Privacy Policy

This Policy regulates the processing of personal data of users of the «iFutureArt · Paint by Numbers» service (hereinafter «the App»). The App is provided as a mini-app in several messengers and as native applications:

Platform	Technology	Address / bot
Telegram	Mini App (Telegram WebApp SDK)	@Paintbyapp_bot · app.ifutureart.com
MAX	Mini App (MAX Bridge)	id1655495116_bot · max.ifutureart.com
VK	VK Mini App	vk.ifutureart.com
iOS / Android	Native applications	via api.ifutureart.com

This Policy supplements the general policy of ifutureart.ru.

1. Operator

LLC «INTERNATIONAL ART»
INN 1655495116 · OGRN 1231600023710
Address: 420111, Republic of Tatarstan, Kazan, Telmana str., 24
Personal data contact: privacy@ifutureart.ru

2. What data we process

Data sent by the platform when launching the App (initData / launch params / Apple identity token):

• User identifier in the platform (Telegram user_id, MAX user_id, VK user_id or Apple sub)
• First name, last name — if specified in the profile and passed by the platform (VK launch params, for example, do not pass the name — it is fetched separately via VK Bridge with your consent)
• Username — if open in the profile
• Profile photo URL — if provided by the platform
• Interface language code (en, ru, es)
• Email and privateRelay flag — only for iOS/Android users signing in with Apple, and only if you explicitly shared your email

Accounts on different platforms are independent. The same person logging in via Telegram, MAX, VK and the iOS app will have four separate accounts with their own progress, points and achievements. Account linking between platforms is not currently implemented.

Data created during use:

• Picture progress (filled regions, painting time)
• Points history, achievements, debits and credits
• Messages and emoji reactions in collaborative sessions
• Referral connections (who invited, how many invited)
• Settings (theme, language, painting options)
• Share cards with progress (stored up to 7 days)
• APNS / push tokens of devices — for iOS users to deliver notifications
• Technical logs (in case of errors — 30 days)

What we do NOT collect:

• Passwords, PINs, payment card data
• Geolocation
• Phone book contacts
• History of other apps and websites
• Biometrics, face recognition
• IDFA and any cross-app tracking IDs
• Cross-app / cross-website tracking of any kind — we do not follow you across other apps or websites
• Data for advertising networks or data brokers

Apple Privacy Nutrition Label for the iOS app: all collected data is classified as «Data Linked to You» (linked to your ID), «Not Used to Track You» (not used for tracking purposes per App Tracking Transparency).

3. Purposes of processing

• App functionality (saving progress, leaderboards, collaborations)
• Sending notifications in the platform you logged in with (Telegram, MAX, or APNS to your iOS device): invitations, reminders, collaboration results
• Aggregated analytics and product improvement
• Security, anti-spam and anti-multi-accounting within a single platform

4. Legal grounds

Processing is carried out in accordance with the Federal Law of the Russian Federation No. 152-FZ «On Personal Data» on the basis of:

• Your consent (the act of launching the App in Telegram, MAX, VK, or installing the native app constitutes consent)
• Performance of the offer-contract (these Terms of Service)
• Legitimate interests of the Operator (analytics, security)

5. Transfer to third parties

Your data is transferred only to:

• Telegram Messenger Inc. — for Telegram users, via Telegram Bot API, in accordance with the Telegram Privacy Policy
• MAX (JSC «Communication Platform») — for MAX users, via MAX Bot API (platform-api.max.ru), in accordance with MAX policy
• VK (VKontakte) — for VK Mini App users, via VK Mini Apps API, in accordance with VK Policy
• Apple Inc. — for iOS users, via Sign in with Apple and Apple Push Notification service (APNS), in accordance with the Apple Privacy Policy
• Hosting provider — for hosting servers (servers are located in Russia)
• Russian government bodies — in cases provided by law

We do not sell your data. We do not share it with advertising networks. We do not use it for cross-border transfer.

6. Storage periods

Data	Period
Picture progress, points, achievements	Until account deletion
Chat messages in collab	30 days after session end
Share cards	7 days
APNS / push tokens of devices	Until app uninstall or explicit notification opt-out
Technical error logs	30 days
Login history	90 days

7. Your rights

You have the right to:

• Get information about what data we have about you
• Get a copy of your data
• Correct inaccurate data
• Delete your account and all associated data («right to be forgotten»)
• Withdraw consent to processing
• Appeal the Operator's actions to Roskomnadzor or in court

In-app account deletion (iOS / Android):
Open Settings → Delete account. A two-step confirmation prevents accidental deletion. Upon confirmation:

• E-mail, Apple ID link, Telegram link are erased
• Push tokens for your devices are removed
• All accumulated points are forfeited from this account
• The account is deactivated (deleted_at flag) and cannot be recovered — signing in again with the same Apple ID will create a BRAND NEW account starting from 0 points
• Your name in past collab sessions and public leaderboards stays preserved (public historical record about a picture)

Mini App deletion (Telegram / MAX / VK):
Since the mini-app uses your platform ID, there is no in-app delete button — revoke bot access in your platform settings (Telegram → @Paintbyapp_bot → ⛔ Stop and block bot, similarly in MAX/VK), or write to privacy@ifutureart.ru.

Send requests to privacy@ifutureart.ru with the subject «iFutureArt». Response — within 10 business days. Account deletion on request affects only the account for which you sent the request (if you use the App on several platforms — you need to specify which accounts to delete).

8. Security

• Authentication via HMAC signature of initData for all messengers (Telegram WebApp / MAX Bridge / VK Mini Apps), or via Apple identity token for iOS — no passwords
• All data is transmitted over HTTPS / WSS
• Servers are located in the Russian Federation
• Database access is restricted, logged
• Daily database backups

9. Cookies and similar technologies

The App does not use cookies in the classical sense. It stores in the local storage of the messenger's WebApp / Bridge (or in the local storage of the app for iOS/Android) only user interface settings (selected category, theme, language).

10. Children

The App is not intended for persons under 13. If you believe that a child under 13 has shared data with us, please write to privacy@ifutureart.ru — we will delete the data.

11. Policy changes

The current version is always available at app.ifutureart.com/privacy/en/, max.ifutureart.com/privacy/en/ and vk.ifutureart.com/privacy/en/. Material changes are announced in the channels: @ifutureart on Telegram and channel on MAX; native app users receive an on-device notification.