Privacy Policy

This is the privacy policy for macOSicons.com. It's meant to be read alongside the Terms of Service and, if you use the API, the API Terms of Service.

1. Who's responsible for your data

macOSicons.com is operated by Elías Ruiz Monserrat, based in Spain, as an individual — I'm the data controller for the personal data described in this policy. This policy explains what I collect, why, who I share it with, and the rights you have over it. It applies to the site, the macOSicons API, and the icon editor.

2. What data I collect

Depending on how you use macOSicons, I collect:

• Account data: your email address and account identifiers, handled through the authentication system that powers sign-in.
• Content you submit: icons and their metadata (name, credit, description), and documents and projects you create in the icon editor.
• AI feature inputs: prompts and images you submit to the editor's AI-assisted tools (image generation, chat assistant).
• Payment data: handled entirely by Stripe when you subscribe to a paid plan. I receive confirmation that a payment succeeded and your subscription status, not your full card details.
• Technical and usage data: IP address, browser and device information, pages visited, and error logs, collected automatically as you use the site. API requests are logged with the key used, IP address, user agent, endpoint, and time, for rate-limiting, abuse prevention, and usage metering.
• Public information: your username, display name, profile picture, the icons you submit, and posts on the feedback board are visible to everyone. Your email address is private unless you turn on "show email" on your profile.

3. Why I process your data

• To provide the service you asked for — your account, icon submissions, editor documents, and paid subscriptions — I process your data to perform our contract.
• To keep the service secure and working, monitor and fix errors, understand how features are used, and show contextual ads to free users, I rely on my legitimate interest in running and funding macOSicons, balanced against your rights.
• To bill you for a paid plan and keep the records tax law requires, I process data to comply with legal obligations.
• Where I ask for it, I rely on your consent: for analytics that uses cookies or session recording, and for emails about changelog updates. You can withdraw consent at any time from the cookie settings or the unsubscribe link in any email.

4. Who I share your data with

I don't sell your personal data. I share it only with the processors that help me run the service:

• Stripe, to process payments for paid plans.
• AI model providers, accessed through a proxy I run, to power the editor's image-generation and chat features. The specific provider behind a given feature can change as I improve the editor; whichever one is in use only receives the prompts and images you submit to that feature. I only use providers whose API terms don't allow training on customer prompts, though they may keep prompts briefly for abuse monitoring under their own terms.
• Error monitoring (a self-hosted, Sentry-compatible service), so I can detect and fix bugs. Error reports can include your IP address, browser details, and the page you were on.
• Plausible Analytics, for cookieless, aggregated site statistics, and, only if you accept analytics cookies, Microsoft Clarity, which records how people use the editor: clicks, scrolls, and session replays with the text you type masked.
• Infrastructure providers that host the database, file storage, content delivery network, and search index behind the service, under data processing agreements. A current list is available on request.
• BuySellAds, which serves the contextual ads shown to free users. To serve an ad it receives your IP address and browser details; it doesn't get your account data, and paying members see no ads.
• Apple, if you sign in with Apple. Apple handles that login under its own privacy policy and gives me your name and an email address (or a relay address, if you choose to hide yours).
• An email delivery provider, to send password resets, account emails, and, if you subscribed, changelog and feedback updates.

5. Your rights

Under the GDPR, you have the right to access, correct, delete, or export your personal data, to restrict or object to some processing, and to withdraw consent where processing relies on it. To exercise any of these, email me at the address below. If you're not satisfied with how I've handled a request, you can lodge a complaint with your local data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

6. How long I keep your data

I keep your account and content data for as long as your account is active. If you delete your account, I delete your personal data and submissions within 30 days, except where I need to keep something longer: billing records for the period tax law requires (currently four years in Spain, kept via Stripe), and error logs, which are kept for up to 90 days. Copies of icons people already downloaded, and caches in third-party integrations, may persist for a while after deletion.

7. International data transfers

Some of the processors listed above (for example, the AI model provider and error-monitoring service) may process data outside the European Economic Area, including in the United States. Where that happens, I rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to protect your data.

8. Cookies and similar technologies

I use two kinds of cookies and similar storage:

• Strictly necessary, which don't need consent: your login session, your ad-free status, your language and theme, and your cookie choice itself.
• Analytics, only with your consent: Microsoft Clarity, which records how you interact with the editor (clicks, scrolls, and session replays with text inputs masked). You can change your choice at any time from the cookie settings.
• Plausible Analytics is cookieless and only produces aggregate statistics. The ads shown to free users are contextual and don't use tracking cookies.

9. Children's privacy

macOSicons is not directed at children under 14, and I don't knowingly collect personal data from them. If you believe a child has provided me with personal data, contact me and I'll delete it.

10. Changes to this policy

I may update this policy from time to time, for example when I add a new feature or change a processor. When I do, I'll update the date at the top of this page, and for material changes I'll post a notice on the site.

11. Contact

For any question about this policy or to exercise your rights, email me at elias.ruiz.monserrat@gmail.com.