Privacy Policy
Last updated 21 August 2026
The short version
The studios run in your browser. Your artwork never leaves your device — it is saved in your own browser storage, not on a server.
If you sign in, we hold your email address and whether your subscription is active. That is all. Card details go to Stripe and are never seen by us.
There is no advertising, no tracking pixels, and nothing is sold.
1. Who is responsible
These services are operated by Andy Legenki, an independent developer, as the data controller. For any question about your data, or to exercise the rights described below, write toandylegenki@gmail.com.
This policy covers legenki.com and the studios at grafema.legenki.com, ritmo.legenki.com, divix.legenki.com and lumen.legenki.com.
2. What is collected
If you never sign in
Nothing that identifies you. The free studios work without an account. Your work is stored by your browser (see “Your work stays local” below), and our host records standard server logs — IP address, browser type, page requested — which are used to keep the service running and are not linked to a person.
If you sign in with Google
Google sends us your email address andbasic profile (name and picture). We request nothing else — no access to Gmail, Drive, Contacts or Calendar. You can review what was shared atGoogle Account permissions.
If you subscribe
Payment is handled entirely by Stripe. We never see or store your card details. What we keep is a single row recording that a subscription exists:
| Stored | Why |
|---|---|
| Account identifier | To match the subscription to your login |
| Status (active, cancelled, past due) | To decide whether Pro features are unlocked |
| Plan (monthly or yearly) | To show it in your account |
| Renewal date | To know when access ends |
| Stripe customer and subscription reference | To keep the record in step with Stripe |
3. Your work stays local
Everything you make — compositions, layers, presets, uploaded fonts and images — is saved in your browser’s own storage on your device. It isnot uploaded, not backed up by us, and not visible to us.
Two consequences worth knowing: clearing your browser data will delete your work, and work saved in one browser will not appear in another. Use the export buttons to keep anything you want to preserve.
4. Who else processes data
| Service | Purpose | What it receives |
|---|---|---|
| Sign-in | Handles the login; tells us your email and profile | |
| Supabase | Accounts and subscription records | Email, account id, subscription status |
| Stripe | Payments | Card details, billing information, your account id |
| Cloudflare | Hosting and delivery | Standard request logs |
Each of these is an established provider with its own privacy terms. Some process data outside your country, including in the United States, under the safeguards their own terms describe.
5. Cookies and tracking
We use no advertising cookies, no analytics profiles and no cross-site trackers. Browser storage is used for two things only: keeping you signed in, and saving your work and preferences on your device.
Our host, Cloudflare, collects aggregate traffic counts that do not identify individual visitors.
6. How long data is kept
- Account and subscription records — while your account exists, and afterwards only where required for tax and accounting records.
- Payment records — retained by Stripe under its own policy and applicable financial law.
- Your work — until you delete it or clear your browser storage. We cannot delete it for you, because we cannot reach it.
7. Your rights
Depending on where you live — and always if you are in the UK or the EEA — you may request a copy of your data, ask for corrections, ask for deletion, object to processing, or ask for your data in a portable form.
Write to andylegenki@gmail.com and we will respond within 30 days. To delete your account, say so in that email; we will remove your account and subscription record. Cancel the subscription itself in Stripe first, through the billing portal in your account menu, so that no further payment is taken.
If you are in the UK or EEA and believe your data has been mishandled, you may also complain to your national data protection authority.
8. Children
These services are not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided data, write to us and it will be removed.
9. Security
Traffic is encrypted in transit. Subscription records are protected so that an account can read only its own row. No system is perfectly secure, but the surface here is deliberately small: we hold very little, and the most sensitive data — your card — never reaches us at all.
10. Changes
If this policy changes materially, the date at the top will change and, where the change affects you meaningfully, we will say so in the app. Continuing to use the services after a change means you accept the updated policy.