1. Who we are
This Privacy Policy explains how Prime Root Labs (“Stencra,” “we,” “us,” or “our”) handles information when you use the Stencra mobile application, stencra.app website, and related services (the “Services”). For questions or requests, contact contact@primerootlabs.com.
2. Your artwork and local processing
Stencra processes imported photos, sketches, and other reference images on your device to create and refine tattoo stencils. A guest library is stored locally; the app does not upload guest artwork as part of image conversion.
If you choose Sign in with Apple, your library is backed up through our cloud service. This can include reference images, rendered stencils, source or prompt metadata, names, folders, favorites, refinement history, editing adjustments, ink color, physical print settings, and app preferences. Existing guest artwork is moved into your signed-in library as part of this process.
Photos selected for Preview on Body and the resulting placement mockups are processed locally and are not automatically uploaded to Stencra’s cloud backup. If you export or share any content, the destination you choose handles it under its own terms. Device or operating-system backups may also retain local data according to your device settings.
3. Information we receive
- Account information: if you sign in with Apple, we receive an account identifier and, where Apple provides them based on your choices, a name and email address or private relay address.
- Cloud content: the library information described above, together with timestamps, synchronization records, and account preferences.
- AI generation: your prompt, selected style, request identifiers, generated references, job status, timestamps, and usage counts needed to provide generation and enforce limits.
- Subscriptions: account or anonymous purchase identifiers, product and transaction information, subscription status, expiry, restore status, and related technical data processed through Apple and RevenueCat. We do not receive your full payment-card details.
- Support: your email address, message, and attachments you choose to send us.
- Service operation: request and error information, IP addresses, timestamps, and security or diagnostic logs processed by our service providers when delivering and protecting the Services.
4. Guest stencil counts
The app includes a Share guest stencil counts setting, enabled by default. When enabled, Stencra reports the number of saved and refined guest stencils and the latest stencil date under a random guest-library identifier. A random write credential protects updates; the backend retains its hash.
This report does not include artwork, prompts, names, email addresses, device fingerprints, app versions, or session events. It is not linked to an Apple account. Normal network requests can still generate infrastructure logs as described above.
You can disable sharing in Settings. Disabling it, deleting guest data, or signing in queues removal of the active counts. The app must reconnect to complete removal. A minimal random-identifier and credential-hash record remains to reject delayed reports. These protective records currently have no automatic expiry.
5. How we use information
We use information to provide the features you choose; save, synchronize, and restore your library; generate AI reference images; manage subscriptions and usage limits; understand stencil usage through the limited counts described above; respond to support requests; troubleshoot errors; prevent abuse; and meet legal obligations.
Where applicable data-protection law requires a legal basis, we rely on performing our agreement with you for requested features, legitimate interests in operating and securing the Services, consent where required for optional processing, and compliance with legal obligations. You may contact us to object to processing or withdraw consent where applicable.
We do not sell personal information, use the Apple advertising identifier for advertising, or implement cross-app advertising tracking in Stencra.
6. AI and service providers
AI Describe: your text prompt and selected style are sent through our backend to an AI provider to generate a reference image. Google Gemini is the primary provider and OpenAI may be used as a fallback or configured alternative. Generated references are saved to your account library. Image conversion and refinement do not require sending your imported image to these AI providers.
Do not include confidential client information or sensitive personal data in a prompt. AI providers process submitted data under the agreements and policies applicable to the service used, which can include safety and abuse monitoring. We do not promise that all provider processing has zero retention.
Supabase provides authentication, backend processing, database services, and private artwork storage. Apple provides sign-in and App Store purchase services. RevenueCat helps validate purchases and manage subscription access. Vercel hosts this website.
We share information necessary for these services and may disclose information when legally required, to protect rights or security, or in connection with a business transfer subject to applicable protections. Provider information is available from Supabase, RevenueCat, Apple, Google, OpenAI, and Vercel.
7. Storage, security, and retention
Local artwork stays on your device unless a feature or action described in this policy transmits it. Cloud artwork uses private storage and account-based access controls. We use reasonable technical and organizational measures, but no system can guarantee absolute security or uninterrupted access. Keep your own exports of important work.
We retain active account data while needed to provide the Services, until you delete it, or where retention is required for legal, security, billing, or dispute purposes. Deleting an item synchronizes its deletion and queues removal of retired files. Interrupted uploads can leave unreferenced files until account deletion.
Account deletion removes the account’s cloud library and stored artwork. A hashed deletion receipt can remain so interrupted deletion can be retried; these receipts currently have no automatic expiry. Limited security records, provider backups, billing records, or information required by law may persist under applicable retention requirements. Local exports and copies shared to other services are not removed by deleting your Stencra account.
8. Your choices and rights
- Permissions: choose the images you import and manage Camera and Photos permissions in your device’s Settings.
- Guest counts: turn off Share guest stencil counts in Stencra Settings.
- Deletion: open Account in the app and use its deletion option to remove your signed-in account or local guest data. An internet connection is required to complete cloud deletion and retire guest count reports.
- Apple authorization: after deleting an account, you can also remove Stencra from Sign in with Apple in your Apple Account settings.
- Subscriptions: deleting an account or the app does not cancel Apple billing. Manage subscriptions in your Apple Account.
- Privacy requests: contact contact@primerootlabs.com to request access, correction, deletion, portability, restriction, or to object to processing where these rights apply.
We may need to verify your identity and account ownership before completing a request. You may also have the right to appeal a decision or complain to your local data-protection authority. We do not discriminate against you for exercising applicable privacy rights.
9. Website data and cookies
This marketing website does not use advertising trackers, non-essential analytics cookies, or a marketing mailing-list form. Vercel may process standard request information, including IP address, browser data, timestamps, and security logs, to deliver and protect the site. Following an external link brings you to a service with its own privacy practices.
10. Children and client photos
Stencra is not directed to children under 13 or a higher minimum age required by applicable law. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided information.
Only use photos of another person when you have the necessary permission. You are responsible for deciding whether it is appropriate to import, back up, export, or share client images. The app is a design tool and does not determine a person’s eligibility to receive a tattoo.
11. International processing
Our providers may process information in countries other than your own. Where applicable law requires safeguards for international transfers, we rely on appropriate contractual or other recognized safeguards. Contact us for information about safeguards relevant to your data.
12. Changes and contact
We may update this policy to reflect changes in the app, providers, or legal requirements. We will update the effective date and provide additional notice where required. Privacy questions and requests can be sent to contact@primerootlabs.com.