Privacy Policy

Who we are

imascot is an iOS app from Xultrai that lets you create procedural virtual pet mascots, customize them, and export animations. The app syncs your mascots with our backend so you can render and export from any device signed in with the same anonymous account.

Summary

We do not sell your data, we do not use third-party advertising or analytics SDKs in the app, and we do not track you across other companies' apps or websites. We collect only what is needed to operate the service: an anonymous device identifier, your mascot designs, and basic technical logs.

Data on your device

• Keychain: a random device token and session JWT used to authenticate API requests. These are stored securely by iOS and never leave your device except when sent to our API over HTTPS.
• UserDefaults: app preferences such as onboarding completion and haptic feedback settings.
• Local cache: rendered Lottie animations may be cached on disk to speed up previews.

Data on our servers

When you use imascot, the app communicates with our API hosted in the EU (Hetzner, Germany). We store:

• An anonymous user record linked to your device token (no name, email, or phone required).
• Your mascots: name, procedural seed, and design specification (JSON).
• Whether you have an active Pro subscription flag (when server-side verification is enabled).
• Temporary render cache in Redis (Lottie JSON keyed by design + gesture).
• Standard server logs (IP address, request path, User-Agent, timestamps) for security and abuse prevention. Logs are retained for a limited time.

What we do NOT do

• No third-party advertising networks.
• No cross-app tracking or "tracking" as defined by Apple's App Tracking Transparency framework.
• No sale of personal data.
• No social login — we do not receive your Apple ID, email, or contacts.

App updates (version check)

The app may contact our API to read version policy (latest supported version, optional force-update flag). We receive your app version and platform (iOS) via standard HTTP headers — not your mascot designs or device token contents beyond what is needed for authenticated endpoints.

In-App Purchases

Pro subscriptions and lifetime purchases are processed entirely by Apple. We do not receive your payment card details. Apple may provide us with limited transaction metadata (product ID, purchase date, subscription status) according to Apple's policies. Purchase verification uses Apple's StoreKit on your device.

Error monitoring (optional)

Our backend may optionally send error reports to Sentry for reliability. If enabled, reports can include request metadata and stack traces — not your mascot artwork content beyond what appears in an error message. The iOS app itself does not embed the Sentry SDK.

Retention & deletion

Mascots you delete in the app are soft-deleted on our servers. You may contact us to request deletion of your anonymous account and associated mascots. Cached renders expire automatically (typically within 30 days).

Children

The app is not directed at children under the age required in your region. Do not use the app if prohibited by local law.

Changes

We may update this policy by posting a new version on this site and updating the "Last updated" date.

Contact

For privacy questions, contact contact@xultrai.com.