Privacy Policy

Last updated: 23.04.2026

1. Data Controller

Frontroll Development – André Frank
Delstrup 95
48167 Münster

Email: frontroll.development@mail.online-impressum.de
Phone: +4915111057527

2. General Usage

The app "Color Star" can be used without registration and without creating a user account. No actively entered personal data is collected. The App does not contain any tracking, analytics, or advertising SDKs.

When using the image import feature, images selected from your device gallery are processed entirely on your device. No image data, metadata, or derivatives are transmitted to any server.

3. Legal Basis for Processing

Insofar as personal data is processed, this is done on the following legal bases:

• Art. 6(1)(b) GDPR – Processing necessary for the performance of a contract (e.g., providing App features, processing in-app purchases).
• Art. 6(1)(f) GDPR – Processing necessary for the purposes of legitimate interests (e.g., technically necessary server log data to ensure security and stability).

4. Technically Necessary Data

When retrieving image content via our server service (Supabase), technically necessary server log data may be processed:

• IP address (full)
• Time of access
• Requested resource
• Device type and operating system

Retention period: Server log data is stored for a maximum of 30 days and then automatically deleted.

Anonymous Error Reporting

To maintain app stability, anonymous error data may be transmitted to our server when the app encounters a technical problem. This data includes:

• Error type and stack trace (technical code path information)
• App version and build number
• Operating system name and version (e.g., "Android 14", "iOS 17")
• A hash value derived from the error (for grouping identical errors)

This data is fully anonymous — no IP addresses, device identifiers, user accounts, or other personally identifiable information is stored in error records. The data is used exclusively for identifying and fixing technical issues.

Retention period: Error reports are stored for a maximum of 90 days and then deleted.

Data processing agreement: Supabase (Supabase Inc., USA) is used as a data processor pursuant to Art. 28 GDPR. Data processing is governed by a Data Processing Agreement (DPA) concluded with Supabase. The project is hosted on AWS EU infrastructure (Frankfurt, Germany / eu-central-1) — data is processed within the European Union. Supabase uses Amazon Web Services (AWS) EU data centers as infrastructure sub-processor. For more information, see https://supabase.com/privacy.

5. Third-Party Libraries and APIs

The App uses third-party libraries and APIs to provide its features (e.g., image rendering, network communication). These libraries are used exclusively for functional purposes – not for tracking, analytics, or advertising.

When using third-party APIs, technically necessary data (e.g., IP address) may be transmitted to the respective service providers. This processing is based on our legitimate interest in providing the App's functionality (Art. 6(1)(f) GDPR).

6. App Store Providers

When downloading the App from the Apple App Store or Google Play Store, personal data is processed by the respective provider (e.g., Apple ID, Google account, payment information). This processing falls under the responsibility of Apple Inc. or Google LLC. The respective privacy policies of those providers apply.

7. In-App Purchases

Optional purchases (Pro version) are processed exclusively through Apple In-App Purchase and Google Play Billing. Payment data is not collected, processed, or stored by the developer. Payment data processing is handled solely by the respective app store provider.

8. Local Storage

Colored and edited pictures are stored exclusively locally on the user's device. When using the image import feature, imported photos and the resulting paintings are also stored exclusively on your device and are never transmitted to any server. This data is deleted when you delete the painting within the App or uninstall the App.

Imported photos may contain embedded metadata (e.g., EXIF data such as GPS location, camera model, date/time). This metadata is stored locally as part of the imported image and is not processed, extracted, or transmitted by the App. When sharing paintings derived from imported photos, the shared image does not include the original photo's metadata.

9. Sharing Feature

When users share their creations via the App's sharing feature, images are transmitted to the platform or app chosen by the user (e.g., messaging apps, social media). This transmission occurs at the user's explicit request. The respective privacy policies of the target platform govern any further processing.

This applies equally to paintings created from App-provided templates and from user-imported photos via image import. When sharing a painting derived from an imported photo, only the painted version is shared — the original source photo is not included.

10. Use by Children (COPPA Compliance)

The App is suitable for children. We take the protection of minors seriously.

• Children under the age of 13 require verifiable parental or guardian consent.
• We do not knowingly collect personal information from children under 13 without parental consent.
• No targeted data collection, tracking, or profiling of children takes place.
• Error reporting data is fully anonymous and contains no personally identifiable information.
• Parents and guardians should be aware that the image import feature allows children to import photos from the device gallery. No imported image data leaves the device, but parents should supervise which photos children access and import.

11. Rights of Data Subjects (GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – Information about processed data.
• Right to rectification (Art. 16 GDPR) – Correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) – Deletion of your data under certain conditions.
• Right to restriction of processing (Art. 18 GDPR) – Restriction of processing under certain conditions.
• Right to data portability (Art. 20 GDPR) – Receipt of your data in a structured, commonly used format.
• Right to object (Art. 21 GDPR) – Objection to processing based on legitimate interests.

To exercise your rights, please contact us at frontroll.development@mail.online-impressum.de.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent supervisory authority for the data controller is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW): https://www.ldi.nrw.de

13. Changes to This Privacy Policy

This privacy policy may be updated as needed. Material changes will be communicated through the App or via other appropriate means. The current version available in the App shall apply.