Creature Cards
Support
Need help with Creature Cards, found a bug, or have a question about a purchase? We'd love to hear from you.
Email us at amy@practiceandprocess.com and we'll get back to you.
You can also send feedback right from the app: open Settings and use the Feedback box near the bottom.
Effective date: September 26, 2026
Creature Cards ("the App") is made by Practice and Process ("we," "us"). This policy explains what information the App collects and how it's used. The App is designed for a general audience and is not directed specifically at children.
No accounts
Creature Cards doesn't have accounts, logins, or passwords. There's nothing to sign up for. Instead, the App generates a random identifier on your device ("device ID") the first time you open it, and uses that to keep track of your card collection and your free-tier usage. This identifier isn't tied to your name, email, or any other personal identity.
What we collect
Drawings, photos, and descriptions you submit. When you create a card, the sketch, photo, or text description you provide is sent to our backend to generate the card's artwork and text. As part of that process:
Your sketch/photo and description are sent to Anthropic's Claude API (for content moderation, to write the card's text, and to describe your drawing so the artwork follows it).
Your sketch/photo is sent to Replicate, which runs the Black Forest Labs Flux image models, to generate or edit the card's artwork.
The submitted sketch, the finished artwork, and the text used to create them are stored in our Supabase backend, associated only with your anonymous device ID — not with your identity.
Purchases. If you buy Creature Cards Premium, the purchase itself is handled by the Apple App Store or Google Play. We use RevenueCat to verify your purchase and manage your Premium status. RevenueCat knows your purchase only by the same anonymous device ID the App uses, not by your name, email, or payment details — we never see your payment information.
Usage analytics. We use PostHog to record how the App is used — for example, when a card is created, saved, refined, downloaded, or deleted, or when the upgrade screen is viewed — so we can understand what people make and fix problems. These events are tied to your device ID, not to your name or email, and include:
The text you type: your card descriptions, the changes you ask for when refining artwork, and any edits you make to a card's name, ability, or attacks.
Details of the cards the App makes for you, such as the creature's name, types, and level.
Basic device and app information, such as your device model, operating system, and app version, and technical error messages when something goes wrong.
Analytics events never include your drawings or photos, and we've switched off PostHog's location lookup. Please don't type personal information — such as a real name, address, or phone number — into a description, a refinement, or a card.
Feedback you choose to send. If you submit feedback through Settings, the text you write is sent through the same PostHog analytics pipeline described above, tied to your device ID. Please don't include personal information in feedback — we don't ask for or need it.
Photo library / camera access. If you choose to photograph a drawing or pick one from your photo library, the App requests permission to do so. We only access the specific image you select or capture, and only to generate a card from it. Finished cards you choose to download are saved back to your photo library using the same permission.
Improving the App. We may review the drawings, photos, and descriptions you submit, and run them through our card-generation process again, to test and improve the quality of the artwork. This happens internally: we don't publish your submissions or share them with anyone beyond the services listed in this policy.
What we don't do
We don't require or collect your name, email address, or any account credentials.
We don't show ads or use advertising trackers.
We don't sell your data.
We don't knowingly collect personal information from children. If you believe a child has submitted personal information through the App, contact us as described under Data retention and deletion and we'll delete it.
Data retention and deletion
Because there's no account, we can't look up your data by name or email — it's tied only to your device's anonymous ID. Uninstalling the App removes your local collection.
To ask us to delete the data stored on our servers — your sketches, photos, card artwork, the text used to create them, and the usage analytics tied to your device — open Settings in the App and send a message through the Feedback box, such as "Please delete my data." Feedback arrives linked to your device's anonymous ID, which is how we find the right records. You can also email us at the address below, but because we can't look you up by email, we'll ask you to send a note through the Feedback box as well so we can match your request to your device.
Purchase records themselves are held by Apple or Google as part of your App Store or Google Play account, governed by their own privacy policies — we can't delete those directly, but they're never linked to your identity in our systems beyond the anonymous entitlement status RevenueCat provides us.
Third-party services we use
Service and Purpose: Anthropic (Claude API): Content moderation, card text, reading your drawing, art direction. Replicate (Black Forest Labs Flux models): Card artwork generation and editing. Supabase: Backend storage for card art, sketches, and the text used to create them. RevenueCat: Purchase verification and Premium status. PostHog: Usage analytics, including the text you type, and feedback text.
Security
We take reasonable measures to protect the information the App handles, but no method of transmission or storage is 100% secure, and we can't guarantee absolute security.
Changes to this policy
If we make material changes to this policy, we'll update the effective date above. Continued use of the App after a change means you accept the updated policy.
Contact us
Questions about this policy or a data deletion request? Email amy@practiceandprocess.com.