Last updated 21 September 2026

Privacy Policy

KandiCon is an app for making bead patterns and sharing what you make. This page says exactly what we keep, where it is kept, and how to get rid of it.

The short version

• We never sell your information, and we never hand it to advertisers.
• There are no ads and no ad networks in KandiCon.
• We use no advertising or marketing SDKs and do not track you across other apps or websites. The Android app does include two Google components, Firebase Cloud Messaging for notifications and ML Kit for on-device image processing, and they are described below.
• KandiCon is for people aged 13 and up.
• There are no passwords. We could not leak one if we tried, because we never have one.
• You can delete your account yourself, in the app or by email.

How signing in works

KandiCon is passwordless. You type your email address, we email you a 6-digit code, and you type the code back. That is the whole thing. You can also use Sign in with Apple, including Apple's hide-my-email option, in which case we only ever see the forwarding address Apple gives us.

The code itself is never stored in a readable form and it stops working after 10 minutes or after five wrong guesses. Your email address is stored so that the same address always brings you back to the same account.

What we store

Your account

• Your email address, or your Sign in with Apple identifier, used to get you back into your account.
• Your profile: handle, display name, bio, avatar emoji and avatar photo if you add one.
• When the account was made and last changed, and whether it is active, suspended or deleted.

What you make and share

• Patterns — the title, category, grid size and the pattern itself, plus any source photo or finished-piece photo you attach.
• Posts — the text, and the photo or video on them, plus the video's thumbnail.
• Comments you write, and likes you give.
• Follows — who you follow and who follows you.
• Direct messages — the text, who sent it, who it went to, and whether it has been read.
• Tutorials and events, if you write or submit one.

Keeping the app safe

• Reports — what you reported, the reason you gave and any detail you typed.
• Blocks — who you have blocked. This is kept on our side so a block survives you getting a new phone.
• A record of moderator actions, so we can show our working if something is questioned.

If a post, comment or message makes us think someone might hurt themselves, someone on the KandiCon team may send that person a private message to check in. If we believe someone is in danger right now, we may share what emergency services need to reach them. We do not share it with anyone else.

Notifications

If you turn notifications on, we store the notification token your phone gives us, along with your app version, language and time zone so alerts arrive at a sensible hour. Turn notifications off and the token is removed.

On iPhone and iPad, notifications are delivered by Apple's push service. On Android they are delivered by Google Firebase Cloud Messaging. Firebase issues the push token and a Firebase Installation ID for the app on your phone, and Google keeps delivery logs for the messages it carries.

Photos you turn into patterns (Android)

When you cut the background out of a photo on Android, KandiCon uses Google ML Kit through Google Play services. The image segmentation runs on your device and the photo is not sent to Google, but Google may receive information about the device and the app, and performance metrics about how ML Kit ran.

If you buy beads

Payment is handled by Stripe on Stripe's own checkout page. KandiCon never sees or stores your card number. What comes back to us is the order: what was bought, the amount, the email address you gave Stripe, and the name and shipping address the parcel goes to. We keep that so we can actually send you your beads.

What is public, and what is not

This part matters, so it is spelled out plainly. Public by design, visible to anyone using the app: your handle, display name, bio and avatar; your posts and the photos or video on them; your comments; your patterns when you share them; and who you follow.

Not public: your email address, and your direct messages, which are only seen by you and the person you sent them to. Moderators can look at reported content, including a reported message, when checking a report.

Please treat a post like a poster in a school corridor. Don't put your address, your school, your phone number or your last name on it.

Where your information lives

KandiCon runs on Cloudflare. The database is Cloudflare D1, photos and video are in Cloudflare R2, and notification tokens are in Cloudflare KV. Everything travels encrypted.

The other companies involved are:

• Cloudflare — hosting, database, file storage, and the email service that sends sign-in codes.
• Stripe — payments, if you buy beads.
• Apple — Sign in with Apple if you use it, and notification delivery to iPhone and iPad.
• Google Firebase Cloud Messaging — notification delivery to Android phones (push token, Firebase Installation ID and delivery logs).
• Google ML Kit, through Google Play services — on-device image segmentation on Android (device and app information and performance metrics may go to Google).

That is the complete list.

Age requirement and parents

KandiCon is for people aged 13 and up. It is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that an account belongs to someone under 13, we delete the account, along with its content, photos, video and sign-in details. If you think a child under 13 is using KandiCon, email alexander@uniquephoto.com with the handle and we will act on it.

If you are the parent of a teenager who uses KandiCon, here is what you should know.

• Profiles, posts and comments are public inside the app. Anyone with KandiCon can see them.
• The app has direct messages, so makers can message each other.
• Every post, comment, profile and chat has a Report button and a Block button. Reports go to a real person and are acted on.
• We can hide a post, comment, pattern or message, and suspend an account, from our side. Our child safety standards explain how we handle anything that puts a young person at risk.
• Posts about self-harm or suicide are taken down, and the person who posted gets a private check-in from the team, not a punishment. Our community guidelines say exactly what happens, and the Get help page lists who to call or text.

If you are a parent or guardian and you want your child's account or any of their content taken down, email alexander@uniquephoto.com from an address you can be reached at and say which handle it is. We will remove it. You do not need a reason and we will not argue with you about it.

Your choices

• See it — your profile, patterns, posts, comments and messages are all shown to you in the app. Ask us by email if you want a copy of anything else we hold.
• Fix it — edit your handle, display name, bio and avatar in the app at any time. Email us if something else is wrong.
• Delete it — delete a post, comment or pattern in the app, or delete the whole account. Deleting something that has a photo on it deletes the photo file too. See Delete your account.
• Stop notifications — turn them off in the app or in your phone's settings.

Email alexander@uniquephoto.com for any of these and a person will answer.

How long we keep things

Your account and what you have made stay until you delete them. Sign-in codes disappear after 10 minutes. Order records are kept because they are a record of a real purchase. When an account is deleted, its content is hidden, its sign-in details are erased and its photo and video files are deleted from storage — the detail is on the deletion page.

Changes

If this page changes, the date at the top changes with it. If a change is a big one, we will say so in the app.

Contact

KandiCon · alexander@uniquephoto.com. Email is read by a person, not a bot.