Privacy Policy
Last updated: 30 September 2026
Idealit ("the app", "we") helps you design and share branded social cards. This policy explains what data the app and the website at idealit.app handle, where it goes and why. It is published at https://idealit.app/privacy/.
The controller of your personal data is Katse Holding Oy (Finnish business ID 3274118-8), registered office Helsinki, Finland. Contact: hello@idealit.app.
The short version
- Your cards, styles, templates and photos are stored on your device.
- Using the app needs a sign-in with your email (a one-time code, no password). The account carries your plan and AI credits, and we keep a synced copy of your cards' text, colours and layout so they can reach your other phone. Photo files are not uploaded for sync.
- AI features are opt-in. Before the first AI request the app asks for your permission and says what is sent and to whom; you can turn AI off at any time in Profile. Each request sends only what that action needs (your text, and the photo if the feature works on a photo) to our server and on to the AI provider, for that request only. We use the providers' paid API services, under which requests are not used to train their models, and we do not use them to profile you. Only use photos of people who have agreed to it.
- If you join the waitlist on our website, we keep your email address to tell you once when the app launches.
- Payments are handled by the App Store (Apple) or Google Play in the app, and by Stripe on the web. We never see your card details.
Data we process
| Data | Where it lives | Why | Legal basis |
|---|---|---|---|
| Cards, styles, templates, versions, photos | Your device | To save your work | Performance of our service to you |
| Name and email you type into Profile | Your device only | To personalise the app | Performance of the service |
| Anonymous install ID | Your device and our server | To link a purchase to your install before you sign in | Performance of the service |
| Account: email address, account ID, sign-in sessions | Our server | Sign-in, your plan and cross-device use | Performance of the service |
| Synced library: card text, colours, layout, style settings | Our server (only if signed in) | To restore your cards on another device | Performance of the service |
| One-time sign-in codes | Sent to your email via our email provider; kept on our server for 10 minutes | To sign you in | Performance of the service |
| AI requests: prompt text, and the photo when the feature uses one | Our server → AI provider, for that request | To return suggestions, images or text placement | Your consent (asked in the app, withdrawable in Profile) |
| Subscription status and purchase proof (Google Play token or App Store signed transaction) | Our server, and Google Play or Apple | To unlock paid features and verify purchases | Performance of the service |
| Waitlist email | Our server | To email you once at launch | Your consent (you can withdraw it any time) |
| Server logs: IP address, time, requested path | Our server, kept up to 30 days | Security, abuse prevention and rate limiting | Legitimate interest |
We do not collect your contacts, precise location, browsing history or advertising identifiers. The app and website use no analytics or advertising trackers and no third-party cookies. We do not sell personal data.
Where the data goes
- Our server is hosted by Hetzner Online GmbH in the EU.
- AI providers: OpenAI and Google (Gemini) process AI requests to produce a result. They may keep requests briefly for abuse monitoring under their own terms. Some of this processing can take place outside the EU/EEA; it is covered by the providers' Standard Contractual Clauses.
- Email: sign-in codes are delivered by Resend.
- Payments: Google Play, Apple or Stripe under their own privacy policies.
Each of these acts as our processor (or, for app stores, as an independent controller of your payment data) and only receives what its task needs.
How long we keep it
- On your device: until you delete it or uninstall the app.
- Account and synced library: until you delete your account.
- Sign-in codes: 10 minutes. Sessions: until you sign out or delete the account.
- Waitlist emails: until launch plus 3 months, or until you ask us to remove yours.
- Server logs: up to 30 days.
Deleting your data
In the app, Profile → Delete account & data permanently erases your cards, styles, templates, versions, profile and cached images from the device. If you are signed in, it first deletes your account, synced library, subscription record and sessions from our server. Uninstalling the app removes local data.
To leave the waitlist or to ask us to delete anything else, email hello@idealit.app. To cancel a subscription, use Google Play (or Apple) subscription settings; deleting your account does not cancel it.
Your rights
Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. Email hello@idealit.app; we reply within one month. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local authority.
Children
Idealit is not directed to children under 13 (or the minimum age in your country) and we do not knowingly collect their data.
Changes
We may update this policy; the "Last updated" date shows the latest version. Material changes are announced in the app or in the store listing.
Contact
Questions about privacy: hello@idealit.app.