Design your tattoo

Privacy

Updated October 5, 2026

Deleting your data

You can delete your account and everything stored with it at any time, yourself: in the app, open Profile and choose Delete account, or do the same in the web app at https://app.tattoonic.com. The account deletion page explains what is deleted and what is kept.

You can also ask us by email: write to support@tattoonic.com from the email address of your account. We delete the account within one month and confirm it to you.

Apple and Google keep their own records of App Store and Google Play purchases and of signing in with them. Ask them to delete those.

What this policy covers

This policy explains what Tattoonic collects, why, who helps us run it, and what you can do about your data. It covers:

Who is responsible

Tattoonic is run by Lucero Studio, Morlans, San Sebastián, Spain. We decide how your data is used, so we are responsible for it: the "controller" under the EU and UK GDPR.

Your data is yours. We use it only as this policy says.

Privacy questions and requests: support@tattoonic.com. Help with the app: support@tattoonic.com.

What we collect

What you give us

  • Your account: your email address, and a password if you set one. It is stored in a form we cannot read.
  • Your photos: the photos you upload to make a design, from your camera or your photo library: of your skin, of a tattoo, or of what you want turned into a tattoo, such as a pet or a flower.
  • Your words: what you type to describe a design, and the words of a lettering design.
  • Your designs: the designs made for you, the tool, words and options you chose, and whether you liked or disliked a design or an idea.
  • Design notes: a short note under each design, written by an AI model, saying what changed and suggesting a next step.
  • The assistant (Pro): your messages, the photos you attach to them, and its replies.
  • Emails to us: what you write, and the details the app adds to a message you start from Contact us: the app version, your device model and system version, your app language and your account's email address.

Photos of your body

The photos you add may show your skin, a tattoo, a scar or another mark, and someone could guess something about your health or beliefs from them, such as a surgery scar or a religious symbol. We use them only to make the designs you ask for and to show them to you. We do not use them to identify you or to work out anything about you, and we never use them for anything else.

Signing in with Apple or Google

You can sign in with your email and a password (confirmed with a code we email you), with Apple or with Google. If you use Apple or Google, we receive what they share with us for sign-in: an account identifier, your email address (with Apple, you can hide it behind a relay address) and, if they share them, your name and profile picture. We do not get your Apple or Google password, and we do not read anything else in those accounts.

What we collect automatically

  • Language and time zone: your app language and time zone. We use them to write emails, notifications and design notes in your language, and to know when your day starts for the daily limits.
  • Sessions and security logs: your sign-in session, your IP address and your device's browser or app information, which our database provider keeps in its sessions and security logs. An account can be signed in on one device at a time: signing in on a new device signs out the others.
  • Push tokens: a token for each device where notifications are on, linked to the sign-in session that registered it.
  • Plan and purchases: which plan you have, when it renews, and your purchase history. We never see your card details.
  • Daily counts: how many designs and assistant messages you used today, to apply the daily limits.
  • Crash reports: when the app crashes or hits an error, what went wrong, the app version, and the device and system version, with performance measurements and error logs. Reports carry your account's random identifier, never your email or name.
  • Usage data: how the app is used, for example which screens you open, which tools you try, and whether a design finished. These events carry your account's random identifier, the app version, the device and system version, and plain values such as a tool name. They never carry your email, your name, your photos or what you type. PostHog, which receives them, also gets your device's IP address with them, and discards it: it does not store IP addresses. Before discarding it, PostHog may work out an approximate location (such as the country and city) from it, and keeps only that. Usage data is on unless you turn it off: in Profile, turn off Share usage data, and the app records and sends no more usage events from that device.

What is stored on your device or in your browser

  • Sign-in and settings: the apps keep your sign-in session (encrypted) and your settings, such as your language and whether usage data is shared, on your device. The web app keeps them in your browser's storage. They are needed for Tattoonic to work.
  • Usage data: while Share usage data is on, PostHog keeps an analytics identifier and the usage events waiting to be sent: on your device in the apps, and in your browser's storage in the web app. Turn off Share usage data in Profile to stop it.

Tattoonic uses no advertising identifiers and no advertising or cross-app tracking tools, and it does not recognise faces. The web app sets no cookies of its own. The marketing website at https://tattoonic.com uses no cookies at all (see "This website" below).

Permissions on your device

Tattoonic asks for these only when you use the feature that needs them. You can refuse, or change your answer in your device's settings.

  • Camera: to take a photo for a design.
  • Photo library: to pick photos for a design, through the system's photo picker, and to save designs to your photos.
  • Notifications: to tell you when a design is ready.
  • Network: to reach our servers. Tattoonic needs an internet connection.

How we use it

  • To provide Tattoonic (our contract with you): your account and sign-in, making designs and their notes, the assistant, notifications you asked for, your plan, and its daily limits.
  • To answer you (our contract with you, or our legitimate interest in helping you): your emails and requests.
  • To keep Tattoonic working and safe (our legitimate interests): crash reports, fixing errors, preventing fraud and abuse, and the one-device sign-in rule.
  • To improve Tattoonic (our legitimate interest in learning how Tattoonic is used, with an easy way to say no): usage data. It is on from the start, and you can turn it off at any time: in Profile, turn off Share usage data. From then on, the app records and sends no usage data from that device.
  • To meet legal duties: for example keeping tax and accounting records, and answering lawful requests from authorities.
  • To tell you about Tattoonic: important changes to Tattoonic, these terms or this policy, by email or in the app.
  • If Tattoonic changes hands: in a merger, sale or reorganisation, the data passes to the new owner, who must keep this policy.

We do not sell your data. Tattoonic shows no ads, and we do not use your photos, designs or messages for advertising or to train AI models.

Who we share it with

We share data only with the companies below, who process it for us to run Tattoonic, and only what each needs:

  • Hosting, database and storage: Supabase and Cloudflare.
  • AI models: WaveSpeed for the designs, and OpenRouter for the assistant and the design notes. They receive the photos, your messages and our instructions only to make the result and send it back. We ask OpenRouter to send them only to model providers that do not train on them or keep them for other uses; some keep them briefly to prevent abuse.
  • Payments: RevenueCat, Stripe, Apple and Google.
  • Crash reports and usage data: Sentry and PostHog.
  • Notifications and email: Expo, Apple and Google for notifications, and Resend for the codes and account emails we send you.

The full list, with what each does and its privacy policy, is under "The services we use" below. Apple and Google, as app stores and sign-in providers, handle data under their own privacy policies.

We may also share data when the law requires it, to protect people's safety or our rights, or with a new owner if Tattoonic is sold.

Tattoonic and this website link to other services, such as the App Store and Google Play. This policy does not cover them.

The services we use

  • Supabase (Supabase, Inc.): our database, file storage and sign-in. It holds your account, sessions, photos, designs, notes and chat messages. Privacy policy
  • WaveSpeed (WaveSpeedAI Pte. Ltd.): runs the image model, OpenAI's GPT Image, that makes the designs. It receives the photos for a design and our instructions for the model, and returns the image. We use it only to make designs, and send it no account details. Under its terms, the photos and designs stay ours and it may use them to make the design; beyond that, it may use only aggregated, anonymised information about the use of its service, to improve it. Its terms say its service relies on other companies' offerings, so OpenAI, which makes the model, may also process them to make the image. Its privacy policy sets no fixed period for keeping them: it keeps data as long as it needs to provide its service, with backup copies for a limited time. Privacy policy
  • OpenRouter (OpenRouter, Inc.): connects the assistant and the design notes to AI models, DeepSeek models today, run by providers that OpenRouter picks among those that do not train on the data or keep it for other uses (some keep it briefly to prevent abuse). It receives your messages, the photos and designs they are about, and, for a design's note, the photo and the design. Prompt logging is off in our OpenRouter account, so OpenRouter does not store your messages, photos or the replies. Privacy policy
  • RevenueCat (RevenueCat, Inc.): manages purchases, subscriptions and the web checkout. It knows your account's random identifier and your purchases, and, for a web purchase, what you enter at its checkout. Privacy policy
  • Stripe (Stripe, Inc. and its affiliates): processes card payments on the web. Privacy policy
  • Sentry (Functional Software, Inc.): crash and error reports, stored in its EU region. Privacy policy
  • PostHog (PostHog, Inc.): usage data from the app while Share usage data is on, and visit counts for this website. It discards IP addresses. Privacy policy
  • Expo (650 Industries, Inc.): sends push notifications to your device, through Apple and Google. Privacy policy
  • Cloudflare (Cloudflare, Inc.): hosts this website and the web app. It handles your IP address to deliver the pages and protect them. Privacy policy
  • Apple (Apple Inc.): Sign in with Apple, the App Store and its payments, and notifications on Apple devices. Privacy policy
  • Google (Google LLC): Sign in with Google, Google Play and its payments, and notifications on Android. Privacy policy
  • Resend (Plus Five Five, Inc.): sends the codes (sign-up, password reset and password change) and other account emails, from noreply@tattoonic.com, through its EU region (Ireland). It receives your email address and the email it sends you. Privacy policy

International transfers

Our providers may process data outside your country, including in the United States. When data leaves the EU, the UK or Switzerland, we rely on safeguards the law accepts, such as the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

We keep data only as long as we need it for the purposes above.

  • Account, photos, designs, notes and chat messages: until you delete them or your account. Deleting a design deletes its photos and images. Start over in the assistant deletes your messages and their photos.
  • Push tokens: until you sign out on that device or it stops receiving notifications. We keep the 20 devices you used most recently.
  • Crash reports: Sentry deletes them after at most 90 days (Sentry's retention periods).
  • Usage data: PostHog keeps usage events for 7 years, the retention period of our PostHog plan (PostHog's retention periods), then deletes them. They carry your account's random identifier, never your email or name.
  • Purchase records: RevenueCat's record is deleted with your account. Apple and Google keep their own records under their policies. We keep what tax and accounting law requires, for as long as it requires.
  • Emails to us: as long as we need them to help you, and as the law requires.

Security

We protect your data with encryption in transit, private storage for your photos and designs that only your account can read, and access limited to what each part of Tattoonic needs. In the iPhone, iPad and Android apps, your sign-in session is stored encrypted on the device. No system is completely secure, so we cannot promise that your data will never be accessed without permission. If a breach puts your data at risk, we tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

  • See the data we hold about you, and get a copy.
  • Correct it if it is wrong.
  • Delete it. You can delete your account yourself at any time.
  • Stop using it for usage data: turn off Share usage data in Profile.

Write to support@tattoonic.com from the email address of your account, so we know the request is yours. We answer within one month, and it is free unless a request is clearly unfounded or excessive.

In the EU and the UK

Under the GDPR you also have the right to:

  • Restrict our use of your data.
  • Object to uses based on our legitimate interests.
  • Receive your data in a portable format, or have it sent to another company.
  • Withdraw your consent at any time, where we rely on it.
  • Complain to the data protection authority where you live or work, or where we are established. We would like to hear from you first.

In California

Under the CCPA you have the right to know what personal information we collect, use and disclose, and why; to get a copy of it in a portable format; to correct it; and to delete it. You can ask twice in 12 months. We do not sell your personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer things about you. We will not treat you differently, charge you more or give you a worse service for using these rights. You can ask through someone you authorise, and we may need to confirm who you are and that they may act for you.

Children

Tattoonic is not for anyone under 17, and we do not knowingly collect their data. Photos of a child, or of a child's body, may not be uploaded. If you believe a child uses Tattoonic or appears in a photo uploaded to it, write to support@tattoonic.com and we will delete the data.

Images made with AI

Designs, design notes and the example designs in the Ideas section are made by AI. On this website, every image made with AI is marked as made with AI in the image file. The main pictures also carry a visible "Made with AI" label, and the footer of every page says that its pictures are made with AI.

This website

This website does not use cookies. It counts visits with PostHog without cookies and without storing anything in your browser; PostHog gets your IP address, as described under usage data above. We use the counts only to see which pages people read and which buttons open the app. Cloudflare, which hosts the website, handles your IP address to deliver the pages.

Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters to you, we tell you in the app or by email before it applies.

Contact