual necessity does not automatically cover advertising, publication of personal data or other optional purposes. Platform notification permission does not replace consent where the law requires it.

5. Transfer to third parties

Your data is transferred only to:

• Telegram Messenger Inc. — for Telegram users, via Telegram Bot API, in accordance with the Telegram Privacy Policy
• MAX (JSC «Communication Platform») — for MAX users, via MAX Bot API (platform-api.max.ru), in accordance with MAX policy
• VK (VKontakte) — for VK Mini App users, via VK Mini Apps API, in accordance with VK Policy
• Apple Inc. — for iOS users, via Sign in with Apple and Apple Push Notification service (APNS), in accordance with the Apple Privacy Policy
• Hosting provider — for hosting servers (servers are located in Russia)
• Russian government bodies — in cases provided by law

We do not sell your data. We do not share it with advertising networks. We do not use it for cross-border transfer.

6. Storage periods

Data	Period
Picture progress, points, achievements	Until account deletion
Chat messages in collab	30 days after session end
Share cards	7 days
APNS / push tokens of devices	Until app uninstall or explicit notification opt-out
Technical error logs	30 days
Login history	90 days

7. Your rights

You have the right to:

• Get information about what data we have about you
• Get a copy of your data
• Correct inaccurate data
• Delete your account and all associated data («right to be forgotten»)
• Withdraw consent to processing
• Appeal the Operator's actions to Roskomnadzor or in court

In-app account deletion (iOS / Android):
Open Settings → Delete account. A two-step confirmation prevents accidental deletion. Upon confirmation:

• E-mail, Apple ID link, Telegram link are erased
• Push tokens for your devices are removed
• All accumulated points are forfeited from this account
• The account is deactivated (deleted_at flag) and cannot be recovered — signing in again with the same Apple ID will create a BRAND NEW account starting from 0 points
• Your name in past collab sessions and public leaderboards stays preserved (public historical record about a picture)

Mini App deletion (Telegram / MAX / VK):
Since the mini-app uses your platform ID, there is no in-app delete button — revoke bot access in your platform settings (Telegram → @Paintbyapp_bot → ⛔ Stop and block bot, similarly in MAX/VK), or write to privacy@ifutureart.ru.

Send requests to privacy@ifutureart.ru with the subject «iFutureArt». Response — within 10 business days. Account deletion on request affects only the account for which you sent the request (if you use the App on several platforms — you need to specify which accounts to delete).

8. Security

• Authentication via HMAC signature of initData for all messengers (Telegram WebApp / MAX Bridge / VK Mini Apps), or via Apple identity token for iOS — no passwords
• All data is transmitted over HTTPS / WSS
• Servers are located in the Russian Federation
• Database access is restricted, logged
• Daily database backups

9. Cookies and similar technologies

The App does not use cookies in the classical sense. It stores in the local storage of the messenger's WebApp / Bridge (or in the local storage of the app for iOS/Android) only user interface settings (selected category, theme, language).

10. Children

The App is not intended for persons under 13. If you believe that a child under 13 has shared data with us, please write to privacy@ifutureart.ru — we will delete the data.

11. Policy changes

The current version is always available at app.ifutureart.com/privacy/en/, max.ifutureart.com/privacy/en/ and vk.ifutureart.com/privacy/en/. Material changes are announced in the channels: @ifutureart on Telegram YouTube Instagram and channel on MAX; native app users receive an on-device notification.