Etch← Back to home

- LEGAL

Privacy Policy

Effective: July 2026

1. Overview

This policy describes what Etch (a product of Stalwart Crest, Inc.) collects when you use the iOS app and this website, why we collect it, who we share it with, and the rights you have over it. We don't sell your data. We don't run third-party analytics. We don't use your content to train AI.

2. Data Stored on Your Device

Etch stores drafts in progress, your settings, and a cache of media you've captured or viewed. This data lives only on your device and is cleared when you uninstall the app.

3. Data Stored on Our Servers

Bundle metadata (titles, item order, the seal hash, timestamps) in our Supabase Postgres database; your captured media (photos and voice) in Cloudflare R2 and video in Cloudflare Stream, encrypted at rest; your account record (your email address); and, if you subscribe to Etch Pro, your subscription status and entitlement (whether Pro is active and when it renews or expires). We do not store your payment card or Apple ID credentials — payment is handled entirely by Apple.

4. Camera, Microphone & Photo Library Access

We ask for camera and microphone access only when you initiate a capture (photo, voice, or video), and photo-library access only when you choose to attach existing media. Items captured inside the app receive a server-stamped timestamp at the moment of capture; items attached from the library are clearly marked as "Attached" with no timestamp claim.

5. Public Share Links

When you publish an Etch, the link makes its included media accessible to anyone who has the URL. When the link is opened, we log basic view metadata (the time it was opened and the referring page) so the sender gets a delivery receipt and we can detect abuse. We do not log the viewer's IP address, device, location, or precise dwell time.

6. Tamper-Evident Hashes

Every published Etch has a cryptographic hash computed over the bundle contents. We store the hash so the viewer can detect tampering. The bundle's media is kept in Cloudflare R2 and Stream (encrypted at rest); we never store it in plaintext anywhere else.

7. Third-Party Services

Supabase (authentication + database), Cloudflare R2 and Stream (media storage and delivery), Cloudflare Pages (this website), Apple (Sign in with Apple and App Store payments), and RevenueCat (subscription management). What each receives, briefly:

  • Supabase. Your account (you sign in with Apple) and the Postgres database holding your Etch metadata and seal hashes.
  • Cloudflare R2 & Stream. Stores and delivers your published media (photos, voice, and video), encrypted at rest.
  • Cloudflare Pages. Hosts this website. We do not run Cloudflare Web Analytics.
  • Apple. Handles Sign in with Apple and all Etch Pro payments through your Apple ID. We never see your card details, and we receive only the email Apple shares with you at sign-in.
  • RevenueCat. Manages Etch Pro subscriptions on our behalf. It receives a pseudonymous app user ID and your App Store purchase and subscription status so we can unlock Pro features for your account. RevenueCat does not receive your name, email, or Etch content.

8. Analytics & Tracking

None. We do not include third-party analytics scripts on this website or in the app. No Google Analytics, no Plausible, no Mixpanel, no Posthog. If we ever introduce product analytics in the app, we'll update this page first.

9. Data Deletion

You can delete any individual Etch from inside the app. To delete your entire account, email [email protected] from the address tied to your account. We process backend purges within 24 hours for media; soft-deleted metadata is fully erased within 30 days.

10. Your Rights

You have the right to:

  • Access the data we hold about you. Email us and we'll send a copy within 30 days.
  • Correct inaccurate information. You can update most account details in-app; for anything you can't edit yourself, email us.
  • Delete your account and all associated data, on the timeline described in §9.
  • Port your data. We'll provide a structured export of your Etches and account record on request.
  • Withdraw consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing before withdrawal.
  • Lodge a complaint with a data protection authority. EU and UK residents may complain to their local supervisory authority; California residents have rights under the CCPA, including the right not to be discriminated against for exercising any of the above.

We will never sell or rent your personal data to third parties.

11. Children's Privacy

Etch is intended for users 13 and older (or the local equivalent age of digital consent). We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, email us and we will delete it.

12. Changes to This Policy

We will update the effective date at the top of this page when we make changes. For material changes, we will also notify you in-app the next time you open Etch and (where required by law) by email.

13. Contact

Questions, requests, or anything else: [email protected].

Data controller: Stalwart Crest, Inc., Delaware, USA.