App · Legal
App privacy
Controller
KCraft Studio LTD (PK Gallery)
Neofytou Nikolaidi & Theod. Kolokotroni
Onisiforou Center, 2nd floor
8011 Paphos, Agios Theodoros
Cyprus
This notice applies to the “PK Gallery” painting app for iPhone and Android. We process personal data in accordance with the General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018. For the shop at pk-gallery.art, the shop privacy notice applies.
Account without name or email
When you first open the app, it creates an account without a name, email address, device identifier or IP address. Your device receives a random key that is kept in the device’s protected storage (Keychain or Keystore). On our server we store only a non-reversible hash of it. Each device has its own key, which is deleted when you sign out. The account ID is a pseudonym; together with your photos and content it is still personal data (Art. 6(1)(b) GDPR).
Securing your account with Apple or Google
If you wish, you can secure your account with “Sign in with Apple” or “Sign in with Google” and use it on several devices. The app receives a signed sign-in token from Apple or Google. We verify it and store only a hash of the provider’s user identifier. With Apple we request neither your email address nor your name. The sign-in token from Google necessarily also contains your email address, name and profile picture; we do not use or store this information. Apple and Google process the sign-in as independent controllers under their own privacy policies (Art. 6(1)(b) GDPR).
Data we store for you
So that the app looks the same on all your devices, we store in your account: your answers from getting started (what you paint with, experience, time), your paint box and shopping lists as entries from our materials catalogue, your projects with your painting progress, and the status of your subscription and your balance of single guides. We also store when you confirmed the photo notice (version and time), the date you last used the app (for automatic deletion) and, for 40 days, how many guides, checks and questions you used per day (for the usage limits) (Art. 6(1)(b) GDPR).
Your photos
When you create a guide from your own photo or have your progress checked, we store the photo together with the guide or the feedback in private storage. Only you can retrieve it through the app; we do not show it to anyone and do not use it for advertising. Before storing it, we reduce the photo in size and remove all metadata such as location and camera details. Before your first photo, the app tells you about this and asks you to confirm.
Photos are kept until you delete them or your account. The photo of your own guide is deleted together with the guide; progress photos can be deleted individually or together with the project. Accounts that are not used for 24 months and have no running subscription are deleted automatically together with all photos (Art. 6(1)(b) GDPR). Please do not upload photos of other people without their permission.
Guides created with AI
Guides, feedback on your progress and answers to your questions from Chroma, the app’s AI painting coach, are created by an AI service from Anthropic PBC, USA. For this we transmit the photo concerned, your chosen settings or your question and the current step of the guide, but no identifier of your account. We do not store questions. Anthropic processes the data as a processor under a data processing agreement with EU standard contractual clauses, does not use it to train its models under its terms for commercial API customers, and deletes it after a short time, usually within 30 days at most (Art. 6(1)(b), Art. 28 and 46 GDPR).
Subscription and purchases
Subscriptions and single purchases are handled by Apple’s App Store or Google Play. Your payment details stay there; we never receive them. RevenueCat, Inc., USA, manages the status of your subscription for us as a processor. RevenueCat receives the random identifier of your app account, the purchase details (product, time, term, status, store country) and, for technical reasons, your IP address and information about your device, operating system and app version, but no name and no payment details. When you delete your account, we also have your record at RevenueCat deleted. Transfers to the USA are based on EU standard contractual clauses (Art. 6(1)(b), Art. 28 and 46 GDPR).
Reporting content
If you think a guide, feedback or an answer from Chroma is wrong, offensive or unsafe, you can report it in the app. We store the report with the reason, your optional note, the reported text and its context (e.g. guide and step) together with your account ID, review it and delete it after 12 months at the latest or with your account (Art. 6(1)(f) GDPR; our interest is to detect and improve faulty AI content).
No advertising, no tracking
The app shows no advertising, contains no analytics or advertising SDKs and does not track you across other apps or websites. Images of the works by Pegah Koch are loaded from pk-gallery.art.
Hosting and server logs
The app’s server, database and photos are stored on our servers at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, under a data processing agreement. With every request, technically necessary data (IP address, time, interface called) is processed to run the app securely and limit abuse (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest.
Contacting us by email
If you write to us, we use your details and your account ID to answer your enquiry (Art. 6(1)(b) and (f) GDPR). Our mailboxes are hosted by Microsoft 365 (Microsoft Ireland Operations Limited, Dublin, Ireland), which processes the messages as a processor; transfers to the USA rely on the EU-US Data Privacy Framework and EU standard contractual clauses.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can delete individual photos, guides and projects directly in the app; under “Profile → Delete account and all data” you delete your account with all data and photos immediately. If you secured your account with Apple, we also ask Apple to revoke the app’s sign-in when you delete it. You may object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). We do not use automated decision-making. As we store no contact details, please quote the identifier shown in the app’s profile when you contact us.
You may lodge a complaint with a supervisory authority, in particular the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (dataprotection.gov.cy), or with the authority in your EU country.
Version of 14 October 2026