Sandpainting privacy
Effective 2026-08-30 · applies to the Sandpainting apps for iOS and Android, made by Kaolin Fire (erif.org).
Sandpainting collects nothing about you. There is no account, no sign-in, no analytics, no crash reporting, no advertising, and no server of ours anywhere. Drawing, lighting, and turning a photo into relief all happen on your device.
Your paintings and photos
What you make stays on your device. When you bring in a photo — by picking one or sharing one into the app — the app reads it, turns its brightness into a height for each point of sand, and keeps only those numbers. The photo itself is not copied into the app’s storage and is never uploaded. On iOS, a photo’s real depth information is used when it has any; that too is read entirely on the device.
No photo-library permission is requested. The system photo picker runs outside the app and hands over only the one image you chose.
When you tap Share, the app writes the current artwork to a single image file in its own private cache and hands that file to whichever app you pick. Nothing is sent anywhere unless you choose a destination.
Tilt and shake
The app reads the accelerometer while you play, so sand runs downhill and a shake levels the tray. Those readings are used in the moment and are never recorded, stored, or transmitted.
Purchases
One optional purchase, All the Colors ($1.99), unlocks the extra colourings. It is processed entirely by Apple or Google Play — we never see, receive, or store payment information, card numbers, or billing addresses. The app keeps a single true/false flag on your device recording that the unlock is owned, and re-checks that with the store. Bringing in a photo is never behind the purchase.
Network access
The app makes no network requests of its own — no version check, no asset download, no remote configuration, no crash upload. Its only web address is a link that opens the App Store if you choose to leave a review.
On Android the app’s permission list includes INTERNET
and ACCESS_NETWORK_STATE. Neither is declared by our code: both
are added automatically by Google’s billing library, which needs them
to talk to Google Play about the one purchase.
Analytics & crash reports
None, on either platform. No Firebase, no Crashlytics, no advertising SDK, no third-party analytics of any kind.
Apple’s StoreKit and Google’s billing library handle the purchase and are subject to Apple’s and Google’s privacy policies. Apple and Google also report their own standard install and crash statistics to developers for every app on their stores; that is their collection, not ours.
What Sandpainting doesn’t do
- No selling of data, to anyone, ever.
- No advertising and no tracking identifiers.
- No account, no login, no server of ours.
Because nothing is collected, there is nothing to share, sell, or delete. Deleting the app removes what it kept on your device.
Changes & contact
If this policy changes, the new version will be posted at this address with a new effective date. Questions: kaolin@erif.org.