Privacy Notice

Last updated: 27 May 2026

Mysticman Productions is designed to be privacy-respecting: your images and artwork stay on your computer. Our apps only reach the Internet to verify your paid licence — and even then they never see what you are painting or creating.

1. Data Controller

Mysticman Productions · info@mysticmanproductions.it (acting as data controller under Regulation (EU) 2016/679 — "GDPR").

2. Data processed locally

Our apps process only what is strictly necessary for them to work, and exclusively on your device:

• Images you load (PNG, JPG, BMP, TIFF, WebP) — read from disk, processed in memory, never uploaded.
• Application settings (slider values, palette choice, PDF options) — stored in a JSON file inside your OS standard user-data directory (%APPDATA%\Mysticman Productions\ on Windows, ~/Library/Application Support/PaintByNumbers Studio/ on macOS).
• Palette files you voluntarily import or export.

3. Licence verification (paid version only)

When you enter a licence key the app contacts our activation server, and afterwards re-validates the licence roughly every two weeks. Each call sends only:

• the licence key itself;
• an anonymous hardware fingerprint — a one-way SHA-256 hash derived from your computer's platform UUID, so the same PC always produces the same value but the original ID cannot be recovered;
• the validation request itself (no body beyond the two values above).

Your name, email and payment data are handled by Creem.io, our merchant of record, which acts as an independent data controller for the purchase transaction. See creem.io/legal/privacy for details.

If you never activate a licence, no licence-related data ever leaves your computer.

4. What the apps do NOT do

• They do not upload your images, palettes, settings or PDFs to any server.
• They do not include telemetry, analytics or crash reporting.
• They do not register accounts, ask for login credentials, or read contacts / location / camera.
• They do not share any data with the developer or any third party beyond the licence verification described above.

5. Communications you initiate

If you write to info@mysticmanproductions.it, the email content (including your address and any data you share) will be processed by the Licensor for the sole purpose of answering you. The legal basis is performance of your request (Art. 6(1)(b) GDPR) and our legitimate interest in providing support (Art. 6(1)(f) GDPR). Emails are retained only as long as needed to handle your request.

6. Your rights (EU/UK users)

Under the GDPR (and UK GDPR for UK users) you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it). To exercise these rights, write to the email above.

7. Changes to this notice

Material changes will be reflected by updating the date at the top. Please re-read it periodically.