Privacy Policy

This Privacy Policy explains how Status & Sticker Hub ("the Application," "we," "us," or "our"), developed and maintained by Odoi Jethro in Uganda, handles personal data, device information, and content when you use our mobile application.

We are committed to the highest standards of user privacy, transparency, and data protection. We operate under a strict data minimization principle: we only process data strictly necessary to provide the features you explicitly choose to use.

Status & Sticker Hub is a multi-utility mobile application providing:

1. WhatsApp Status Viewing & Saving: A local viewer and saver for user-accessible WhatsApp status media using Android's Storage Access Framework.
2. Custom Sticker Studio: On-device image and video editing tools to create custom static and animated stickers.
3. WhatsApp Sticker Integration: Local export of sticker packs to WhatsApp via an Android Content Provider.
4. Text Status Studio: On-device design of typographic status cards and posters.
5. GIF Sticker Search & Conversion: In-app discovery of animated GIFs via third-party API and conversion into WhatsApp-compatible animated stickers.
6. Type Master Arcade Minigame: An interactive typing game with local gameplay (Guest Mode) and optional user accounts with global leaderboard rankings.

• 100% Free of Charge: The Application is completely free to download and use. There are no paid subscriptions, in-app purchases, paid downloads, or paywalls.
• Zero Advertising: The Application contains zero advertisements, no advertising SDKs, no ad trackers, and no ad-targeting frameworks.
• No Sale of Personal Data: We do not sell, rent, monetize, or trade your personal data or user-generated content to any third party under any circumstances.

The following data categories are processed strictly on your device and are never transmitted to our servers or stored in our cloud infrastructure:

1. WhatsApp Status Media:

• What is processed: Images (.jpg) and videos (.mp4) located in your device's WhatsApp status folder.
• How it works: Access is granted solely when you explicitly select the status directory through the Android system directory picker (Storage Access Framework). The Application reads these files locally to display previews. If you choose to save a status, a copy is written directly to your device's public Downloads/StatusHub folder.
• Remote Transmission: None.

1. User-Created Stickers & Media Assets:

• What is processed: Images, videos, background cutouts, drawings, captions, and sticker pack metadata (Pack Name, Author Name) created in the Sticker Editor.
• How it works: All image processing (cropping, flood-fill background erasing, outlines, WebP encoding) occurs on your device using on-device graphics processing. Sticker files are stored in the Application's private internal storage (context.filesDir/stickers/) and indexed in a local SQLite/Room database.
• Remote Transmission: None.

1. WhatsApp Sticker Export:

• What is processed: Local sticker WebP files and metadata provided to WhatsApp when you tap "Add to WhatsApp."
• How it works: Data is shared directly on-device with the WhatsApp application (com.whatsapp and com.whatsapp.w4b) through a secured Android Content Provider (StickerContentProvider) protected by WhatsApp's read permission (com.whatsapp.sticker.READ).
• Remote Transmission: None.

1. Text Status Poster Designs:

• What is processed: Custom text, background selections, typography parameters, and rendered poster images created in the Text Post Studio.
• How it works: Rendered locally on device canvas and saved to your device's Downloads/TextPosts directory upon your explicit request.
• Remote Transmission: None.

1. Local Preferences and Settings:

• What is processed: Application theme preference (System Default, Light, Dark), minigame sound effects toggle, minigame haptic feedback toggle, selected keyboard audio profile, and last used publisher name.
• How it works: Stored locally in Android SharedPreferences.
• Remote Transmission: None.

Certain optional or connected features require communication with third-party service providers:

1. Type Master Minigame — Authentication (Optional)

• Data Collected: Email address, user-chosen password hash, display name / username, and system-generated Firebase User Identifier (UID).
• Source: Provided directly by you when you choose to register an account or log in to sync scores.
• Service Provider: Google Firebase Authentication (Google LLC).
• Purpose: User authentication, account recovery, session security, and associating your high scores on the global leaderboard.
• Storage Location: Secure Google Cloud infrastructure (United States / European Union).
• Note: Account registration is entirely optional. You can play the game fully in Guest Mode without providing an email address or password.

2. Type Master Minigame — Global Leaderboards

• Data Collected: User ID (Firebase UID), display name / username, score, words per minute (WPM), challenge stages cleared, run duration in seconds, selected difficulty (EASY, NORMAL, HARD), and server timestamp.
• Source: Generated automatically upon completing an arcade run while authenticated.
• Service Provider: Google Cloud Firestore (Google LLC).
• Purpose: Displaying global rankings and high scores to other players.
• Public Visibility: Leaderboard entries (display name, score, WPM, stages cleared, time) are publicly readable by other users within the Application's leaderboard interface.
• Storage Location: Secure Google Cloud infrastructure.

3. GIF Sticker Factory — Search & Trending

• Data Processed: Search terms typed into the GIF search bar, HTTP User-Agent, and temporary network transmission data.
• Service Provider: Klipy API (https://api.klipy.com).
• Purpose: Retrieving GIF search results and trending animated media for conversion into WhatsApp stickers.
• Local Caching: Selected GIF files are downloaded temporarily to your device's temporary cache directory (context.cacheDir) for conversion and are deleted immediately after processing or purged automatically within 24 hours by a background maintenance worker.

4. Downloadable Fonts

• Data Processed: Font requests.
• Service Provider: Google Fonts via Google Play Services (com.google.android.gms.fonts).
• Purpose: Rendering typography styles in the Text Post and Sticker studios without bundling large font files in the app package.

We work with trusted third-party service providers who process data in accordance with strict confidentiality and security standards:

The Application requests only the minimal permissions required for its functionality:

1. android.permission.INTERNET: Required to connect to Firebase Authentication, Cloud Firestore leaderboards, and the Klipy GIF search API.
2. android.permission.ACCESS_NETWORK_STATE: Required to detect network availability before attempting online operations.
3. Storage Access Framework (Scoped Storage URI Grant): Used to read WhatsApp status media. You explicitly grant access to the specific .Statuses folder via the Android system directory picker. The Application does not request legacy broad storage permissions (READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE).
4. MediaStore API: Used to save exported stickers, saved statuses, and generated text posters to public folders (Downloads/StatusHub and Downloads/TextPosts) without requiring broad storage access.

For users governed by the Data Protection and Privacy Act, 2019 of Uganda, we process personal data under the following lawful bases:

1. Consent (Section 7 & 8): You provide informed, voluntary consent when registering an account, submitting high scores to the global leaderboard, or granting folder access via the Storage Access Framework.
2. Performance of a Contract / Service Request (Section 7(2)(b)): Processing authentication credentials and score records is necessary to provide the user-requested online features of the Application.
3. Legitimate Interests & Functional Necessity: Processing ephemeral search queries is necessary to return requested GIF search results.

Status & Sticker Hub originates from Uganda. When you use online features (such as creating an account, syncing scores to the leaderboard, or searching GIFs), your data is transmitted securely to cloud infrastructure operated by Google LLC and third-party content providers located in the United States of America or the European Union.

In accordance with Section 19 of the Uganda Data Protection and Privacy Act, 2019:

• All cross-border data transfers are encrypted in transit using industry-standard Transport Layer Security (TLS/HTTPS).
• Data processors (such as Google Cloud) maintain robust technical and organisational security measures, international certifications (e.g., ISO/IEC 27001, SOC 2/3), and contractual data protection commitments.
• By registering an account and using online features, you consent to the cross-border transfer of your account and leaderboard data for the specific purposes described in this policy.

We adhere to the principle of storage limitation under Ugandan law and Google Play policies:

• Account Data (Email, Display Name, UID): Retained in Firebase Authentication for as long as your account remains active. Deleted immediately upon your request or in-app account deletion.
• Leaderboard Score Data: Retained in Cloud Firestore for as long as your account remains active or until replaced by a higher score. Purged completely across all game difficulties upon account deletion.
• Temporary GIF Cache: Ephemeral files in context.cacheDir are deleted immediately after conversion or pruned within 24 hours by CachePruningWorker.
• Local Stickers & Preferences: Retained locally on your device until you delete the stickers within the app, clear the Application's storage, or uninstall the Application.
• Saved Statuses & Text Posters: Stored in your device's public Downloads directory under your sole control.

In compliance with Google Play User Data Policies and Section 24 of the Uganda Data Protection and Privacy Act, 2019, we provide full control over your account and associated data.

In-App Account Deletion

You can permanently delete your account and all associated cloud data directly inside the Application:

1. Open the Minigame tab (Tab 4).
2. Tap your Typist Profile chip at the top left of the screen.
3. Select Delete Account & Data.
4. Enter your account password to confirm ownership.
5. Tap Permanently Delete.

What Happens During Deletion:

• Your login credentials, email address, and UID are permanently removed from Firebase Authentication.
• All your high scores, speed records, and leaderboard entries across all difficulty levels (EASY, NORMAL, HARD) are permanently deleted from Cloud Firestore.
• Your local authentication session is cleared.
• This action is immediate, permanent, and irreversible.

External / Web Deletion Request

If you have uninstalled the Application or cannot access your device, you can request account and data deletion via our dedicated web resource:

• Account Deletion Portal: /legal/stickers-and-status-hub/account-deletion
• Privacy Contact Email: odoijethro21@gmail.com

Requests submitted via email will be verified and processed within 30 business days.

Under the Uganda Data Protection and Privacy Act, 2019, you have the following rights regarding your personal data:

1. Right of Access (Section 18): You have the right to request confirmation and a copy of the personal data we hold about you.
2. Right to Rectification (Section 24): You have the right to update or correct inaccurate personal data (such as changing your display name).
3. Right to Erasure / Deletion (Section 24): You have the right to have your personal data permanently erased from our systems.
4. Right to Object to Processing (Section 25): You have the right to object to the processing of your personal data or withdraw consent at any time without affecting prior lawful processing.
5. Right to Lodge a Complaint (Section 31): You have the right to lodge a formal complaint with the national supervisory authority:

• Personal Data Protection Office (PDPO) — Uganda
• National Information Technology Authority – Uganda (NITA-U)
• Website: https://www.pdpo.go.ug
• Email: info@pdpo.go.ug

To exercise any of your rights, please submit a request to odoijethro21@gmail.com.

Status & Sticker Hub is a general-audience utility and casual gaming application. The Application is not directed at children under the age of 13 (or under 18 under Ugandan legal minority provisions without parental guidance).

We do not knowingly solicit or collect personal data from children under 13. If we discover that an account has been registered by a child under 13 without verified parental consent, we will promptly delete the account and associated leaderboard records from our servers. Parents or guardians who believe their child has provided personal data may contact us at odoijethro21@gmail.com.

We implement robust technical and organisational security measures to protect your information:

• Encryption in Transit: All network communication with Firebase and third-party APIs is strictly enforced over HTTPS / TLS 1.3 / TLS 1.2 with system trust anchors (configured via Android Network Security Configuration; cleartext HTTP traffic is explicitly disabled).
• Access Control: Firebase Firestore security rules restrict write operations to authenticated users for their own score records.
• Principle of Least Privilege: Exported Content Providers strictly validate the calling package identity (com.whatsapp and com.whatsapp.w4b) and deny unauthorized external access.
• On-Device Sandbox: Local sticker files and database entries are stored in Android application-sandboxed internal storage inaccessible to other installed applications.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Developer / Controller: Odoi Jethro
• Location: Kampala, Uganda
• Direct Email: odoijethro21@gmail.com
• Official Website: https://www.odoijethro.com
• Privacy Policy URL: https://www.odoijethro.com/legal/stickers-and-status-hub/privacy-policy