iFutureArt · Paint by Numbers
Privacy Policy
Effective from June 5, 2026
This Policy regulates the processing of personal data of users of the «iFutureArt · Paint by Numbers» service (hereinafter «the App»). The App is provided as a mini-app in several messengers and as native applications:
| Platform | Technology | Address / bot |
|---|
| Telegram | Mini App (Telegram WebApp SDK) | @Paintbyapp_bot · app.ifutureart.com |
| MAX | Mini App (MAX Bridge) | id1655495116_bot · max.ifutureart.com |
| VK | VK Mini App | vk.ifutureart.com |
| iOS / Android | Native applications | via api.ifutureart.com |
This Policy supplements the general policy of ifutureart.ru.
1. Operator
LLC «INTERNATIONAL ART»
INN 1655495116 · OGRN 1231600023710
Address: 420111, Republic of Tatarstan, Kazan, Telmana str., 24
Personal data contact: privacy@ifutureart.ru
2. What data we process
Data sent by the platform when launching the App (initData / launch params / Apple identity token):
- User identifier in the platform (Telegram user_id, MAX user_id, VK user_id or Apple sub)
- First name, last name — if specified in the profile and passed by the platform (VK launch params, for example, do not pass the name — it is fetched separately via VK Bridge with your consent)
- Username — if open in the profile
- Profile photo URL — if provided by the platform
- Interface language code (en, ru, es)
- Email and privateRelay flag — only for iOS/Android users signing in with Apple, and only if you explicitly shared your email
By default, accounts on different platforms are independent. The same person logging in via Telegram, MAX, VK, the iOS and Android apps gets, by default, separate accounts with their own progress, points and achievements. Account linking (merging) is supported — you can merge accounts from different platforms into one, combining progress and points.
Data created during use:
- Picture progress (filled regions, painting time)
- Points history, achievements, debits and credits
- Messages and emoji reactions in collaborative sessions
- Referral connections (who invited, how many invited)
- Settings (theme, language, painting options)
- Share cards with progress (stored up to 7 days)
- APNS / FCM / push tokens of devices — for native-app users (iOS — Apple APNS, Android — Google Firebase Cloud Messaging) to deliver notifications
- Technical logs (in case of errors — 30 days)
What we do NOT collect:
- Passwords, PINs, payment card data
- Geolocation
- Phone book contacts
- History of other apps and websites
- Biometrics, face recognition
- IDFA and any cross-app tracking IDs
- Cross-app / cross-website tracking of any kind — we do not follow you across other apps or websites
- Data for advertising networks or data brokers
Apple Privacy Nutrition Label for the iOS app: all collected data is classified as «Data Linked to You» (linked to your ID), «Not Used to Track You» (not used for tracking purposes per App Tracking Transparency).
3. Purposes of processing
- App functionality (saving progress, leaderboards, collaborations)
- Sending notifications in the platform you logged in with (Telegram, MAX, or push to your native-app device: APNS for iOS, FCM for Android): invitations, reminders, collaboration results
- Aggregated analytics and product improvement
- Security, anti-spam and anti-multi-accounting within a single platform
4. Legal grounds
Processing is carried out in accordance with the Federal Law of the Russian Federation No. 152-FZ «On Personal Data» on the basis of:
- Your consent (the act of launching the App in Telegram, MAX, VK, or installing the native app constitutes consent)
- Performance of the offer-contract (these Terms of Service)
- Legitimate interests of the Operator (analytics, security)
5. Transfer to third parties
Your data is transferred only to:
- Telegram Messenger Inc. — for Telegram users, via Telegram Bot API, in accordance with the Telegram Privacy Policy
- MAX (JSC «Communication Platform») — for MAX users, via MAX Bot API (
platform-api.max.ru), in accordance with MAX policy
- VK (VKontakte) — for VK Mini App users, via VK Mini Apps API, in accordance with VK Policy
- Apple Inc. — for iOS users, via Sign in with Apple and Apple Push Notification service (APNS), in accordance with the Apple Privacy Policy
- Google LLC (Firebase) — for Android users, via Firebase Cloud Messaging (FCM) to deliver push notifications, in accordance with the Firebase and Google privacy policies
- Hosting provider — for hosting servers (servers are located in Russia)
- Russian government bodies — in cases provided by law
We do not sell your data. We do not share it with advertising networks. We do not use it for cross-border transfer.
6. Storage periods
| Data | Period |
|---|
| Picture progress, points, achievements | Until account deletion |
| Chat messages in collab | 30 days after session end |
| Share cards | 7 days |
| APNS / push tokens of devices | Until app uninstall or explicit notification opt-out |
| Technical error logs | 30 days |
| Login history | 90 days |
7. Your rights
You have the right to:
- Get information about what data we have about you
- Get a copy of your data
- Correct inaccurate data
- Delete your account and all associated data («right to be forgotten»)
- Withdraw consent to processing
- Appeal the Operator's actions to Roskomnadzor or in court
In-app account deletion (iOS / Android):
Open Settings → Delete account. A two-step confirmation prevents accidental deletion. Upon confirmation:
- E-mail, Apple ID link, Telegram link are erased
- Push tokens for your devices are removed
- All accumulated points are forfeited from this account
- The account is deactivated (
deleted_at flag) and cannot be recovered — signing in again with the same Apple ID will create a BRAND NEW account starting from 0 points
- Your name in past collab sessions and public leaderboards stays preserved (public historical record about a picture)
Mini App deletion (Telegram / MAX / VK):
Since the mini-app uses your platform ID, there is no in-app delete button — revoke bot access in your platform settings (Telegram → @Paintbyapp_bot → ⛔ Stop and block bot, similarly in MAX/VK), or write to privacy@ifutureart.ru.
Send requests to privacy@ifutureart.ru with the subject «iFutureArt». Response — within 10 business days. Account deletion on request affects only the account for which you sent the request (if you use the App on several platforms — you need to specify which accounts to delete).
8. Security
- Authentication via HMAC signature of initData for all messengers (Telegram WebApp / MAX Bridge / VK Mini Apps), or via Apple identity token for iOS — no passwords
- All data is transmitted over HTTPS / WSS
- Servers are located in the Russian Federation
- Database access is restricted, logged
- Daily database backups
9. Cookies and similar technologies
The App does not use cookies in the classical sense. It stores in the local storage of the messenger's WebApp / Bridge (or in the local storage of the app for iOS/Android) only user interface settings (selected category, theme, language).
10. Children
The App is not intended for persons under 13. If you believe that a child under 13 has shared data with us, please write to privacy@ifutureart.ru — we will delete the data.
11. Policy changes
The current version is always available at app.ifutureart.com/privacy/en/, max.ifutureart.com/privacy/en/ and vk.ifutureart.com/privacy/en/. Material changes are announced in the channels: @ifutureart on Telegram and channel on MAX; native app users receive an on-device notification.