Privacy Policy

This is the privacy policy for macOSicons.com. It's meant to be read alongside the Terms of Service and, if you use the API, the API Terms of Service.

1. Who's responsible for your data

macOSicons.com is operated by Elías Ruiz Monserrat, based in Spain, as an individual — I'm the data controller for the personal data described in this policy. This policy explains what I collect, why, who I share it with, and the rights you have over it. It applies to the site, the macOSicons API, and the icon editor.

2. What data I collect

Depending on how you use macOSicons, I collect:

• Account data: your email address and account identifiers, handled through the authentication system that powers sign-in.
• Content you submit: icons and their metadata (name, credit, description), and documents and projects you create in the icon editor. For icons you submit to the library, I also store a short description and tags of the artwork written by an AI model, the reason if I reject one, and moderation records that only I can access: the automated pre-review results and any note I add when rejecting an icon. That note is emailed to you and never shown publicly.
• AI feature inputs: prompts and images you submit to the editor's AI-assisted tools (image generation, chat assistant).
• Payment data: handled entirely by Stripe when you subscribe to a paid plan. I receive confirmation that a payment succeeded and your subscription status, not your full card details.
• Technical and usage data: IP address, browser and device information, pages visited, and error logs, collected automatically as you use the site. API requests are logged with the key used, IP address, user agent, endpoint, and time, for rate-limiting, abuse prevention, and usage metering.
• Public information: your username, display name, profile picture, the icons you submit, and posts on the feedback board are visible to everyone. Your email address is private unless you turn on "show email" on your profile.

3. Why I process your data

• To provide the service you asked for — your account, icon submissions, editor documents, and paid subscriptions — I process your data to perform our contract.
• To keep the service secure and working, monitor and fix errors, review and moderate submitted icons (including automated pre-screening), understand how features are used, and show contextual ads to free users, I rely on my legitimate interest in running and funding macOSicons, balanced against your rights.
• To bill you for a paid plan and keep the records tax law requires, I process data to comply with legal obligations.
• Where I ask for it, I rely on your consent: for analytics that uses cookies or session recording, and for emails about changelog updates. You can withdraw consent at any time from the cookie settings or the unsubscribe link in any email.

4. Who I share your data with

I don't sell your personal data. I share it only with the processors that help me run the service:

• Stripe, to process payments for paid plans.
• AI model providers, accessed through a proxy I run, to power the editor's image-generation and chat features, and to write a short description and tags of each icon submitted to the library, which are used for search and to help me moderate submissions. The specific provider behind a given feature can change as I improve the service; whichever one is in use only receives the prompts and images you submit to that feature, or the artwork of the icon you submitted. I only use providers whose API terms don't allow training on customer prompts, though they may keep prompts briefly for abuse monitoring under their own terms.
• Error monitoring (a self-hosted, Sentry-compatible service), so I can detect and fix bugs. Error reports can include your IP address, browser details, and the page you were on.
• Plausible Analytics, for cookieless, aggregated site statistics, and, only if you accept analytics cookies, Microsoft Clarity, which records how people use the editor: clicks, scrolls, and session replays with the text you type masked.
• Infrastructure providers that host the database, file storage, content delivery network, and search index behind the service, under data processing agreements. A current list is available on request.
• BuySellAds, which serves the contextual ads shown to free users. To serve an ad it receives your IP address and browser details; it doesn't get your account data, and paying members see no ads.
• Apple, if you sign in with Apple. Apple handles that login under its own privacy policy and gives me your name and an email address (or a relay address, if you choose to hide yours).
• An email delivery provider, to send password resets, account emails, and, if you subscribed, changelog and feedback updates.
• TypeSafe (typesafe.ai), which helps me pre-screen icons submitted to the library. It receives the app name and credit you entered, the icon image you submitted (downscaled), the app's description from the catalogue, and the names of categories and of existing apps that might match. It uses the image to check for inappropriate content, whether it is really an app icon (and not, say, a screenshot or a photo), and any written text aimed at a reviewer. It never receives your email address or your account data. It returns probabilities, which my own code uses to sort the review queue into three groups (flagged, needs a look, or looks fine) and to suggest a rejection reason, category, or app. Under its data processing agreement, TypeSafe doesn't use customer data for training. The rest of the pre-screening, a check for similar published icons and a count of your approved and rejected uploads, runs on my own servers and isn't shared. None of these tools approves or rejects anything: I do that myself.

5. Your rights

Under the GDPR, you have the right to access, correct, delete, or export your personal data, to restrict or object to some processing, and to withdraw consent where processing relies on it. To exercise any of these, email me at the address below. If you're not satisfied with how I've handled a request, you can lodge a complaint with your local data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

6. How long I keep your data

I keep your account and content data for as long as your account is active. If you delete your account, I delete your personal data and submissions within 30 days, except where I need to keep something longer: billing records for the period tax law requires (currently four years in Spain, kept via Stripe), and error logs, which are kept for up to 90 days. Moderation records about a submission (its pre-review results, the rejection reason, and any note I sent you) are kept as part of that submission's moderation history. Copies of icons people already downloaded, and caches in third-party integrations, may persist for a while after deletion.

7. International data transfers

Some of the processors listed above (for example, the AI model provider and error-monitoring service) may process data outside the European Economic Area, including in the United States, and TypeSafe and its subprocessors may also process data outside the EEA. Where that happens, I rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to protect your data. TypeSafe's data processing agreement includes those clauses, along with the UK and Swiss equivalents, and its subprocessors are listed at trust.typesafe.ai/subprocessors.

8. Cookies and similar technologies

I use two kinds of cookies and similar storage:

• Strictly necessary, which don't need consent: your login session, your ad-free status, your language and theme, and your cookie choice itself.
• Analytics, only with your consent: Microsoft Clarity, which records how you interact with the editor (clicks, scrolls, and session replays with text inputs masked). You can change your choice at any time from the cookie settings.
• Plausible Analytics is cookieless and only produces aggregate statistics. The ads shown to free users are contextual and don't use tracking cookies.

9. Children's privacy

macOSicons is not directed at children under 14, and I don't knowingly collect personal data from them. If you believe a child has provided me with personal data, contact me and I'll delete it.

10. Changes to this policy

I may update this policy from time to time, for example when I add a new feature or change a processor. When I do, I'll update the date at the top of this page, and for material changes I'll post a notice on the site.

11. Contact

For any question about this policy or to exercise your rights, email me at elias.ruiz.monserrat@gmail.com.