Privacy Policy

Scope and data controller

This Privacy Policy applies to the xCanvas Android application (the “App”), its online font, image, and template catalogues, its AI image-generation feature, and this privacy-policy webpage (together, the “Services”). It does not control the privacy practices of other apps or websites that a user opens from xCanvas or chooses as a sharing, printing, payment, or email destination.

xType (“xType,” “we,” “us,” or “our”) is the controller responsible for the processing described in this policy, except where a named third party acts as an independent controller for its own service—for example, Google for Google Play, Google advertising services, or Google Play Services for AR, and OpenAI for its own processing.

Privacy at a glance

Information xCanvas handles

“Personal data” or “personal information” means information that identifies, relates to, describes, or can reasonably be linked to a person or device. The categories below describe the current App's actual data flows.

Information xCanvas does not request for its own features

The App does not include an xCanvas account system and does not request microphone, contacts, call-log, SMS, or precise-location permission. The App also does not include a separate first-party analytics or crash-reporting SDK. Google Mobile Ads may nevertheless infer an approximate area from an IP address and process ad-related identifiers and diagnostics as described above.

Device permissions and local processing

On-device subject segmentation

xCanvas uses Google ML Kit subject segmentation for effects such as isolating a subject from an image. The selected image is processed on the device. Google Play services may download the segmentation model before first use, but xCanvas does not upload the image to its own server for this feature. See Google's ML Kit subject segmentation information.

Google Play Services for AR

xCanvas uses local AR preview functionality and does not use ARCore Cloud Anchors or the ARCore Geospatial API. Camera access is requested at the point the user chooses the AR feature.

Why information is used and the legal bases

Depending on the feature and applicable law, xType processes information to:

• provide editing, saving, importing, exporting, sharing, printing, backup/restore, widget, AR, AI generation, content-download, and purchase features;
• remember local preferences and restore the user's workspace;
• display, measure, and secure advertising and respect available ad-privacy choices;
• verify and restore purchase entitlements;
• respond to support messages and privacy requests;
• operate, troubleshoot, secure, and prevent abuse of the Services;
• comply with law, enforce rights, and protect users, xType, providers, and the public; and
• manage a merger, financing, reorganization, sale, or transfer of all or part of the Services, subject to applicable law and notice requirements.

EEA, United Kingdom, and Switzerland

Where those laws apply, the legal bases are:

• Performance of a contract or steps requested by the user: providing the App, requested AI output, asset downloads, subscriptions, exports, and support.
• Consent: personalized advertising or storage/access on a device where consent is required, and optional device permissions. Consent may be withdrawn for future processing without affecting earlier lawful processing.
• Legitimate interests: operating and securing the Services, preventing fraud and abuse, maintaining limited technical logs, providing contextual or limited ads where permitted, troubleshooting, and responding to ordinary support—balanced against user rights.
• Legal obligation: tax, accounting, regulatory, court, law-enforcement, and valid legal-process requirements.
• Protection of vital interests: only in an exceptional situation involving safety.

Third parties such as Google and OpenAI may determine their own legal bases for processing they perform as independent controllers. Their notices provide further information.

When data is shared and third-party providers

xType does not sell a user's name, email address, projects, images, or AI prompts for money. The App does disclose data to providers when needed for the functions described below. Personalized advertising may be treated as “sharing” or a “sale” for targeted or cross-context behavioural advertising under some U.S. state laws, even when no money is exchanged. Available opt-out controls are described in Section 8.

User-directed disclosure

When a user shares, prints, emails, exports, opens, or saves content through another app or service, xCanvas sends the selected content to that destination at the user's direction. The destination's own privacy policy then applies. Users should review content before sharing because projects and images may contain personal or sensitive information.

Legal and organizational disclosures

Information may be disclosed when reasonably necessary to comply with law or valid legal process; investigate fraud, abuse, security, or technical issues; enforce terms or protect legal rights and safety; or complete a corporate transaction. If ownership of the Services changes, this policy or a replacement notice will govern the transferred data as required by law.

Retention, security, and international transfers

How long information is kept

• Local projects, files, prompts, generated images, and settings: kept on the device until the user deletes the item, clears App storage, or uninstalls xCanvas. Files exported to the gallery or another location must be deleted separately.
• Android backups: controlled and retained by Android/Google under the user's backup settings and Google's policies. A restored or retained backup may outlast an App installation.
• Local purchase entitlement: kept while needed to reflect access and refreshed against Google Play. Google independently retains transaction records under its policies and legal obligations.
• AI, asset-server, security, and webpage logs: retained only for the period reasonably necessary to deliver requests, secure and troubleshoot the service, prevent abuse, meet provider requirements, and comply with law. OpenAI, Cloudflare, and Hostinger apply their own retention rules to data they process.
• Support and privacy correspondence: retained while needed to answer the request, maintain appropriate support and compliance records, resolve disputes, and meet legal requirements, then deleted or anonymized when no longer needed.

Retention can vary when a longer period is required by tax, accounting, consumer, regulatory, litigation-hold, fraud-prevention, or other law. When deletion is not immediately possible—for example, in protected backups—data is isolated from ordinary use until deletion or expiry where reasonably practicable.

Security

xCanvas uses Android app-private storage for local data, scoped system pickers for user files, and HTTPS for its own remote asset and AI connections. Google Mobile Ads states that its automatically collected data is encrypted in transit. Access to support email and hosted services is restricted to people and providers who need it for the purposes in this policy. No method of storage or transmission is completely secure, so absolute security cannot be guaranteed.

International data transfers

xType is based in Greece. Google, OpenAI, Cloudflare, Hostinger, Proton, and their subprocessors may process data in the European Economic Area, the United States, or other countries. Those countries may have different data-protection laws. Where required, transfers are made using an applicable adequacy decision, contractual safeguards such as standard contractual clauses, or another lawful transfer mechanism described by the relevant provider.

Your choices and controls

• Delete local content: delete projects, imported fonts/images, AI images, or other supported items inside xCanvas. Clear xCanvas storage in Android Settings or uninstall the App to remove its private local data. Separately delete gallery exports, shared copies, printed copies, or files saved elsewhere.
• Manage advertising choices: open xCanvas → Options → Privacy options when that entry is displayed. Users can also use Google My Ad Center and Android's ad-privacy or advertising-ID controls. Choices may affect ad personalization but not necessarily the number of ads.
• Manage permissions: revoke camera or notification permission in Android Settings. The related optional feature may stop working.
• Manage AI prompts: avoid entering personal, confidential, or sensitive information. Deleting an AI image in the App also deletes its locally saved prompt. Provider-side logs may remain for the limited purposes and periods described in provider policies.
• Manage subscriptions: use the Google Play subscription centre to view, cancel, or manage subscriptions. Uninstalling xCanvas does not cancel a subscription.
• Manage Android backup: use the device's Google backup settings to control cloud backup and device restore. Availability and menu names vary by Android device.
• Choose what to send to support: review and edit the pre-filled diagnostic details and message before sending email.
• Make a privacy request: email FontsApp@protonmail.com with “xCanvas Privacy Request” in the subject.

This policy webpage

This static webpage does not use advertising, analytics scripts, third-party fonts, or tracking cookies. The web host may still create standard access and security logs. Because the page does not initiate targeted advertising or a sale/share of personal information, browser Do Not Track or Global Privacy Control signals do not change its behaviour.

Regional privacy rights

EEA, United Kingdom, and Switzerland

Subject to applicable law and exceptions, users may have rights to be informed; access personal data; correct inaccurate data; delete data; restrict processing; receive portable data; object to processing based on legitimate interests or direct marketing; withdraw consent; and lodge a complaint with a competent data-protection authority. xType does not use App data to make decisions that produce legal or similarly significant effects solely by automated means.

A request can be sent to the contact in Section 12. Users may also contact the data protection authority in the country where they live, work, or believe an infringement occurred. General information is available from the European Commission.

California and other U.S. states

Where a state privacy law applies to xType and the requester, users may have the right to know or access categories and specific pieces of personal information, receive a portable copy, delete or correct information, opt out of sale/sharing or targeted advertising, limit certain uses of sensitive information, and receive equal service without unlawful discrimination. Some rights do not apply to information handled solely on the user's device or to data a provider processes as a separate business/controller.

California notice at collection

In the preceding 12 months, the Services may have collected the following California categories: identifiers (IP address and advertising/device identifiers); internet or other electronic activity (App/ad interactions and server requests); geolocation (approximate area inferred from IP, not precise GPS location); commercial information (purchase or subscription status through Google Play); device/application diagnostics; and content a user provides (AI prompts and support messages). Sources are the user, the user's device, Google services, and service providers. Purposes and recipient categories are described in Sections 5 and 6.

xType does not sell personal information for money. Google advertising can be treated as “sharing” for cross-context behavioural advertising under California law. Where applicable, use the in-App Privacy options and the Google/Android controls in Section 8 to opt out. xType does not knowingly sell or share the personal information of consumers under 16. More information about California rights is available at privacy.ca.gov.

Submitting and appealing a request

Send requests to FontsApp@protonmail.com. Describe the right being exercised, the relevant xCanvas feature, and the jurisdiction. xType will respond within the period required by applicable law. If a request is denied, the response will explain the reason and, where required, how to appeal. An authorized agent may submit a request where permitted, subject to proof of authority and identity verification. Requests may be limited or refused where an exception applies or the request cannot reasonably be verified.

Children's privacy

xCanvas is a general-audience creative tool and is not designed to knowingly collect personal information from children. A child who is below the minimum age for independently consenting to online data processing in their country should use the App only with a parent or guardian's permission and supervision. Children should not put their own or another person's private information into AI prompts, project text, or support email.

If xType learns that a child provided personal information through the AI or support features without valid authorization, xType will take reasonable steps to delete it where it can be identified. A parent or guardian can contact FontsApp@protonmail.com. Google and other providers apply their own child and age-related rules to data they process.

Changes to this policy

xType may update this policy when xCanvas features, providers, data practices, or legal requirements change. The “Last updated” date at the top identifies the current version. Material changes will be communicated through the App, this page, the Google Play listing, or another appropriate method when required. Continued use after an update is subject to the revised policy, but an update does not retroactively replace consent where new consent is legally required.

Contact xType

For questions, complaints, privacy requests, or concerns about this policy, contact xType using the details below. Please write “xCanvas Privacy” in the subject so the request can be routed correctly.

Google Play listing: xCanvas on Google Play