Scroll Art is an iPhone and iPad app and a website (scrollart.app) operated by Eli Riedel, based in the United States (full address under "Contact" below) ("we", "us"). We are the "controller" (the business responsible) for the personal data described here. This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It is written to be read; if anything is unclear, email hello@scrollart.app.
The short version. We collect what we need to run your account, your membership and your feed, plus usage analytics you can turn off. We advertise Scroll Art on Facebook, Instagram and Reddit, so we share some app and website activity with Meta and Reddit to measure those ads. We only use your device's advertising identifier, or the Meta and Reddit pixels on our website, if you allow it, and you can switch the rest off in the app. We don't sell your data and we don't show ads in Scroll Art. Payment card details go to Apple or Stripe, never to us. You can delete your account in the app at any time.
Your precise location, contacts, photos, microphone or camera, health data, or browsing history. We only read your device's advertising identifier (IDFA) if you allow tracking when iOS asks. We don't show ads in Scroll Art, and we do not sell personal data for money.
Where the EU or UK GDPR applies, we rely on the following legal bases.
| Purpose | Legal basis |
|---|---|
| Creating and running your account, the feed, comments, follows, collections, and your art personality | Performance of our contract with you (the Terms) |
| Selling and managing your membership and free trial, handling refunds | Contract; legal obligations (tax and accounting records) |
| Emails you need: sign-in codes and password resets; purchase confirmations and renewal information for web memberships | Contract; legal obligations (automatic-renewal laws) |
| A few getting-started emails after you create an account without a membership (at most three, in your first week) | Legitimate interests (helping you try the app you signed up for); unsubscribe with the link in any of them |
| Push notifications (replies, likes on your comments, new followers) and the daily painting reminder | Your consent, given in iOS; withdraw it any time in Settings |
| Keeping the community safe: filtering, reviewing reports, removing content, suspending accounts | Legitimate interests (a safe service) and contract |
| Product analytics | Legitimate interests (understanding and improving Scroll Art); you can object with the "Share usage data" switch |
| Crash and error reports | Legitimate interests (keeping the app working) |
| Measuring and improving our ads with Meta and Reddit using your advertising identifier and hashed email (app) or their pixels (website) | Your consent: "Allow" in the iOS tracking prompt, or "Accept" on the website banner. Withdraw it any time (see "Your choices") |
| Measuring our ads with Meta without your advertising identifier (install, app opens and the in-app events listed above, and trial and membership events) | Legitimate interests (knowing which of our ads work, so we can keep Scroll Art affordable); you can object with the "Share usage data" switch or by emailing us |
| Responding to legal requests and protecting rights and safety | Legal obligations; legitimate interests |
We don't make decisions about you that have legal or similarly significant effects based solely on automated processing. The feed ranking and art personality are automated personalization of what paintings you see, nothing more.
We use these service providers ("processors") to run Scroll Art. Each receives only what it needs for its job, under a contract that limits its use of the data to providing its service to us.
| Provider | What for | What they receive | Where |
|---|---|---|---|
| Supabase | Database, sign-in, sending push notifications | Account, activity, content, quiz result, analytics events, device tokens, Sign in with Apple token | United States |
| Cloudflare | Hosting this website; storing and serving painting images and story audio | IP address, requested files | Global network |
| Apple | App Store purchases, push notifications (APNs), Sign in with Apple | Purchase and trial status, device token; your Apple account data stays with Apple | United States / global |
| Sign in with Google (if you choose it); the fonts on this website | Your Google account email and name; your IP address when a web page loads its fonts | United States / global | |
| RevenueCat | Membership and trial management for both App Store and web purchases; runs our web checkout page; tells Meta about trials and paid memberships for ad measurement | Account ID, purchase history, device and app information, device identifiers (the IDFA only if you allow tracking) and Meta's anonymous app ID, email (web purchases) | United States |
| Stripe | Card and Apple Pay payments in our US web checkout | Email, payment details, billing country and postal code (held by Stripe, not us) | United States |
| Resend | Sending sign-in, password-reset and getting-started emails | Email address and the message | United States |
| PostHog | Product analytics | Install or account ID, in-app events, app version, device type, IP address (as part of the connection) | United States |
| Sentry | Crash, error and performance reporting | Account ID, error details, device model, OS and app version, IP address | United States |
| Meta Platforms (Facebook, Instagram) | Measuring and improving our ads on Facebook and Instagram (advertising measurement partner) | App: install and app opens, account created, quiz completed, checkout started, painting opened from a shared link; trial started and membership paid or renewed (sent by RevenueCat, with price); Meta's anonymous app ID, the IDFA if you allow tracking, device and app information, IP address; for web purchases, hashed email and hashed account ID; trial still active after an hour (with hashed email only if you allow tracking). Website, only if you accept: pages viewed, App Store button clicks, Meta cookies, IP address and browser information | United States / global |
| Reddit, Inc. | Measuring and improving our ads on Reddit (advertising measurement partner) | App, only if you allow tracking: trial started, trial still active after an hour, membership paid or renewed (with price), hashed email, hashed advertising identifier, IP address. Website, only if you accept: pages viewed, App Store button clicks, Reddit cookies, IP address and browser information | United States |
About Meta. Meta receives this under its Business Tools Terms and handles it under its own privacy policy. It may match it with what it knows from its own services to tell us, in aggregate, which ads led to installs and memberships, and to show our ads to people likely to enjoy Scroll Art. We never give Meta your name, the paintings you look at, your comments, or your quiz answers. The only email Meta gets from the app is hashed, and only if you allow tracking (or buy on our web checkout).
Other members see what you post publicly in Scroll Art: your username, display name, bio, comments, likes shown on your profile, and who you follow.
We may also disclose information if the law requires it, or to protect the rights, property, and safety of Scroll Art, its members, or others. If Scroll Art is ever sold or transferred, your data would move with it, still protected by this policy, and we would tell you first.
AI services. The painting facts and story videos are written and voiced with AI services (AI language models and ElevenLabs' synthetic voice). Those services receive painting information and published source text only, never your personal data.
We are based in the United States and our providers store data mainly in the United States. If you use Scroll Art from the EU, the UK, or elsewhere, your data is transferred to the United States. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or on the EU-US Data Privacy Framework and UK Extension where the provider is certified, as offered in each provider's data processing terms.
| Data | How long |
|---|---|
| Account, profile, quiz result, likes, saves, collections, follows, view history, comments | Until you delete them or your account. Account deletion removes them from our live database immediately; backup copies are overwritten within 30 days. A deleted comment's text is removed; other people's replies to it may remain under a "[deleted]" marker. |
| Sign in with Apple token | Deleted with your account, after we ask Apple to revoke it |
| Product analytics events | 12 months, then deleted automatically. When you delete your account, events in our own database are unlinked from it. |
| Crash and error reports | Up to 90 days |
| Data shared with Meta for ad measurement | Kept by Meta under its own terms and privacy policy; we can't delete it for you, but you can ask Meta through its privacy settings and tools |
| Reports and moderation records | As long as needed to enforce the Terms and keep the community safe |
| Purchase and billing records | Kept by Apple, Stripe, RevenueCat and us for as long as tax and accounting law requires (usually up to 7 years) |
| Emails you send us | Up to 3 years after the conversation ends |
Depending on where you live, you may have the right to: access your data and get a copy in a portable format; correct it; delete it; restrict or object to how we use it (including analytics based on legitimate interests); withdraw consent you've given; and not be treated differently for using these rights.
To use any right, email hello@scrollart.app from the email on your account (or tell us your username). We may need to confirm it's you. We answer within one month (45 days for US state-law requests), and tell you if we need more time as the law allows. An authorized agent can act for you with your signed permission.
In the last 12 months we collected these categories of personal information, for the purposes described above, and disclosed them only to the service providers listed above: identifiers (email, username, account and install IDs, IP address, device tokens); customer records (name, email); commercial information (membership and purchase history); internet or other electronic network activity (in-app activity and analytics events); approximate location that providers may derive from IP address; inferences (your art personality and feed preferences); and sensitive personal information limited to account login credentials. We have not sold personal information. Starting September 28, 2026 we share these categories with Meta Platforms for cross-context behavioral advertising: identifiers (advertising identifier if you allow tracking, Meta's anonymous app ID, hashed email and account ID for web purchases, IP address), commercial information (trial and membership events), and internet or other electronic network activity (app events listed above and, with your consent, website pages viewed). Starting October 3, 2026 we also share with Reddit, Inc., only for people who allow tracking: identifiers (hashed email, hashed advertising identifier, IP address) and commercial information (trial and membership events), and, with your consent, website pages viewed. We don't knowingly sell or share the personal information of anyone under 16.
You can opt out of our sharing with Meta for advertising at any time, wherever you live:
Scroll Art is not for children under 13, and we do not knowingly collect personal data from them. If you are under the age at which you can consent to data processing in your country, you need a parent or guardian's permission to use Scroll Art. If you believe a child under 13 has created an account, email us and we will delete it.
scrollart.app sets no cookies of its own and runs no analytics scripts. It is hosted by Cloudflare, which processes your IP address to deliver pages and protect the site, and it loads fonts from Google Fonts, which receives your IP address.
Meta and Reddit pixels, only with your consent. A banner asks every visitor whether we may use Meta's and Reddit's pixels to measure our ads. Until you tap Accept, nothing from Meta or Reddit loads and none of their cookies are set. If you accept, the pixels load from Meta and Reddit, set their cookies (such as Meta's _fbp, up to 90 days, and Reddit's _rdt_uuid, up to 90 days), and tell them which of our pages you viewed (including a shared painting or personality) and when you tap an App Store button. We remember your choice in your browser's local storage (key sa-consent), not in a cookie. You can change it with "Cookie settings" at the bottom of any page; a Global Privacy Control signal counts as Decline. For visitors in the EU, EEA and UK our legal basis for the pixels is your consent.
The web checkout opened from the app is run by RevenueCat and Stripe on their own domains, under their own cookie and privacy terms.
Data travels over encrypted connections, access to user data in our database is restricted by row-level security, and only the minimum people and systems can reach it. No system is perfectly secure, but if a breach affects your data we will tell you and the authorities as the law requires.
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top always shows the current version.
Eli Riedel (Scroll Art) · hello@scrollart.app
216 Flint Ridge Rd, Apt 2201, San Marcos, TX 78666, United States