Privacy Policy

This Privacy Policy explains how Yeehaw Technologies LLC (“we,” “us,” or “our”) collects, uses, and protects your information in connection with the Ünflat application (the “App”) and the website at unflatlowpoly.com (the “Site”).

1. Executive Summary

We believe in data minimization. Here is how we handle your information:

• Local by Default: The App works fully without an account. Your creations live locally on your device unless you choose to share them.
• No Ads in the App, No Data Selling: We do not show advertisements in the App, and we never sell your personal data.
• Ad Measurement: We advertise Ünflat on TikTok and Meta (Facebook and Instagram). The App uses AppsFlyer to learn which of our ads led to an install or an Ünflat Plus purchase. On iPhone and iPad, the App uses your device’s advertising identifier only if you tap Allow. You can turn ad measurement off in Settings › Help › Ad measurement. It is off in the European Economic Area, the UK and Switzerland. See Section 6.
• Optional Accounts: Signing in is optional. You interact using a handle, not your real name or email address.
• You Control Your Account: You can delete your account at any time.
• Age Restricted: Ünflat is for users 13 and older.

2. Device-Only Data (No Account Required)

By default, Ünflat runs locally on your device. Your figs, scenes, patterns, clips, and exported files (.glb, .png, .gif, .mp4, .stl, and .usdz) are stored on your device's local storage. Photos you import to use as textures, references, or backdrops are processed locally and are never uploaded to our servers unless you explicitly share a creation containing them to the public community.

3. Account Data (Optional)

If you choose to create an account, authentication is handled securely via Firebase Authentication (a Google service) using Apple, Google, or an email address. If you sign in, we collect and store the following on our secure servers:

• Credentials & Identity: An account ID, the email address provided by your sign-in method (never displayed publicly, and used for our newsletter only if you opt in), your name if you sign in with Google (kept by Firebase Authentication and never shown), and your chosen handle.
• Preferences: Your confirmation that you are 13 or older. Your choice to see mature community content is stored on your device only.
• Profile & Activity Data: Your profile bio, star points, the makers you follow, creations you have shared publicly, applause/favorites given, and in-app inbox messages.
• Favorites, Followed & Blocked Makers: The creations you favorite, the makers you follow, and the makers you block are stored with your account in a private record that only your signed-in account can read. Other users cannot see it. Signing out removes this list from the device, signing in on any device restores it, and deleting your account deletes it. When you block a maker while signed in, the App also sends us a report so we can review their work: your account ID, the maker's account ID, the creation you blocked them from (if any) and its name, and the time. Reports are kept as described under Data Retention & Deletion.
• Usage Telemetry: A periodic snapshot of your usage, saved with your account (e.g., total number of figs/scenes created, session counts, app version). We do not track individual taps or precise behavioral data.
• Cloud Backup (Plus Users Only): If you subscribe to Ünflat Plus, we store one cloud backup of your library via Firebase Storage, which is overwritten each time you manually sync.

4. Community Sharing, Remixing, & Marketing Rights

When you choose to share a fig, scene, pattern, or clip to the public community, we store the creation, its thumbnail, your handle, and the remix lineage.

• What is Uploaded: Any textures or paint applied to the creation—including textures generated from your personal photos—are uploaded so others can view the creation. Unused reference photos and backdrops are stripped before uploading.
• Remixing: Shared creations can be opened, modified, and remixed by other users. Your handle remains on the credit line.
• Marketing Usage: By sharing a creation to the public community, you grant us the right to display and use that creation in our promotional, advertising, and marketing materials (including app store listings, social media, and video trailers).
• Content Moderation: Public shares are actively moderated.

5. Diagnostics & Analytics

• Analytics: We use Google Analytics for Firebase to record generalized event data (e.g., app opened, fig created, export sent). This data is anonymized, named by event category rather than specific content (Google Analytics works out an approximate location, such as country or city, from your IP address; we do not collect precise location), and used strictly to understand overall app stability and feature usage. We do not use this data for advertising or cross-app tracking.
• Crash Reports (Opt-In): Crash reporting is disabled by default. If you enable "Send crash notes" in Settings, the App sends a brief, anonymous technical log (app version, screen name, error type) when a crash occurs. This log contains no user IDs, device IDs, or personal content.
• Bug Reports: If you manually submit a bug report via the App, it sends your written description alongside basic diagnostic data (device type, recent error logs) to our support inbox.

6. Ad Measurement in the App

We advertise Ünflat on TikTok and on Meta’s apps (Facebook and Instagram). To learn which ads work, the Ünflat app for iPhone, iPad and Android uses AppsFlyer, a mobile measurement service. AppsFlyer matches an install, or a Plus purchase, to the ad that led to it, and reports the result to us, TikTok and Meta. We use the results only to measure and improve our own ads.

• What the App Sends to AppsFlyer: Device and app details: an AppsFlyer ID created for your install, your device’s advertising identifier where allowed (below), device model, operating system version, language, app version, IP address, and the time the App was installed and opened. Four moments in the App: your first fig saved, the Ünflat Plus screen opened, and Ünflat Plus bought (monthly or yearly).
• What Our Subscription Service Sends: RevenueCat tells AppsFlyer about Ünflat Plus purchases, renewals and refunds, with the price and currency. To match them, RevenueCat receives your AppsFlyer ID and, where allowed, your advertising identifier. These purchase events may include the random ID RevenueCat uses for your account.
• What We Never Send: Your name, email address, handle, your creations, your photos or your messages.
• What TikTok and Meta Receive: AppsFlyer tells the platform whose ad led to your install that the install happened, and passes on the moments and purchases above, so the platform can measure and improve our campaigns. TikTok’s and Meta’s own privacy policies govern what they do with it.
• iPhone and iPad: When you first tap Start, the App shows a short screen, then Apple’s question about tracking. Tap Allow, and the App can use your device’s advertising identifier (IDFA) to match your install to our ad. Tap Ask App Not to Track, and the App never reads it. Without your Allow, Apple’s own SKAdNetwork reports count installs and purchases per campaign; Apple sends these reports days later, without your device’s identity. Apple counts this kind of measurement as tracking, so the App Store page for Ünflat lists it under “Data Used to Track You”. You can change your answer any time in your device’s Settings › Privacy & Security › Tracking.
• Android: The App can read your device’s advertising ID and Google Play’s install referrer. You can delete your advertising ID in your device’s Settings › Privacy › Ads (on some phones, Settings › Google › Ads).
• Turning It Off: Turn off Settings › Help › Ad measurement in the App. The App stops sending data to AppsFlyer at once and clears your AppsFlyer ID from RevenueCat.
• Where It Is Off: Ad measurement is off on devices set to a time zone in the European Economic Area, the UK or Switzerland. It is never on in the web version of Ünflat.

7. Third-Party Integrations

• Connecting a Roblox Account (13+, Android only): The Roblox features are only in the Ünflat Android app. Connecting to Roblox is entirely optional. You authenticate directly on Roblox’s secure portal. Roblox provides the App with sign-in tokens, which are stored entirely in your device’s secure local storage (Encrypted Keystore on Android). Our servers never receive, process, or store your Roblox sign-in tokens. Uploads go directly to your Roblox account and are subject to Roblox’s Privacy Policy and moderation.
• Purchases & Subscriptions: Ünflat Plus subscriptions are processed securely by the Apple App Store or Google Play. We never receive or store your credit card information. We use RevenueCat to validate store receipts and unlock your premium features. Deleting your account deletes your RevenueCat record; your purchase history stays with Apple or Google under their policies. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play settings. RevenueCat also reports purchases, renewals and refunds to AppsFlyer for ad measurement, as described in Section 6.
• Push Notifications: If permitted, the App sends your device’s notification token to our service to alert you to in-app inbox events. You can revoke this permission at any time in your device settings. News from Ünflat notifications are off until you turn them on in Settings.

8. Website & External Communications

• Contact Forms & Submissions: Information submitted via the unflatlowpoly.com contact or "Made with Ünflat" forms (name, handle, email, message) is sent to our support inbox via Resend. We use this solely to respond to your inquiry and do not add you to marketing lists.
• Newsletter: If you explicitly opt in to our newsletter, on the Site or with the unticked box when you sign up in the App, your email is managed by Buttondown. You may unsubscribe at any time via the link in any email.
• Embedded Video: Walkthrough videos on the Site are hosted by YouTube in "privacy-enhanced mode" (youtube-nocookie.com). YouTube does not track your data on our Site unless you actively click play, at which point YouTube’s Privacy Policy applies.
• Website Analytics: The Site uses Google Tag Manager and Google Analytics to count visits, see which pages are read, and see how people found the Site (for example, pages viewed, the site that linked here, general region and device type). We use this only for our own marketing decisions. Google Analytics sets cookies in your browser to do this. It isn’t used for advertising, and it’s separate from the App. A notice on the Site lets you say yes or no to these cookies; in the European Economic Area, the UK and Switzerland, none are set until you say yes. You can also block them in your browser settings.
• Advertising Pixels: The Site uses the TikTok Pixel and the Meta Pixel to learn which of our ads bring visitors, and how many of them tap a store download button. They set advertising cookies in your browser. You can block them in your browser settings.
• Hosting: The Site is hosted securely by Cloudflare, which may process standard technical routing data (like IP addresses) for security and anti-spam rate-limiting.

9. Children's Privacy

Ünflat is strictly for individuals 13 years of age and older. We do not knowingly collect personal information from children under 13. We do not show advertisements in the App. Ad measurement (Section 6) counts installs and purchases from our own ads; we do not use it to build profiles of the people who use Ünflat. If you believe a child under 13 has provided us with personal information, please contact us at [email protected], and we will delete the data immediately.

10. Third-Party Service Providers

We rely on the following trusted partners to operate the App and Site. Their processing of data is governed by their respective privacy policies:

• Apple App Store / Google Play: App distribution and payment processing.
• Firebase (Google): Secure account authentication, cloud database, cloud backups, and analytics.
• RevenueCat: Subscription receipt validation.
• Roblox (Android only): Direct API connection for user-initiated asset uploads.
• Cloudflare: Website hosting and secure media delivery.
• Resend: Transactional email delivery for support forms.
• Buttondown: Opt-in newsletter management.
• AppsFlyer: Ad measurement in the App (Section 6).
• TikTok: Ad measurement for our TikTok ads, in the App and on the Site.
• Meta (Facebook and Instagram): Ad measurement for our Meta ads, in the App and on the Site.

11. Data Retention & Deletion

We retain your account data only as long as your account remains active. Bug reports and support emails are retained only as long as necessary to resolve the inquiry. Google Analytics usage data is not tied to your account and is kept for up to 14 months.

Ad Measurement Data: AppsFlyer, TikTok and Meta keep ad measurement data under their own policies. It is not linked to your Ünflat account, so deleting your account does not delete it. Turning off Settings › Help › Ad measurement stops new data at once. To ask us to have your ad measurement data deleted, email [email protected].

Your Deletion Rights: You may delete your account at any time in the App: Settings › Account › Delete my account, then tap again and sign in once more (an email account types its password); nothing is deleted until that succeeds. Without the App, email [email protected] from the address you signed in with, with the subject "Delete my account" and your handle if you know it; we delete the account within 30 days and reply when it is done. Deleting your account permanently removes your handle, profile, star points and their history, the applause and stars you gave, your saved favorites, fans and blocked makers, your cloud backups, your RevenueCat record, and, if you used Sign in with Apple, the App's link to your Apple ID. Creations you shared publicly stay in the community without your handle: they are credited to “a deleted account” and are no longer linked to you.

What We Keep After Deletion: Reports you filed and support messages you sent stay in our private moderation and support records, with your account ID, for up to one year. If the law requires us to keep something, such as material we must report to the National Center for Missing & Exploited Children, we keep it locked and private for as long as the law requires.

Deleting Some Data Without Deleting Your Account: Clear your page bio and link yourself in Settings › Account. To remove a creation you shared, open its page in the App and tap Take down: it leaves the community at once. We keep a private copy that only you and we can see. To have that copy deleted too, email [email protected] from your sign-in address with its name, and we delete it within 30 days. Unsubscribe from the newsletter with the link in any email, and turn off crash notes or notifications in Settings.

12. Changes to this Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we do, we will revise the "Last updated" date at the top of this document.

13. Contact Us

If you have any questions or concerns about your privacy or this policy, please contact us at [email protected]. See also our Terms & Conditions.