Your data, handled with care

This Privacy Policy explains what personal data Edok Studio (“Edok Studio”, “we”, “us”) collects when you visit our website or use our product, why we collect it, how we use it, and the choices you have. We’re a design studio for app-store screenshots and metadata — we work with the designs and assets you create, not your customers’ data.

By using Edok Studio you agree to this policy. If anything here is unclear, email admin@edokstudio.com and we’ll explain in plain English.

We collect only what we need to operate the service.

• Account data — name, email address, hashed password (or third-party identity provider claims), workspace name. Captured when you sign up or invite teammates.
• Billing data — payments are processed by Paddle. We store the resulting invoice metadata (amount, currency, plan, status) but never your raw card or wallet details.
• Usage data — pages visited, features used, error reports and performance metrics so we can debug issues and improve the product.
• Workspace data — projects and screenshot designs you create, images you upload, generated metadata & translations, AI-prompt history.
• Technical metadata — IP address, browser/user-agent, device type, language, time zone — collected on every request for security and abuse-prevention purposes.

We use your data to:

• Provide, maintain and improve the service.
• Authenticate you and protect your account from abuse.
• Process payments and send invoices via our payment partners.
• Send transactional emails (password resets, plan changes, invoices).
• Send product announcements if you opt in (you can unsubscribe at any time using the link in every email).
• Diagnose technical issues, prevent fraud, and meet legal obligations.

We do not sell or rent your personal data to anyone, ever.

We use a minimal number of cookies and similar technologies:

• Essential cookies — to keep you logged in, persist your workspace choice, and maintain CSRF protection. The product won’t function without these.
• Analytics — privacy-respecting aggregate analytics to understand which features are used and where users get stuck. No cross-site tracking.

We do not use third-party advertising trackers. Most browsers let you block cookies in settings; if you block essential cookies, the product won’t work.

If you create smart links, people who tap them reach a page on your project’s own address before being sent to your app, the App Store, the Play Store, or your website. For each of those taps we record the date and time, the device platform (iOS, Android or desktop), the two-letter country our network provider reports, the site the visitor came from, and a shortened browser identification string.

We keep that record so you can see how a link performed. We do not store the visitor’s IP address, set any cookie on the redirect page, use advertising identifiers, or attempt to identify or fingerprint an individual device — and we never combine this data across different customers’ links.

Because these are your visitors, you are the data controller for this information and we process it on your behalf. If your links are aimed at people in the EU/UK, your own privacy notice should cover it.

Tap-level records are deleted on a schedule set by your plan: after 7 days on Free and 90 days on Pro. On Pro Plus they are kept until you delete the link or the project. The running total shown next to each link is a counter, not a record of individuals, and is kept for the life of the link. Deleting a link or a project deletes its tap records with it.

We share data only with vetted sub-processors that help us deliver the service. Each one is bound by a data-processing agreement.

• Paddle — billing & tax compliance for all payments.
• Cloud hosting — to run our servers, databases, and backups.
• Email delivery — to send transactional emails.
• Cloud storage (Cloudflare R2) — to store the images and assets you upload to the editor.
• AI inference providers — to power AI metadata & translations. We send only the minimum context needed; providers do not retain your prompts for training where opt-out is offered.

We may also disclose data when required by law or to protect rights, property, or safety.

Data is encrypted in transit (TLS) and at rest. Access to production databases is restricted to a small set of engineers and audited. We run regular backups and have a documented incident-response process.

We retain account data while your account is active and for a reasonable period afterwards to support account recovery, comply with legal obligations, and resolve disputes. Workspace data is deleted when you delete your workspace, subject to a brief backup-retention window.

Depending on your location (notably the EU/UK under GDPR, California under CCPA), you have rights including:

• Access — request a copy of the personal data we hold about you.
• Correction — fix inaccurate data.
• Deletion — delete your account and associated personal data.
• Portability — receive your data in a machine-readable format.
• Object / restrict — opt out of specific processing activities.
• Withdraw consent — for processing based on consent.

To exercise any of these, email admin@edokstudio.com. We’ll verify your identity and respond within 30 days.

Edok Studio operates globally. Data may be stored or processed in countries other than the one where you live, including outside the EU/UK. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) for transfers out of the EEA.

Edok Studio is not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe we have, contact us and we’ll delete it.

We may update this Privacy Policy. We’ll post the new version on this page and update the “Last updated” date. Material changes will also be communicated by email to registered users.

For privacy-related questions, data-rights requests, or anything else covered by this policy, write to admin@edokstudio.com. For general support questions, use our contact form.