Privacy Policy

1. Controller

The controller responsible for the Service is:

2. What Stays on Your Device and What Does Not

• Your photos: when you take or select a photo in the mobile app, background removal and sticker creation take place on your device. The app stores the resulting photo sticker locally. StickerGrab does not upload that photo to its servers for this process.
• Remote emotes and stickers: when a remote emote needs conversion for WhatsApp, its source URL is sent to StickerGrab’s conversion server. The server fetches and converts the remote file and returns the result to your device. The converted copy is then stored locally.
• Saved packs: if you save a pack while signed in, its name and sticker metadata, including remote image URLs, are stored in our cloud database so the pack can be available to your account. Locally converted files remain on your device.

3. Personal Data We Process

• Account and profile data: account ID, authentication provider, email address, display name, username, profile picture, session information, account dates, and, if supplied, birth date and country code. Apple or Google provides us only with the account data that you authorize it to share.
• Sticker and pack data: pack names, sticker names, source URLs, animation status, ordering, visibility, creation dates, and creator username. Public packs also expose the selected pack and sticker data to other users.
• TikTok retrieval data: the TikTok username you enter, message identifiers associated with retrieved stickers, sticker files, file size and format data, and retrieval status. Product analytics record that a search occurred, but the mobile app does not include the entered TikTok username in that analytics event.
• Usage and device data: app and website events, pages and features used, ad and paywall interactions, subscription status, app version, operating system, device model, language, timestamps, IP address, approximate location derived from IP, advertising or device identifiers where available, diagnostics, crash data, network request data, and structured operational data such as operation status, aggregate item counts, duration, error codes, and opaque account or record identifiers.
• Session replay and feedback data: in the production mobile app, a limited sample of sessions may be recorded to reproduce errors and usability problems. This can include screen content, taps, navigation, and technical context. Fields masked by the replay technology remain masked, but you should not enter sensitive information into free-text fields.
• Account deletion audit data: when you request account deletion, the server records the opaque account ID, processing stage, outcome, and a technical error code if the operation fails. The audit entry does not include your authorization token, profile contents, or sticker contents.
• Purchase data: product, price, currency, purchase and renewal status, trial or subscription status, and store transaction identifiers. Apple or Google processes payment credentials; StickerGrab does not receive your complete card or bank details.
• Communications: your email address and the contents and metadata of messages you send to support.

4. TikTok Usernames and Sticker Catalog

If you use the TikTok retrieval feature on the website, StickerGrab uses the username you submit to find the relevant conversation with StickerGrab’s TikTok account. Retrieved sticker files and related metadata are stored in StickerGrab’s database and content delivery storage. The catalog is readable without signing in, so a person who searches a TikTok username may be able to retrieve the stickers associated with that username. Do not submit another person’s username without their authorization. To request removal from this catalog, email us at [email protected].

5. Purposes and Legal Bases

Where the GDPR applies, we process personal data on the following legal bases:

• Contract (Article 6(1)(b) GDPR): to authenticate you, provide requested sticker creation, retrieval, conversion, storage, sharing, export, subscription, and support features, and administer your account.
• Legitimate interests (Article 6(1)(f) GDPR): to keep the Service secure and reliable, prevent abuse, diagnose errors, verify account deletion operations, understand non-consent-based aggregate usage where permitted, improve features, and establish or defend legal claims. Our interests are operating and improving a safe, functional Service.
• Consent (Article 6(1)(a) GDPR and, where applicable, Section 25 TDDDG): for personalized advertising, access to optional device permissions, and non-essential analytics or device storage where the law requires consent. You may withdraw consent for the future through the available consent or device settings.
• Legal obligations (Article 6(1)(c) GDPR): to keep required transaction records and respond to valid legal requests.

You do not have to create an account or use optional features. Authentication data is required for account-only features, a TikTok username is required for TikTok retrieval, and camera or photo access is required only for the photo you choose to use. If you do not provide the data required for a feature, we cannot provide that feature.

6. Analytics, Advertising, and Similar Technologies

• Amplitude: the mobile app uses Amplitude’s EU endpoint for product analytics. Events can include a pseudonymous installation or device identifier, iOS Identifier for Vendor, platform, subscription status, paywall details, feature interactions, and aggregate TikTok search and save events. The TikTok username entered in search is not included in the mobile analytics event.
• Sentry: the app and website use Sentry for crash and error reporting and technical monitoring. The website may send sampled performance traces; the mobile app additionally sends structured operational logs and a limited sample of session replays. Default personal-data collection is disabled in our Sentry configurations. While you are signed in, the mobile app attaches your opaque StickerGrab account ID so related diagnostics can be correlated. Structured logs use fixed event descriptions and data such as outcomes, aggregate counts, durations, platform, opaque pack IDs, and error codes. Known sensitive attribute names are filtered before a structured log is sent, and these logs are not intended to contain pack or sticker names, TikTok usernames, image URLs, local file paths, tokens, or sticker content.
• Google Mobile Ads: free users may see banner, interstitial, or rewarded ads. Google and its advertising partners may process IP address, device and advertising identifiers, app interactions, diagnostics, consent choices, and approximate location to deliver, limit, secure, and measure ads and, with permission, personalize them. Pro users do not receive these in-app ads.
• Website analytics: the website uses Simple Analytics and Google Analytics to measure visits and usage. Google Analytics may use cookies or similar identifiers and process browser, device, IP-derived location, referrer, page-view, and interaction data. You can also control cookies through your browser and Google’s available opt-out settings.

7. Device Permissions and Local Storage

The mobile app requests camera access when you choose to take a photo and photo-library access when you choose an existing image. You can revoke either permission in your device settings. The app also stores authentication sessions, language preferences, pack caches, and created or converted sticker files locally. Clearing app data or uninstalling the app generally removes local data, subject to your device and backup settings.

8. Recipients and Service Providers

We disclose data only as needed to provide the Service, comply with law, protect rights and security, or complete a business transfer. Our principal providers and integrations include:

• Supabase for authentication, accounts, and cloud database services.
• Cloudflare for content delivery storage and Turnstile abuse prevention.
• Apple and Google for sign-in, app distribution, and in-app purchases.
• Superwall for paywalls, purchase handling, and subscription status.
• Amplitude, Sentry, Simple Analytics, and Google Analytics for analytics, diagnostics, and monitoring.
• Google and its advertising partners for mobile advertising.
• FrankerFaceZ for emote search and source files.
• TikTok and WhatsApp when you use features that interact with or open those services.

These providers process data under their own terms and privacy notices where they act independently. StickerGrab does not sell your personal data for money.

9. International Transfers

Some recipients are established or use infrastructure outside the European Economic Area. Where required, we rely on an adequacy decision, including an applicable EU-US Data Privacy Framework certification, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. You may contact us for more information about the safeguard relevant to a particular transfer.

10. Retention

• Account profiles and account-linked packs are generally kept while your account is active and deleted when you use the in-app account deletion function, except for data we must retain by law or need for legal claims.
• Deleting your account does not cancel an App Store or Google Play subscription, delete files stored locally on your device, or automatically remove entries from the shared TikTok sticker catalog because that catalog is not linked to your StickerGrab account. Contact us to request catalog removal.
• Support correspondence, security and account-deletion audit logs, analytics, diagnostics, transaction records, and backups are kept only as long as needed for their purpose, the configured provider retention period, or a legal requirement. Limited audit and diagnostic records may therefore remain after account deletion so we can verify the deletion, investigate failures or abuse, and establish or defend legal claims. Backup deletion may follow the normal backup rotation rather than occur immediately.

11. Security

We use reasonable technical and organizational measures intended to protect personal data, including authenticated access and database access controls. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

12. Your Rights

Subject to the conditions of applicable law, you may have the right to access, correct, delete, or restrict processing of your personal data; receive data you provided in a portable format; object to processing based on legitimate interests; and withdraw consent at any time for future processing. You also have the right to complain to a data protection authority. The authority responsible for our location is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW). To exercise a right, contact [email protected]. We may need to verify your identity.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has provided personal data, contact us so we can investigate and delete it where appropriate.

14. Automated Decision-Making

StickerGrab does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Advertising providers may use automated systems to select ads, subject to your choices and their privacy notices.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, providers, or law. We will post the revised version here and update the date above. If a change materially affects how we use personal data, we will provide additional notice where required.

16. Contact

For privacy questions or requests, contact [email protected].