Liveink Privacy Policy

Effective: 2026-10-10 · Last updated: 2026-10-10 · Tiếng Việt

1. Who we are

Liveink ("we", "us") is a drawing app for small groups of close friends. The person responsible for your data (the "controller") is App Dexter Limited, Rm C, 7/F, World Trust Tower, 50 Stanley Street, Central, Hong Kong. Contact for everything in this policy: [email protected].

2. The short version

• You do not need to give us an email, phone number or password. You get a random account and a 6-character invite code. You can optionally link Google or Apple sign-in so you can get your account back on a new phone.
• Your drawings go only to friends you have connected with. There is no public feed and no way for strangers to find you.
• We keep the drawings you send on our server so your friends can receive them and so they appear in your Memories. You can delete your account at any time in the app.
• No sale of data. The Android app shows ads from Google AdMob to people without Liveink Plus; the iPhone app shows none (section 3.12). We use Google Firebase Cloud Messaging to deliver notifications, and (with a switch you control) Google Firebase Analytics for usage statistics that are linked to your account by a pseudonymous user ID, and AppsFlyer to learn whether an ad or an invite brought you here (section 3.9).
• We do not read your address book or your location. The camera is used only inside the app, when you ask for it: to scan a friend's invite QR code on your phone and, where photo mode is available, to take a photo you choose to add to a drawing. It never records in the background (section 12).

3. What we collect and why

3.1 Your account

• Account ID (random), display name (the name you type, up to 24 characters, visible to your friends), invite code (random 6 characters; anyone who has it can see your display name and send you a friend request), the time the account was created and when it was last active (updated about once an hour).
• Access token: a random secret your phone uses to talk to our server. We store only a one-way hash of it.
• Why: to create and run your account, let friends find you by code, and clean up unused accounts.

3.2 Signing in, other devices and recovery

• Sign in with Google or Apple (optional). If you use it, the app obtains a signed identity token from Google or Apple on your phone and sends it to us. We verify it and keep: which provider you used, a one-way keyed hash of your provider user ID, a one-way hash of your email address and a masked version of it (for example a***@gmail.com) so you can recognise which account is linked, and your first name only if it is needed as your starting display name (you can change it). We do not receive your Google or Apple password, contacts, or any other profile data, and we do not keep the token. For Apple we may keep an encrypted Apple token so that your Apple link can be revoked when you unlink or delete your account. You can unlink at any time (as long as you keep another way to get back in).
• Recovery code (optional). You can create a recovery code to move your account to a new phone. We store only a slow one-way hash of the code (plus its first 5 characters to find it). It is shown to you once.
• QR device login. To sign in a second device (for example a tablet or watch) you show a QR code on the new device and approve it on a device that is already signed in. While this is in progress we store, for up to a few minutes, hashes of the one-time codes, the new device's name, platform and app version, and the approximate country of the new device (derived from its IP address by Cloudflare; the IP address itself is not stored in this record).
• Signed-in devices. Each device that signs in gets its own session. We store the session's hashed token, an optional device name (up to 40 characters), platform and app version, created and last-seen times, and an approximate country. You can see and sign out your devices in the app.

3.3 Your profile

• Time zone (for example Asia/Ho_Chi_Minh) and app language (one of the 20 languages the app offers): read from your phone at sign-up. Your time zone dates your Memories, applies your quiet hours and is visible to your friends. Language is used to write notifications in your language.
• Avatar: a colour and optional emoji, visible to friends.
• Profile photo (optional): a picture you choose with your phone's photo picker and crop. The app shrinks it to at most 256 x 256 pixels and our server re-encodes it, which removes hidden picture data (location, camera, date); we never store the original. Only you and your accepted friends can fetch it (there is no public link). Friends' phones keep a cached copy while you are friends. You can remove it at any time. If a friend reports it we keep a copy as evidence for 90 days.
• Birthday (optional): a full date or day and month. Private unless you turn on "Share my birthday".
• Quiet hours (optional), hide my status ("ghost mode"), per-friend nicknames, and your notification and privacy switches (for example "Seen" receipts and showing captions in notifications): private to you; the server reads quiet hours, language and time zone to time and word notifications.

3.4 Your friends

• Your friend list (up to 20 people, a larger limit with Liveink Plus; every connection is mutual), the date you became friends, and an optional shared "since" date either of you can set.
• Your private labels for each friend (nickname, "special person" tag, "muted"): only you see them.
• Friend requests. Nobody becomes your friend without your consent. When someone enters your code or opens your invite link we store a request (who asked whom, when, how, and its state) until you accept, decline, it is cancelled, or it expires after 30 days. Declined, expired or cancelled requests are kept up to 7 more days so they cannot be repeated at once, then deleted. Before you accept, the other person sees only your display name. Declining is never shown to the sender. Your "Who can add me" setting and your invite-link token (which you can reset) are stored with your account.
• Bonds. For each friendship our server counts, without any content, how much you and that friend draw for each other (per day: drawings, draw-backs and first reactions in each direction; per friendship: a level from 1 to 10 that only goes up, the date each level was reached, totals and an optional shared ink colour). Only you and that friend can see it. You can hide it for yourself. Bonds are on by default from age 18 (or if no age is known), off by default at 16-17 (you can switch them on) and always off under 16.
• Relationship status. A relationship type (lover, spouse, crush, best friend, sibling, family, classmate, roommate) needs both people: one asks, the other confirms. We store who asked, its state, the shared "together since" date and when the request expires (30 days). Declining is silent. Either person can end it at any time.

3.5 Your drawings, widgets and backgrounds

A drawing is a set of strokes (points with timing, colour, brush, pressure and symmetry setting), the paper or background style you chose, an optional caption, your display name and the friends you sent it to.

• While you draw, strokes pass through our server to up to 5 selected friends in real time. Others receive the finished drawing.
• Latest drawing: the newest drawing you sent each friend is stored so their app and widget can show it, even if they were offline. The widget itself only displays drawings already on the phone.
• Memories: when a drawing is finished, we file its final version in your Memories (at most 8 per day; the oldest of that day is replaced). Recipients see it in their Memories while you are friends.
• Captions (up to 80 characters of plain text, links and formatting removed) are stored with the drawing and shown to its recipients. They appear on a friend's lock screen only if that friend turned that on (off by default).
• Reactions (an emoji from a short fixed list), draw-back links (a drawing can point to the drawing it answers) and "Seen" receipts (recorded once, only the author sees them; you can switch them off) are stored with the drawing.
• "Miss you" pings are passed on in real time and not stored (only a content-free marker for up to 24 hours to avoid duplicate notifications).

3.5a Photos in drawings

If you add a photo to a drawing (only for people aged 16 and over, which needs your year of birth, kept private), the photo is uploaded to our server, shrunk and re-encoded (location and camera data are removed), encrypted on the server with keys held by us, and shared only with the friends you send the drawing to. This is not end-to-end encryption: we can technically decrypt photos, which is what lets us remove hidden metadata and handle reports. Photos are kept for up to 12 months or until you or the drawing's author delete them, and are deleted with your account. Each account has a storage quota. If a photo is reported we keep an evidence copy for 90 days.

3.6 Online and drawing status

While the app is connected to our server, friends can see that you are online, and while you draw, that you are drawing (unless you hide your status). We keep no history of this and show no "last seen".

3.7 Notification token

After sign-up the app asks Google Firebase Cloud Messaging (FCM) (on iOS, via Apple's push service) for a device token and sends it to us with your platform, app version and language. We use it only to deliver notifications about friend activity and to refresh your widget when the app is closed. The token is registered even if you turn notifications off, because widget refreshes use it too. Messages contain a friend's display name and technical IDs, never the drawing itself (and a caption only if the recipient enabled that).

3.8 Blocks and reports

• Messages: you can send short text messages (up to 1,000 characters) to a friend, on their own or as a reply to a drawing. We store each message (sender, recipient, text, time, when it was read, which drawing it answers) on our server so both of you can read the conversation on any of your devices. Messages are plain text, stored unencrypted on our server (not end-to-end), and are shown only to the two people in the conversation. We keep them until you delete them: you can delete any message for yourself at any time, and the sender can take a message back for both sides within 24 hours. We do not delete messages on a schedule. If you remove or block a friend, the conversation is hidden and cannot be opened by either of you while you are not friends; it comes back if you become friends again. When an account is deleted, every message that account sent or received is deleted from our server, also from the other person's conversation. A friend can report a message to us; we then keep a copy of that message as evidence (see reports below). A setting lets you hide message text from your notifications.
• If you block someone, we store the block, the friendship is removed and neither of you can connect again by code. They are not told.
• If you report a drawing, message, profile photo or person, we store your account ID, the reported account ID, the reason, your optional note (up to 300 characters) and a copy of what was reported as you saw it. A person reviews it. Reports and evidence are kept for 90 days, even if an account is deleted.
• If several different people report the same account within 24 hours, its drawings may be held back for up to 24 hours while we review. We may warn or suspend accounts that break the Terms.

3.9 Security and technical data

• IP address. Our server and Cloudflare (section 6) see the IP address of every connection. We use it to limit abuse (rate limits, temporary blocks).
• Server logs: for each request the time, method, path (no query string), result, duration and IP address; for live connections the first 6 characters of the account ID. Logs never contain your token, drawings or display name.
• Counters per IP address, network range, account or invite code (for example failed code guesses) that expire after 1 minute to 24 hours, and aggregate operational numbers without personal data. The operator may also count totals (for example accounts and drawings per week) from data we already hold to run the service.
• Usage statistics (product analytics). The app counts what is used (for example "a drawing was sent", which brush or paper was chosen, how long a screen was open, which onboarding step was reached, whether a purchase was made) and sends these counts to our server and to Google Firebase Analytics. Events carry a random install ID created by the app, a pseudonymous user ID (a one-way hash of your account ID, never the ID itself) that links the events to your account, your app version, language and country (from your device's region and, on our server, from the connecting network). They never contain your drawings, photos, name, e-mail, friends or the content of anything you send. Our server keeps the raw events for 180 days and daily totals after that.
• Install attribution. AppsFlyer tells us whether you installed Liveink after seeing an ad or following an invite link, so we can spend wisely. On Android it uses the Google Play install referrer (not the advertising ID); on iOS it runs only if you allow tracking in the system prompt: if you decline, it is not started and receives no user ID, no in-app events and no purchase events.
• Your switch. Both are off until you answer our question in the European Economic Area, the United Kingdom and Switzerland, and on by default elsewhere; you can turn each of them off at any time in Settings > Privacy. Turning statistics off stops all three destinations, asks our server to delete the raw events of your install, and resets the analytics identifiers on your phone.

3.10 Purchases and Liveink Plus

Liveink Plus is a paid subscription. Payments are processed entirely by Google Play or the Apple App Store; we never see your card or payment details. We receive only whether your subscription is active (and until when), linked to your account, so we can unlock Plus (all sticker packs and a larger friend list).

3.11 On your phone

The app keeps your access token, friends, latest drawings, history, a Memories cache, unsent drawings, settings and widget data in its private storage. On Android this data is excluded from cloud backup and device-to-device transfer.

3.12 Ads in the Android app

The Android app shows ads served by Google AdMob (Google LLC / Google Ireland Ltd): now and then a full-screen ad at a natural break (after you send a drawing, when you come back to the app, when you close your history), an ad card between drawings in your history, and, only when you choose it, a short video ad that unlocks a sticker pack for 24 hours. Liveink Plus subscribers see no ads, and the iPhone app shows none. Ads are limited to content rated for teens.

To show and measure ads, Google's SDK in the app collects your device's advertising ID, IP address, device and app information and your interactions with ads, under Google's own policy. Ads are never based on your drawings, messages, photos, friends or name, and we give Google none of them. In the European Economic Area, the United Kingdom and Switzerland, Google's consent form asks you first whether ads may be personalised, and Settings > Privacy > Ad privacy choices lets you change your answer at any time. Everywhere, you can reset or delete your advertising ID in your phone's settings (Android: Settings > Privacy > Ads) to stop personalised ads.

4. What we do not collect

No access to your address book (if you pick one contact to send an invite, the system picker gives the app only that one name and phone number, which stay on your phone and are used only to open a message), no location (your time zone is not a location), no microphone, no sale of personal data (analytics and attribution: section 3.9, with a switch; ads in the Android app: section 3.12). The app does not get access to your photo library: where it needs a picture you hand over only the single picture you choose. The camera is used only inside the app, when you ask for it, to scan QR codes and (optionally, where photo mode is available) to take a photo for a drawing (section 12): there is no background recording, and a photo you take is uploaded only if you add it to a drawing you send.

5. Who can see what

6. Who we share data with

We do not sell or rent personal data. In the Android app, Google AdMob collects the advertising data described in section 3.12 directly from your phone to show and measure ads (not for Plus subscribers). If you allow tracking in the iOS system prompt, AppsFlyer uses the attribution data described below only to measure our own ad campaigns. Service providers process data on our behalf:

• Cloudflare, Inc.: our service sits behind Cloudflare. Cloudflare terminates the HTTPS connection and passes traffic on to our server, so it technically sees all traffic between the app and our server (including drawings) and your IP address, and tells us the approximate country of a connection.
• Google LLC / Google Ireland Ltd (Firebase Cloud Messaging): receives your device token and the notification messages described above, and uses a Firebase installation identifier to deliver them. With your consent (section 3.9) Google Firebase Analytics receives the pseudonymous usage events described there (linked to your account by the user ID) and AppsFlyer Ltd receives the install-attribution data (on iOS only if you allow tracking); advertising-ID collection stays off for Firebase. Google ML Kit (the barcode-scanning library inside the Android app) reads QR codes on your phone with a model bundled in the app; camera images are not sent to Google, but the library may send Google technical diagnostics such as performance figures and an installation identifier. Google Play also tells the app, once after installation from Google Play, the referrer text of the link you installed from (section 12). Apple delivers notifications on iOS.
• Google AdMob (Android app only, not for Plus subscribers): the advertising data in section 3.12, as an independent controller under Google's policies.
• Google and Apple sign-in: only if you choose it (section 3.2), under their own privacy policies.
• Hosting provider: our server and database run on a server rented from OVHcloud.
• Authorities: we may disclose data if the law requires it, only what is required.

7. Where your data is stored

Our server is located in Canada. If you use Liveink from Vietnam or another country, your data is transferred to and stored in that country. Cloudflare and Google may process data in data centres around the world.

8. How long we keep data

Cloudflare and Google keep their own logs under their own policies.

9. Security

• The connection between the app and Cloudflare is encrypted with HTTPS/TLS. The hop from Cloudflare to our server is currently plain HTTP over the public Internet (we have not installed an origin certificate yet), so your traffic is not encrypted on that last leg; we will update this section when it is. Tokens, recovery codes and sign-in identifiers are stored only as one-way hashes. Access to the server is limited to the operator.
• Drawings and profile data are not end-to-end encrypted and are not separately encrypted at rest. Deleting your account overwrites the deleted records in our live database (with the current SQLite configuration); copies in our backups are removed when those backups expire (section 8).
• No method is 100% secure. If a breach affects you we will tell you and the authorities as the law requires.

10. Your choices and rights

Depending on where you live (including under Vietnam's Personal Data Protection Law No. 91/2025/QH15), you can:

• See and correct your data: your name, profile, friends and drawings are in the app. For anything else, email us.
• Delete your account (section 11), a single memory, a profile photo, or a friend.
• Withdraw consent / object: stop using the app and delete your account; turn notifications off in your phone settings; unlink Google or Apple; hide your status; switch off "Seen" receipts.
• Get a copy: there is no automatic export yet. You can save or share any drawing you can open as an image. To request a copy of the data we hold about you, email us.
• Complain to your data protection authority (in Vietnam: the Ministry of Public Security, Department of Cybersecurity and High-Tech Crime Prevention, A05).

Because we usually do not know your email or phone number, we may ask for your display name and invite code (and other details from the app) to confirm that a request comes from the account holder.

11. Deleting your account

• In the app: open Settings, scroll to the bottom, tap Delete account, then confirm. It takes effect immediately. A step-by-step page is at https://liveink.app/delete-account.
• Without the app: email [email protected] from any address with your display name and invite code.
• Deleted from our server: your account, name, invite code, tokens, profile and profile photo, friendships and labels, drawings you sent and received as latest drawings, your Memories, reactions and receipts, every message you sent or received (also from your friends' conversations), bonds, notification tokens, devices and sessions, recovery code, Google/Apple/email links (and, where configured, Apple is told to revoke the link), and live state. Your friends' apps are told you are no longer their friend.
• What remains: drawings your friends already received may stay on their phones (history, widgets, saved images, screenshots); drawings friends sent you stay in their own Memories; reports involving you for up to 90 days; server logs until they rotate; Cloudflare and Google's own logs.

12. App permissions

• Internet, and notifications (optional).
• Android foreground service (data sync): while you use the app it keeps a live connection so drawings appear immediately; Android shows a notification while it runs.
• Run at startup (Android): only to redraw your widget from drawings already on the phone. It does not connect to our server.
• Camera (Android and iOS, optional, asked when you first use it): used only inside the app and only when you ask for it. (1) Scan QR: the app shows a live camera preview and a friend's invite code is recognised on your phone, frame by frame (on Android with a barcode model bundled in the app, on iOS with the system scanner); no picture or video is recorded, saved or uploaded and only the text of the code is used. You can use the app without it: pick a QR picture from your photos or type the 6-character code instead. (2) Photo for a drawing (where photo mode is available): a picture is taken only when you press the shutter; it is uploaded only if you add it to a drawing and send it (see photos in drawings, section 3.5a, where it applies). The camera never records video or runs in the background.
• Install referrer (Android, Google Play installs only): the first time the app starts after being installed from Google Play, it asks Google Play for the referrer text of the link you installed from. If that text contains a valid 6-character invite code, the app offers to add that friend; nothing else is kept and the text is not sent to us.
• Contact picker (optional): when you invite someone by message, the system contact picker hands the app only the one name and phone number you choose; they are used on your phone to open the message and are not uploaded.
• Which messengers are installed (Android): to show direct "invite through ..." buttons the app checks on your phone whether a few messenger apps (for example Messenger, Zalo, WhatsApp, Telegram, Viber) are installed. The result stays on your phone.
• QR code from a photo / profile photo / photos in drawings: the system photo picker lets the app read only the one picture you choose. QR pictures are read on the phone and not uploaded or kept; only the invite code in them is used.

13. Children

Liveink is for people aged 16 and over. We do not knowingly allow younger children to use it. If a birth year that makes an account younger than the minimum age is given to our service, the account is refused. If you believe a child under 16 uses Liveink, email us and we will delete the account.

14. Changes to this policy

We will post changes on this page and update the date above. If a change is important we will also tell you in the app where practical.

15. Contact

[email protected] · App Dexter Limited, Rm C, 7/F, World Trust Tower, 50 Stanley Street, Central, Hong Kong.