Privacy Policy
Last updated: 18 August 2026
The short version. PintaMinis stores the paints you own, the lists and recipes you write, and the photos you upload. It does not run advertising, does not use analytics, and does not sell or share your data with anyone for their own purposes. Deleting your account erases all of it.
1. Who is responsible
PintaMinis is an independent, non-commercial hobby project run by a private individual. The data controller for the purposes of the EU General Data Protection Regulation (GDPR) is the operator of pintaminis.com.
For any privacy question or request, contact: [email protected].
2. What is collected
Account data
| Data | Where it comes from |
|---|---|
| Email address | You, when you register; or your Google account |
| Password | You. It is handled by Firebase Authentication and is never visible to us |
| Display name and profile picture | Your Google account, only if you sign in with Google |
Data you create in the app
- Which catalogue paints you own, and which are running low or on your shopping list.
- Custom paint lists you create, and their names.
- Recipes: names, descriptions, steps, techniques, notes and links you add.
- Cover photos you upload for a recipe.
Technical data
- Anti-abuse checks. The app uses Firebase App Check with reCAPTCHA Enterprise to verify that requests come from the genuine app rather than from a script. Google processes device and browsing signals, including your IP address, to produce that verdict.
- Server logs. Google and Cloudflare log connection data, including IP address and browser user agent, as part of delivering and protecting the service.
PintaMinis does not use analytics, tracking pixels, advertising identifiers, or profiling of any kind. See the Cookie Policy for exactly what is stored in your browser.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account and signing you in | Performance of a contract (Art. 6(1)(b)) |
| Storing and syncing your inventory, lists, recipes and photos | Performance of a contract (Art. 6(1)(b)) |
| Publishing a recipe you chose to share, and showing its author name | Consent, given by the act of publishing (Art. 6(1)(a)) — withdrawn at any time by unsharing |
| Protecting the service from abuse and automated scraping | Legitimate interest in keeping the service available and its costs sustainable (Art. 6(1)(f)) |
4. What other people can see
Everything you create is private to your account by default.
A recipe becomes visible to other signed-in users only when you explicitly publish it. When you do, the recipe's content, its cover photo and an author name are readable by anyone holding the share link.
Worth knowing before you publish. The author name is your
Google display name if you have one. If you registered with email and
password, there is no display name, so the part of your email address before
the @ is used instead. If your email address is your real name,
that name becomes visible on the published recipe. Set a display name first
if you would rather it did not.
Unpublishing a recipe removes the public copy. Anyone who had already saved or copied its content before then is outside our control.
5. Who processes it
PintaMinis does not sell, rent or share your personal data. It is processed on our behalf by the following providers, under their own data processing terms:
| Provider | Role |
|---|---|
| Google Ireland Ltd. / Google LLC (Firebase) | Authentication, database (Cloud Firestore), photo storage (Cloud Storage), hosting, and anti-abuse verification (App Check with reCAPTCHA Enterprise) |
| Cloudflare, Inc. | DNS, content delivery, TLS termination and protection against abuse |
| GitHub, Inc. | Hosting of this informational website only. It holds none of your account data |
The app also loads fonts from Google's fonts.gstatic.com, which
means your IP address reaches Google when the interface first renders.
The app contains an integration for Google AdMob that is disabled and not compiled into the published build. No advertising data is collected. Should that ever change, this policy will be updated before it does.
6. International transfers
Your data is stored on Google infrastructure in the United
States (Cloud Firestore in the nam5 multi-region, Cloud
Storage in us-east1). Cloudflare operates a global network and may
process connection data outside the EEA.
These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
7. How long it is kept
Your data is kept for as long as your account exists. There is no inactivity purge; nothing is deleted behind your back.
Deleting your account from Settings → Delete account erases, in this order: your inventory, your paint lists, every recipe you published (which also removes it for anyone who linked it), your recipes, your links to other painters' recipes, your uploaded photos, and finally your account itself. This is immediate and cannot be undone.
Provider-level backups and server logs may persist for a short period afterwards under those providers' own retention schedules.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your personal data, and to withdraw consent at any time.
Most of these you can exercise directly in the app, without asking anyone: edit or delete any recipe, list or photo at any time; unpublish a shared recipe to withdraw that consent; delete your entire account from Settings.
For anything else — including a copy of your data in a portable format — write to [email protected]. You also have the right to lodge a complaint with your local supervisory authority; in Spain this is the Agencia Española de Protección de Datos.
9. Security
- All traffic is served over HTTPS, with TLS 1.2 as the minimum version.
- Database and storage access rules are enforced server-side: your documents are readable and writable only by your own authenticated account.
- Firebase App Check is enforced on the database and photo storage, so requests that do not come from the genuine app are rejected.
- Passwords are handled entirely by Firebase Authentication. They are never stored, seen or transmitted by the app itself.
No system is perfectly secure, and this one is run by one person as a hobby. Please do not store anything in it that would be harmful if disclosed.
10. Children
PintaMinis is not directed at children under 14, and accounts are not knowingly created for them. If you believe a child has registered, write to the address above and the account will be removed.
11. Changes
This policy may change as the app does. The date at the top always reflects the current version, and material changes will be announced in the app before they take effect.