Boneloom Privacy Policy
Who we are
Boneloom is a drawing and 2D animation app made by an independent developer in Panama. In this policy, "we" and "us" mean the developer of Boneloom. You can reach us at boneloomstudio@gmail.com.
Your drawings and projects stay on your device
Everything you make in Boneloom, including drawings, layers, frames, skeletons, animations, colours and settings, is stored only on your phone, inside the app's private storage. We never receive your drawings or projects, and they are never uploaded to us. The only thing that can leave your phone about a skeleton is described under Anonymous rig diagnostics, and only if you agree to it.
- Importing a picture: Boneloom uses Android's photo picker. The app only sees the one image you choose, and that image stays on your device.
- Exporting: when you save a PNG, GIF, video or project file, you choose where it goes. Where you send it after that is up to you.
- Moving the light by tilting your phone: the app reads your phone's motion sensor while you use this feature. The readings are used on the spot and never stored or sent anywhere.
- Your phone's own backup: if your phone backs up apps to your Google account, Android may include Boneloom's files in that backup. That backup belongs to your Google account, and we cannot see it.
What the app collects automatically
Boneloom uses two Google services, Firebase Crashlytics and Firebase Analytics. They collect the following automatically while you use the app:
| What | Examples | Why |
|---|---|---|
| Crash logs | What the app was doing when it crashed, and the error. | To find and fix crashes. |
| Diagnostics | Phone model, Android version, app version, memory and performance information, language and country setting. | To understand crashes and problems on different phones. |
| App interactions | Which screens are opened, how long a session lasts, and basic events such as the app being opened or updated. | To learn which parts of the app are used, so we can improve them. |
| Device identifiers | A random ID that Firebase creates for this installation of the app. | To tell one installation's reports apart from another's. |
This information does not include your name, email address, contacts, precise location, photos, or anything you draw. It is not used to identify you personally. (That is about Firebase. Rig diagnostics, below, are separate and only happen if you agree.)
Anonymous rig diagnostics (only if you agree)
The first time you open Boneloom, it asks whether you agree to send anonymous information about how skeletons are built. If you choose Decline, nothing described here is ever collected, stored or sent. You can change your answer at any time in Settings; turning it off also deletes anything that was still waiting on your phone to be sent.
If you choose Accept, then when you leave the skeleton screen, the app checks how that skeleton moves: whether a bone pulls on parts it should not, whether the mesh tears, whether the head was found. It sends a report when something looks wrong, and about one in five of the skeletons that look fine, so we also know what good looks like. The same unchanged skeleton is never sent twice, and a phone sends at most 20 reports a day. A report contains:
| What | Details |
|---|---|
| Numbers about the skeleton | How many bones and mesh points, and measurements of how the drawing moves when each bone turns. |
| The skeleton itself | Where the bones are, the mesh points, and which bones hold them. |
| A coarse outline | A black-and-white silhouette of the drawing, at most 160 squares across, with no colour and no detail. |
| What was done on the skeleton screen | Counts only: for example how many bones were added or deleted, undos after automatic bones, brush strokes, exports, and how long the screen was open. |
| Sizes and versions | The canvas size, the app's version and Android's version. |
It never sends your drawing, its colours or pixels, anything you typed (names of drawings, skeletons or bones), your account, a device or advertising ID, or your location.
Reports are not linked to you, so they cannot be traced back to you. This also means we cannot find and delete one person's reports on request; saying no, or turning it off in Settings, stops anything further being sent. To stop anyone flooding the service, the server briefly keeps a scrambled (hashed) form of the network address a report came from, apart from the reports, and deletes it after about a day.
It is used only to find and fix skeletons that move badly. It is stored by Supabase, a database service acting on our behalf, and is never sold or shared.
Subscriptions and purchases
Boneloom is free to download. Premium is an optional subscription (monthly, or yearly with a free trial) bought through Google Play.
- Payment: Google Play takes the payment. Your card or other payment details go to Google, never to us.
- RevenueCat: we use RevenueCat, a subscription service, to check purchases with Google Play and to tell the app whether premium is active. RevenueCat receives the purchase details (which plan, when it was bought or renewed, the price and currency, the store country, and Google's purchase token), an anonymous ID it creates for this installation of the app, and basic device and app information (Android version, app version). It does not receive your name, your email address or anything you draw.
- Why: to unlock premium, to restore it on a new phone, and to know how many people subscribe. It is not used for advertising.
- Cancelling: you can cancel at any time in Google Play, under Payments and subscriptions. If premium ends, nothing you made is deleted.
If you write to us
The app's feedback button opens your own email app with a message to us. If you send it, we receive your email address, what you write, and the details the app adds under the line: the app version, your Android version and your phone model. We use it only to answer you and to improve Boneloom, and you can delete those lines before sending.
What we do not do
- No accounts. There is no sign-up or sign-in.
- No ads. Boneloom shows no advertising.
- No advertising ID. The app does not collect or use your device's advertising ID, and ad personalisation is turned off.
- No selling or sharing. We do not sell your information or share it with third parties. Google (Crashlytics, Analytics and Google Play billing), RevenueCat (subscriptions) and Supabase (rig diagnostics, only if you agree) work for us as service providers and handle this information on our behalf.
Security
Everything sent to Firebase, RevenueCat and Supabase is encrypted in transit (HTTPS), and Supabase also stores it encrypted. Your drawings and projects are kept in the app's private storage, which other apps on your phone cannot read.
How long it is kept
Crash reports are kept by Firebase Crashlytics for 90 days. Analytics information is kept according to Firebase Analytics' retention setting and is then deleted automatically. Purchase records are kept by RevenueCat and Google for as long as a subscription needs them and as long as tax and accounting rules require. Rig diagnostics are kept for 12 months and then deleted automatically, and all of them are deleted when the feature is retired; the scrambled network addresses used against flooding are deleted after about a day. Your drawings stay on your phone until you delete them or uninstall the app.
Your choices
- Uninstalling Boneloom stops all collection and removes the app's data from your phone, including your drawings. Export anything you want to keep first.
- Rig diagnostics: turn Help fix skeletons on or off in the app's Settings at any time. Off, nothing more is sent, and anything still waiting on your phone is deleted.
- Clearing the app's storage in Android's settings resets the app's random ID, which also removes your drawings.
- Questions or requests about your information: email us at the address above and we'll help. Because there are no accounts, we don't know who you are unless you tell us.
Children
Boneloom is not directed at children under 13, and we do not knowingly collect personal information from children. The app collects the same technical information from everyone, as described above. If you believe a child has contacted us with personal information, email us and we will delete it.
Changes to this policy
If Boneloom starts collecting anything new, we will update this page and change the effective date above before that version of the app is released.
Contact
Email: boneloomstudio@gmail.com