1. Who we are
This Privacy Policy explains how Prime Root Labs (“Stencra,” “we,” “us,” or “our”) handles information when you use the Stencra mobile application, stencra.app website, and related services (the “Services”). For questions or requests, contact contact@primerootlabs.com.
2. Your artwork and local processing
Generating a stencil sends your selected reference image or description to our AI service, whether you use Stencra as a guest or sign in. Your saved guest library stays on your device. Stencil refinement and editing happen locally.
If you choose Sign in with Apple, your library is backed up through our cloud service. This can include reference images, rendered stencils, source or prompt metadata, names, folders, favorites, refinement history, editing adjustments, ink color, physical print settings, and app preferences. Existing guest artwork is moved into your signed-in library as part of this process.
Photos selected for Preview on Body and the resulting placement mockups are processed locally and are not automatically uploaded to Stencra’s cloud backup. If you export or share any content, the destination you choose handles it under its own terms. Device or operating-system backups may also retain local data according to your device settings.
3. Information we receive
- Account information: if you sign in with Apple, we receive an account identifier and, where Apple provides them based on your choices, a name and email address or private relay address.
- Cloud content: the library information described above, together with timestamps, synchronization records, and account preferences.
- AI generation: your submitted reference or prompt, selected tattoo style and stencil output, request identifiers, generated stencils, job status, timestamps, and usage counts needed to provide generation and enforce limits.
- Subscriptions: account or anonymous purchase identifiers, product and transaction identifiers, trial and subscription status, purchase and renewal dates, price, currency, expiry, restore status, and related technical data processed through the App Store and RevenueCat. Apple processes payments; we do not receive your full payment-card details.
- Support: your email address, message, and attachments you choose to send us.
- Usage data: for guest libraries, saved and refined stencil totals and the date of recent stencil activity under a random identifier. Guest artwork, names, and prompts are not included in these reports.
- Advertising measurement: app installs and launches, account or guest identifiers, AppsFlyer installation identifiers, Apple’s vendor identifier (IDFV), IP address and approximate location derived from it, device model, operating system, app version, language, tracking-permission status, and technical performance data. Apple’s advertising identifier (IDFA) is included only when you permit tracking.
- Service operation: request and error information, IP addresses, timestamps, and security or diagnostic logs processed by our service providers when delivering and protecting the Services.
4. How we use information
We use information to provide the features you choose; save, synchronize, and restore your library; generate AI stencils; manage subscriptions and usage limits; understand feature use through limited usage data; measure which Facebook and Instagram ads lead to installs, trials, subscriptions, and revenue and improve our campaigns; respond to support requests; troubleshoot errors; prevent abuse; and meet legal obligations.
Where applicable data-protection law requires a legal basis, we rely on performing our agreement with you for requested features, legitimate interests in operating and securing the Services, consent where required for optional processing, and compliance with legal obligations. You may contact us to object to processing or withdraw consent where applicable.
With your iOS tracking permission, advertising identifiers and events may be matched with information from other companies’ apps and services to measure our ads. Without that permission, IDFA is not collected. Subscription processing, operational analytics, and supported measurement through Apple’s SKAdNetwork and Meta’s aggregated measurement can still operate; relevant events and technical data may still be sent without IDFA.
5. AI, subscriptions, and advertising partners
AI generation: your selected reference image or text description, tattoo style, and stencil output are sent through our backend to an AI provider to generate a stencil. Sign-in is optional. Guest results are saved in your local library; signed-in results can be backed up to your account. Refinement and body previews remain local.
Do not include confidential client information or sensitive personal data in a reference image or prompt. AI providers may process submitted data for safety and abuse monitoring under their own policies; we do not promise zero retention by every provider.
Subscriptions and advertising measurement: RevenueCat processes App Store purchase and entitlement information and sends subscription lifecycle events, such as trial starts, purchases, renewals, cancellations, and expirations, to AppsFlyer with transaction amounts and identifiers associated with your account or installation. AppsFlyer measures installs and app activity and shares relevant install, app-open, trial, subscription, and purchase events with Meta to measure and improve our Facebook and Instagram ads. This can include account, installation, and device identifiers, IP address, device information, tracking-permission status, product identifiers, price, and currency. Measurement can include users who installed Stencra without clicking an ad. IDFA is shared only with your tracking permission.
Your reference images, generated stencils, body-preview photos, prompt text, library content, and support messages are not sent through these advertising-measurement integrations. We do not send your email or phone number to Meta for ad matching. Learn more in the AppsFlyer Services Privacy Policy, RevenueCat Privacy Policy, and Meta Privacy Policy.
We use service providers for authentication, cloud processing and private storage, subscription management, AI generation, advertising measurement, and website hosting. These providers handle information under their applicable agreements and privacy commitments. We share information needed for the purposes described in this policy and may disclose information when legally required, to protect rights or security, or in connection with a business transfer subject to applicable protections.
6. Storage, security, and retention
Local artwork stays on your device unless a feature or action described in this policy transmits it. Cloud artwork uses private storage and account-based access controls. We use reasonable technical and organizational measures, but no system can guarantee absolute security or uninterrupted access. Keep your own exports of important work.
Guest generation uses a private installation identifier for request recovery, purchase verification, and usage limits. A generated image is temporarily cached for delivery and retries. The app requests removal after receiving it; retry access expires after one hour, and expired cached images are cleared during subsequent service activity. We retain limited job and security records to enforce usage limits. Deleting guest data clears the local library and requests removal of its temporary generation results when online; it does not reset purchase history or generation limits.
We retain active account data while needed to provide the Services, until you delete it, or where retention is required for legal, security, billing, or dispute purposes. Deleting an item synchronizes its deletion and queues removal of retired files. Interrupted uploads can leave unreferenced files until account deletion.
Account deletion removes the account’s cloud library and stored artwork. A hashed deletion receipt can remain so interrupted deletion can be retried; these receipts currently have no automatic expiry. Limited security records, provider backups, billing records, or information required by law may persist under applicable retention requirements. Local exports and copies shared to other services are not removed by deleting your Stencra account.
Subscription and advertising-measurement records are stored separately from your artwork and may remain after library or account deletion for billing, measurement, fraud prevention, or legal purposes, subject to applicable retention requirements and provider agreements. Contact us to request deletion of personal information associated with these records where applicable.
7. Your choices and rights
- Advertising tracking: choose whether to allow tracking when iOS asks, or change your choice in Settings → Privacy & Security → Tracking → Stencra. Declining does not prevent stencil generation, editing, purchases, restores, or Pro access. It does not disable the subscription processing, operational analytics, and measurement without IDFA described above.
- Permissions: choose the images you import and manage Camera and Photos permissions in your device’s Settings.
- Deletion: open Account in the app and use its deletion option to remove your signed-in account or local guest data. An internet connection is required to complete cloud deletion.
- Apple authorization: after deleting an account, you can also remove Stencra from Sign in with Apple in your Apple Account settings.
- Subscriptions: deleting an account or the app does not cancel Apple billing. Manage subscriptions in your Apple Account.
- Privacy requests: contact contact@primerootlabs.com to request access, correction, deletion, portability, restriction, or to object to processing where these rights apply, including any applicable right to opt out of sharing for advertising purposes.
We may need to verify your identity and account ownership before completing a request. You may also have the right to appeal a decision or complain to your local data-protection authority. We do not discriminate against you for exercising applicable privacy rights.
8. Website data and cookies
This marketing website does not use advertising trackers, non-essential analytics cookies, or a marketing mailing-list form. Our website host may process standard request information, including IP address, browser data, timestamps, and security logs, to deliver and protect the site. Following an external link brings you to a service with its own privacy practices.
9. Children and client photos
Stencra is not directed to children under 13 or a higher minimum age required by applicable law. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided information.
Only use photos of another person when you have the necessary permission. You are responsible for deciding whether it is appropriate to import, back up, export, or share client images. The app is a design tool and does not determine a person’s eligibility to receive a tattoo.
10. International processing
Our providers may process information in countries other than your own. Where applicable law requires safeguards for international transfers, we rely on appropriate contractual or other recognized safeguards. Contact us for information about safeguards relevant to your data.
11. Changes and contact
We may update this policy to reflect changes in the app, providers, or legal requirements. We will update the effective date and provide additional notice where required. Privacy questions and requests can be sent to contact@primerootlabs.com.