Privacy Policy
Kandiverse (Canada)
Effective: September 6, 2026
1. Who We Are
Kandiverse is developed and operated in Canada. We make Perler-bead pattern design tools for kids and families.
Questions? Email us: support@kandiverse.com
2. Our Privacy-First Design
•
In the photo-to-pattern converter, photos are processed entirely on your device. The raw image is never transmitted to our servers, never uploaded, and never stored by us.
•
Some features upload images you choose to share: AI Create reference photos (transmitted to OpenAI to generate your pattern — see Section 4), and any profile photo, profile banner, or community creation photo you post (stored in our cloud image storage so they can be displayed — see Sections 3, 8, and 9). These uploads are always initiated by you.
•
We collect the minimum personal information necessary to operate the service.
•
We do not sell your personal information to any third party.
•
We do not use your data for targeted advertising or behavioral profiling.
3. Information We Collect
When you create an account:
•
Email address — for login via Supabase Auth
•
Password (hashed) — we never see your plain-text password
•
Display name (optional) — for personalization
When you use the app:
•
Bead pattern designs (color grid data) — so you can save and manage your designs
•
Subscription status — to determine free or paid access
•
Usage events (private design count, AI generation count) — to enforce plan limits server-side
•
Device type, OS version, app version — for crash reporting via Sentry
•
Profile photo, profile banner, and community creation photos you upload — stored so they can be shown in the app; community creation photos are public. Optional and user-initiated.
When you use AI Create (optional):
•
Text prompts and descriptions you enter — sent to our servers to generate your pattern
•
Reference photos you upload — processed transiently to generate your pattern; not stored by us (see Section 4)
Apart from the images you deliberately upload (AI Create reference photos, and any profile or community creation photos), we never access your camera roll or collect photos in the background. We do NOT collect: location data, contacts, biometric data, or any sensitive personal information.
4. AI Create and Third-Party Image Generation
AI Create is an optional feature that turns a text prompt or an uploaded reference photo into a new pixel-art bead pattern. It works differently from the rest of the app:
•
Your prompt, description, and any reference photo you upload are sent to our servers and then to OpenAI, the third-party provider whose image-generation models power the feature. This content is used solely to generate your pattern.
•
We do not store your uploaded reference photo or the generated intermediate image on our servers after your pattern is generated — only the resulting bead-pattern grid exists, and only if you save it.
•
OpenAI processes this content as a service provider under its API terms. OpenAI states that content submitted through its API is not used to train its models and may be retained temporarily for abuse monitoring before deletion.
•
Your AI Create history (the gallery of past generations) is stored locally on your device only. It is never synced to our servers, and you can clear it in the App at any time.
•
We record a count of your generations to enforce daily and monthly generation limits for your plan.
Do not upload photos of other people without their permission. Parents: if your child uses AI Create with a photo, that photo is transmitted to OpenAI as described above. The photo-to-pattern converter (which never uploads photos) remains available as a fully on-device alternative.
5. Payments
Payments are processed by Stripe, a PCI-DSS Level 1 certified processor. We never receive, store, or process your full card number or CVV. We receive only a Stripe customer ID and subscription status.
6. Children's Privacy
Kandiverse may be used by children. We comply with COPPA (US), PIPEDA (Canada), and GDPR Article 8 (EU/UK).
•
We do not knowingly collect personal information from children under 13 without verified parental consent.
•
EU/UK users under 16 should use the app only with parental consent.
•
We display no behaviorally targeted ads to any user, including children.
•
Sharing a pattern to the community makes a child's username, profile photo, bio and shared designs publicly visible and indexable by search engines - see Section 7 for what this means and how to keep designs private.
If you believe your child has provided us personal information without your consent, email support@kandiverse.com and we will delete it promptly.
7. Public Content and Search Engines
Some parts of Kandiverse are public by design, and public means visible to anyone on the internet, not only to signed-in Kandiverse users.
•
Patterns you share to the community are published at kandiverse.com/patterns/... together with the pattern name, its bead and colour counts, and the username of whoever shared it.
•
Your creator profile is published at kandiverse.com/profile/your-username whenever you have at least one shared pattern. It shows your username, display name, profile photo, banner, bio, any social links you added, and the list of patterns you have shared.
Both are included in our sitemap and are indexable, so search engines such as Google may list them in search results and show your profile photo and pattern images in image search. Search engines keep their own copies, so a page can remain visible in results for some time after you change or remove it.
You control this:
•
A design saved as Private or Followers only is never published or indexed.
•
Deleting a shared pattern removes its public page. If you delete every shared pattern, your creator profile is no longer published.
•
Deleting your account removes your public pages.
•
To speed up removal from a search engine's own index after you delete something, contact that search engine directly, or email support@kandiverse.com and we will help.
Profiles that have never shared a pattern are not published or indexed at all.
For parents: if your child shares a pattern to the community, their username, profile photo, bio and shared designs become publicly visible and searchable as described above. If you would rather your child's work stay private, have them save designs as Private or Followers only, or contact us at support@kandiverse.com.
7. Public Content and Search Engines
Some parts of Kandiverse are public by design, and public means visible to anyone on the internet, not only to signed-in Kandiverse users.
•
Patterns you share to the community are published at kandiverse.com/patterns/... together with the pattern name, its bead and colour counts, and the username of whoever shared it.
•
Your creator profile is published at kandiverse.com/profile/your-username whenever you have at least one shared pattern. It shows your username, display name, profile photo, banner, bio, any social links you added, and the list of patterns you have shared.
Both are included in our sitemap and are indexable, so search engines such as Google may list them in search results and show your profile photo and pattern images in image search. Search engines keep their own copies, so a page can remain visible in results for some time after you change or remove it.
You control this:
•
A design saved as Private or Followers only is never published or indexed.
•
Deleting a shared pattern removes its public page. If you delete every shared pattern, your creator profile is no longer published.
•
Deleting your account removes your public pages.
•
To speed up removal from a search engine's own index after you delete something, contact that search engine directly, or email support@kandiverse.com and we will help.
Profiles that have never shared a pattern are not published or indexed at all.
For parents: if your child shares a pattern to the community, their username, profile photo, bio and shared designs become publicly visible and searchable as described above. If you would rather your child's work stay private, have them save designs as Private or Followers only, or contact us at support@kandiverse.com.
8. How We Use Your Information
We use your information only to:
•
Create and manage your account
•
Save and sync your bead-pattern designs
•
Generate your AI Create patterns when you request them
•
Process subscription payments and gate premium features
•
Enforce plan limits (private saves and AI Create generation allowances; community saves are unlimited)
•
Detect and prevent abuse and fraud
•
Diagnose crashes and fix bugs
•
Respond to support requests
•
Comply with applicable law
9. Who We Share Data With
•
Supabase — database, auth, and storage hosting
•
Stripe — subscription billing
•
OpenAI — image generation for the optional AI Create feature (receives only the prompts, descriptions, and reference photos you submit to it)
•
Cloudflare — image hosting and delivery (R2) for the profile photos, banners, and community creation photos you upload, and network/security proxying
•
Sentry — crash reporting (no PII in payloads)
•
Legal authorities — when required by law or court order
We do not sell or share your data with advertisers or data brokers.
10. Data Storage and Retention
Your data is stored on Supabase's cloud infrastructure, which may be hosted in the United States; uploaded images (profile photos, banners, and community creation photos) are stored in Cloudflare R2. We ensure GDPR-compliant safeguards including standard contractual clauses where applicable.
•
Active account data: retained while your account is active
•
Usage events: retained 90 days then anonymized
•
Uploaded photos (profile, banner, community creations): stored in Cloudflare R2 while the account or design exists; removed when you delete them or your account
•
AI Create prompts and reference photos: processed transiently and not retained on our servers after your pattern is generated
•
Crash logs (Sentry): auto-deleted after 90 days
•
Deleted account data: removed within 30 days of account deletion
11. Your Rights
Contact support@kandiverse.com to:
•
Access the personal information we hold about you
•
Delete your account and all associated data
•
Export your data (data portability)
•
Withdraw consent at any time
EU/EEA/UK users may also lodge a complaint with their local data protection authority. California users have additional rights under the CCPA — we do not sell personal information.
We respond to all verifiable requests within 30 days.
12. Security
•
All data in transit is encrypted via TLS 1.2+
•
Data at rest is encrypted by Supabase's storage layer
•
Row-Level Security ensures users access only their own data
•
Auth tokens are stored in your device's SecureStore
•
Rate limiting is applied to all API endpoints
13. Changes to This Policy
We may update this Privacy Policy from time to time and will revise the Effective date above. Minor or clarifying updates take effect when posted. For material changes to how we collect, use, or share your personal information, we will provide notice in the app and/or by email, and — where the law requires it, including verifiable parental consent for changes that affect children — before the change applies to you. Continued use after an update takes effect constitutes acceptance.
14. Contact
Kandiverse — Canada
Email: support@kandiverse.com
Office of the Privacy Commissioner of Canada: www.priv.gc.ca · 1-800-282-1376
Last updated September 6, 2026