Privacy Policy

This Privacy Policy explains how Art Block (the “Service”) collects, uses, and shares personal information when you use our mobile application. “We”, “us”, and “our” refer to the operator of Art Block described under Who we are below. By using the Service, you agree to this policy. If you do not agree, please do not use the Service.

Who we are

Art Block is a mobile app for scheduling, logging, and (optionally) sharing creative practice. It is developed and published by Vardar Studio Inc., based in Quebec, Canada, using the Art Block name on the Apple App Store, Google Play, and related materials.

For privacy law (including who is responsible for decisions about your personal information), the data controller is Vardar Studio Inc., identified as the app’s developer / seller on the Apple App Store and Google Play listings for Art Block. You can reach us as described under Contact below.

Backend providers we use

Art Block relies on a small number of third-party processors to run the Service on our behalf:

• Apple — App Store distribution, in-app purchases, Sign in with Apple, APNs push delivery, local notification delivery, and platform-level protections on iOS.
• Google — Google Play distribution and in-app purchases on Android, Sign in with Google where offered, and Firebase Cloud Messaging for Android push delivery.
• RevenueCat — RevenueCat validates App Store and Google Play purchases and manages subscription entitlements. It may process device identifiers and purchase / transaction information.
• Supabase — Supabase hosts the Art Block backend. Cloud backup of your practice content, your social profile, your shared sessions and any cover photos you attach to them, your follows / groups / likes / comments, your in-app notifications, push device tokens we register for social alerts, and your moderation actions (blocks, mutes, reports) are stored on Supabase infrastructure. Files (such as session cover photos, profile avatars, and group avatars / banners) are kept in Supabase Storage.

Supabase data is currently hosted on infrastructure located outside Canada (typically in the United States, depending on the project region). If we move to a different region we will update this policy.

Information we collect

Art Block is local-first: your practice journal lives on your device. When you are signed in, cloud backup keeps a structured copy on our backend so you can move between devices. Optional social features let you share parts of your practice with other people you choose to follow, after you activate social in the app.

1. Account and sign-in

To use the Service, you must sign in and create an account on our backend (hosted by Supabase). Depending on your platform, you can sign in with Sign in with Apple (iOS), Sign in with Google (Android), and/or email and password. We store your account identifier, session tokens, and (for email sign-in) your email address as needed to authenticate you. If you use Sign in with Apple, Apple may share your name or email with us according to the choices you make in Apple’s sign-in sheet. If you use Sign in with Google, Google may share basic account information (such as your email) with us according to the permissions you grant.

New email accounts may need to confirm their email address before sign-in completes, depending on how our authentication service is configured.

Sign-in credentials and tokens are stored on your device. Signing out clears local practice data on the device; your cloud backup remains tied to your account until you delete it or delete your account.

2. Practice content (cloud backup and on-device photos)

Art Block is local-first: your practice journal is stored on your device. When you are signed in, the app also uploads a structured copy of your practice content to your private row on Supabase — scheduled practices, session logs, focused minutes, notes, mediums, pursuits, and a small embedded copy of your profile avatar for backup restore. Only you (the signed-in account) can read this backup row under normal operation. We do not analyse the contents of your practice journal for advertising.

Session diary photos (images you attach to a logged session) are kept primarily on your device. They are not fully embedded in the cloud backup payload. If you share a session to social and attach a cover photo, that cover is uploaded separately to Supabase Storage as described below.

3. Social profile (only after you activate social)

Social is off by default for new accounts. Until you complete activation in the Social tab, other users cannot discover you and your sessions are not published to the feed.

When you turn social on, we store a profile keyed to your account: username, bio, profile avatar, discoverability preference, whether you require manual approval for follow requests, and whether your profile is public or private (which affects the default audience for sessions you mark as shared). Other Art Block users may see this profile if you make yourself discoverable, or if they look you up by username.

4. Shared sessions, likes, and comments

When you share a practice session — manually or via the optional auto-share setting — a copy of that session (title, category, mediums summary, focused minutes, log time, your note, and the cover photo you attached, if any) is stored on our servers. In the app you choose whether a session is private or shared on social; your public vs private profile setting determines whether shared sessions are visible to followers or all signed-in users who can find you. You may also tag a session to a group, limiting visibility to that group’s members. Cover images are uploaded to Supabase Storage and served through short-lived signed URLs. Other users’ likes, comments, and timestamps are stored against that session row.

5. Followers, following, and groups

We store your follow relationships, follow requests (incoming / outgoing / accepted / declined), group memberships, group session templates you create or adopt, and (for group admins) group avatar / banner images. Group leaderboards and feeds are produced from this data.

6. Notifications (in-app, local, and optional push)

When someone follows you, requests to follow you, accepts your follow request, or likes / comments on a session you shared, we create an in-app notification row referencing the actor and the related entity. You can turn most notification categories off in Settings (follow, likes, comments). Follow-request and follow-accepted notifications stay on because they are actionable.

Practice reminders are scheduled as local notifications on your device. If you grant notification permission, we may also send optional social push notifications for those same social events (not marketing). On iOS this uses Apple’s push service (APNs); on Android this uses Firebase Cloud Messaging. We store a device push token on our backend so we can deliver those alerts to your signed-in devices. You can revoke notification permission in system settings at any time; we do not send marketing push.

7. Moderation data (blocks, mutes, reports)

We store the following so the app’s safety features work:

• Blocks — pairs of (blocker, blocked) account identifiers. Blocking another user also hard-deletes any prior follows, follow requests, likes, comments and notifications between the two of you.
• Mutes — pairs of (muter, muted) identifiers. The muted user is not told they were muted.
• Reports — when you report a session or profile, we store the reporter’s account identifier, the reported user’s account identifier, the reported session id (if any), the category you chose, and any short text you added. Vardar Studio Inc. can review reports for moderation purposes. Reports are not visible to other users.

8. Anti-abuse rate-limit log

To prevent automation and accidental loops from overloading the Service, the backend keeps a short, append-only log of write attempts (follow, like, comment, publish session, change session cover) keyed to your account. Entries are automatically deleted within roughly an hour. The log is not exposed to clients and is only used to enforce per-user thresholds.

9. Photos, camera, and images you choose

If you attach a photo to a session log, set a session cover when sharing, set a profile avatar, or add a group banner, the app may access your photo library or camera only when you choose to pick or take an image. We re-encode the chosen image to a small JPEG before uploading where applicable. Avatar bytes may be stored on the corresponding profile / group row and in your cloud backup snapshot; session covers are stored as files in Supabase Storage.

Art Block does not read your contacts, calendar, location, or microphone for advertising. The “Find friends” screen is a username search only.

10. Optional focus shield (iOS — Screen Time / Family Controls)

On iOS, if you enable focus shielding during onboarding or in the timer, the app uses Apple’s Family Controls / Screen Time APIs to help block distracting apps while you practice. This feature is optional and is not available on Android. The apps or categories you select are processed on your device through Apple’s frameworks; we do not upload your app-selection list to our servers for advertising. You can change or disable this permission in iOS Settings at any time.

11. Payment-related information

Paid features are purchased through the Apple App Store (iOS) or Google Play (Android). We do not receive your full payment card details. RevenueCat receives the transaction information needed to validate purchases and report entitlements.

12. Device and technical data

Such as device type, operating system, app version, and crash / diagnostic information allowed by your device settings. If we add third-party crash or analytics tools, we will list them here and update this policy before they go live.

How we use information

We use personal information to:

• Provide, maintain, and improve the Service;
• Sync your practice content across your devices via cloud backup;
• Operate the optional social layer — show your profile to people you’ve made yourself visible to, deliver follow / like / comment / group activity, and route in-app notifications;
• Manage subscriptions and entitlements (through RevenueCat);
• Enforce our Terms of Use and protect users — for example by honouring blocks and mutes, applying server-side rate limits, reviewing reports, and removing or restricting content or accounts where appropriate;
• Detect, prevent, and address technical or security issues, abuse, or fraud;
• Comply with law and protect rights, safety, and security.

How information is shared with other users

Most of what the social features store is intentionally visible to other users. The visibility you choose for each shared session controls who can see it:

• Private (not shared) — the session is not on your social feed; only you see it in your diary.
• Shared — followers audience — when your profile is private, shared sessions are visible to accounts that follow you (subject to follow-approval settings).
• Shared — public audience — when your profile is public, shared sessions may be visible to signed-in users who can find you (subject to discoverability settings).
• Group — visible only to active members of the group you tagged.

Your username, bio, avatar, follower / following counts, and any sessions you choose to publish at followers or public may be shown to other Art Block users. Likes and comments you leave on someone else’s session are visible to the audience that can see that session.

Storage, retention, and international transfers

Cloud backup, social, and moderation data are stored on Supabase infrastructure (currently outside Canada, typically in the United States). Subscription processing through RevenueCat may also involve servers outside Canada.

We retain personal information only as long as reasonably needed for the purposes described in this policy:

• Your cloud backup persists until you delete the data through the app, or you delete your account.
• Shared sessions, likes, and comments persist until you delete them or your account.
• Notifications are pruned over time and you can dismiss them individually.
• Reports may be retained even after the related session or account is removed, where reasonably necessary for safety, abuse prevention, or to meet legal obligations.
• Rate-limit log entries are removed within roughly an hour.

Sharing with third parties

We do not sell your personal information. We may share information with:

• Apple — to operate App Store distribution, subscriptions, Sign in with Apple, APNs, and platform-level protections on iOS.
• Google — to operate Google Play distribution, subscriptions, Sign in with Google, and Firebase Cloud Messaging on Android.
• RevenueCat — to validate App Store and Google Play purchases, manage entitlements, and perform related technical operations.
• Supabase — as our hosting and database processor, for cloud backup, the social features, file storage, authentication, and push-device registration.
• Other service providers — if we add new vendors (for example email delivery or analytics), we will list them here when they apply.
• Legal or safety — when required by law, legal process, or a proportionate request by public authorities, or to protect users, the public, or the Service.

Your choices and rights

• Social is off by default. You can turn social off again at any time in Settings. When social is off you are not discoverable, your profile is not shown to other users, and auto-share is disabled.
• You control your discoverability, whether follows require manual approval, the default audience for shared sessions, and which notification categories generate activity rows for you.
• You can delete your shared sessions, likes, comments, follows, and groups from inside the app. Deleting a shared session also removes its cover photo from Supabase Storage.
• You can block or mute any other user from their profile or any of their cards in the feed.
• You can report a session or profile that violates our Terms.
• You can delete your account from inside the app (Profile → Settings → Delete account). This removes your cloud backup, social profile, shared sessions, follows, groups, and related account data. Step-by-step instructions are on our account management page. You may also contact us if you need help. Some moderation records (such as past reports filed by or against you) may be retained where reasonably necessary for safety or to meet legal obligations.
• If you are in Canada, including Quebec, you may have rights to access your personal information, correct inaccuracies, withdraw consent where processing is consent-based, and obtain information about how we handle personal information, subject to applicable exceptions. You may also have the right to challenge compliance and, where applicable, to request cessation of dissemination or de-indexation in line with local law.
• To exercise these rights, contact us as described under Contact. We may need to verify your identity before responding.

Children

The Service is a productivity and journaling style tool for artists; it is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child has provided us with personal information, please contact us using the details under Contact and we will take reasonable steps to delete it. Age thresholds and consent rules can vary by region; additional requirements may apply where local law says so. The social features in particular are not intended for users under 13, and we may suspend accounts we reasonably believe are used in violation of these age requirements.

Changes

We may update this policy from time to time. When we do, we will post the updated version on this page and change the “Last updated” date above. If we materially expand what we collect — for example by adding a public web profile, advertising, or new third-party processors — we will surface a notice in the app where practicable.

Contact

Questions about this policy, support, or requests regarding your personal information (including help with account deletion, which is also available in-app; see account management):

• Vardar Studio Inc. — vardarstudio.com
• Email: contact@vardarstudio.com
• You may also use the developer contact channel shown on the Apple App Store or Google Play listing for Art Block.

Data controller: Vardar Studio Inc. (Quebec, Canada), developer of Art Block on the Apple App Store and Google Play.

Apple and Google have their own privacy policies governing their platforms and services (App Store / iOS / APNs, Google Play / Sign-In / Firebase). Supabase and RevenueCat also publish their own privacy policies; see the links above.