DecalyPrivacy policy
In one paragraph
Decaly traces your pictures on your phone. Pictures are never uploaded, there is no account, and the app shows no ads. It does send anonymous usage statistics to Google Firebase, and it talks to Google Play, through RevenueCat, for the Decaly Pro subscription. This page lists exactly what that involves, who processes it, and how to have it deleted.
What stays on your device
- The pictures you open. A picture you choose with the photo picker, share to Decaly or open with Decaly is read from your phone and traced by code inside the app. A photo you take with the camera button is written by your camera app into Decaly’s private cache. No part of any picture, and no traced design, is ever sent anywhere by Decaly.
- My cut files (Decaly Pro). When you save a cut file, Decaly keeps a copy of the picture, a small thumbnail and your trace settings (colours, detail, layering, size, edits) in the app’s private storage, so you can save the design again later.
- The cut files you save. SVG, DXF and PNG files go where you choose to save them, or to the app you share them with. From then on they are yours, and Decaly doesn’t read them again.
- Settings: inches or centimetres, and a counter the app uses to decide when to ask for a Google Play review.
Android’s automatic cloud backup is switched off for this app, so none of this is copied to your Google Drive. Decaly holds no storage permission and no camera permission: pictures reach it through Android’s photo picker, your camera app, a share or “Open with”.
What leaves your device
Decaly uses Google Firebase Analytics to understand whether the app works and which features are used, and RevenueCat with Google Play Billing for the subscription. These send:
- Usage events that Decaly logs: that a picture was traced, with the number of colours and how long the trace took; that Save or Share was tapped and for which destination (Cricut Design Space, Silhouette Studio or Print Then Cut), and how many layers were saved; that the purchase screen was shown or closed and from where; that a purchase completed, failed or was restored, or a free trial started; that the review prompt was shown; and, if billing can’t start, a short reason such as “no Play Store”. Pictures, file names, colours and sizes are never part of an event.
- Events Firebase records by itself, such as the first open, sessions and app updates, with the device model, Android version, app version, language and an approximate country derived from the network connection.
- An app instance identifier that Firebase uses to tell one installation from another. It is not linked to your name or email. The Advertising ID is removed from this app and is not collected, and Firebase’s advertising-ID collection is switched off.
- Purchase and subscription status. Google Play handles the payment; RevenueCat receives the purchase receipt under an anonymous app user ID, so the app knows whether Decaly Pro is active and you can restore it on another device. We never see your payment details.
The app also includes Firebase Remote Config and Firebase App Check (Play Integrity) through code shared by our apps. Decaly does not use either today; if it starts to, Remote Config would download app settings using a Firebase installation identifier, and App Check would ask Google Play to confirm the app is genuine. Decaly does not include a crash-reporting SDK. If you have allowed your phone to share usage and diagnostics with Google, Google Play may show us crash and performance statistics that do not identify you.
On Google’s own test devices (the Play pre-launch report), Decaly turns analytics off so robots are not counted.
This data is used to fix faults and to decide what to improve. It is not sold, and it is not used for advertising.
Processors
- Google LLC — Firebase Analytics (and the unused Remote Config and App Check), Google Play Billing, and the Google Play in-app review card (Firebase privacy, Google privacy policy). A review you write in that card goes to Google Play under your Google account; Decaly never sees it.
- RevenueCat, Inc. — manages the subscription and its status (RevenueCat privacy policy).
- Cloudflare, Inc. — serves this website.
Deleting your data
This section applies to Decaly: PNG & Image to SVG (dev.machado001.decaly), published on Google Play by machado001.
Data on your device (saved designs in My cut files with their pictures, thumbnails and settings; the camera cache; your units setting and review-prompt counter): delete a design from My cut files in the app, or remove everything at once in Settings → Apps → Decaly → Storage → Clear storage, or by uninstalling the app. There is no copy anywhere else, so this deletes it completely. Cut files you saved to a folder or shared stay where you put them; delete them there.
Data held by our processors (usage events and app instance identifiers in Firebase Analytics; purchase records and the anonymous app user ID in RevenueCat): email machadowg@gmail.com with the subject “Decaly data deletion”. Because the app has no account, it helps to say roughly when you used the app and on which device model. We delete the data we can associate with your request and confirm by reply within 30 days. Firebase Analytics data is also deleted automatically when the project’s retention period runs out. Purchase records that Google Play and RevenueCat must keep for tax, fraud-prevention and accounting reasons are kept as long as the law requires, then deleted. Cancelling Decaly Pro is done in Google Play and does not by itself delete any data.
Children
Decaly is a crafting tool for adults and is not directed at children. It does not knowingly collect information from anyone under 13.
Your rights
Depending on where you live, you may have rights under the GDPR, the LGPD or the CCPA to access, correct, delete or export your data, and to complain to your data protection authority. Write to the address below and say which app you are writing about; requests are answered within 30 days.
This website
This site runs no JavaScript (its content security policy forbids scripts entirely), sets no cookies and loads nothing from other sites: its fonts are served from this domain. Cloudflare, which serves it, sees each request and the IP address it came from, as any web host does.
Changes
If this policy changes, the date at the top changes with it, and earlier versions remain in the history of the repository this site is built from.