T-Shirt Design & Mockup Maker · Last updated 8 November 2026
T-Shirt Design & Mockup Maker (“T-Shirt Design”, “the app”) is published by Auralabs (“we”, “us”). This policy explains what the app collects, why, who it is shared with and the choices you have. It covers the iOS and Android apps and this website.
The following is stored only on your device and is never sent to us:
Deleting the app deletes this data, so export anything you want to keep. On Android, it may be included in your Google device backup if you have backups turned on.
When you first open the app it signs in to Google Firebase Authentication anonymously. This creates a random ID for this install. It is not linked to your name, email, phone number or advertising ID, and we cannot use it to contact you. The app uses it to:
If you delete the app or move to a new phone, the app creates a new ID.
The ready-made designs, collections, fonts and artwork are downloaded from our content storage on Cloudflare R2 (tshirt-cdn.auralab.cc), with Google Firebase Storage as a backup. These downloads do not include any information about you or your projects. Like any website, the servers see your IP address and basic request information (such as the app version) to deliver the files.
AI stickers are optional. Nothing is sent until you tap Generate.
| What | Why | Where it goes |
|---|---|---|
| The text you type to describe the sticker (up to 300 characters) and the style you pick | To generate the sticker | Our server, then Google’s Gemini API |
| In “From photo” mode: the photo you choose, made smaller and converted to JPEG on your phone | To generate a sticker based on it | Our server, then Google’s Gemini API |
| The generated image | To check it is suitable for all ages before you see it | Our server, then a Google Gemini model that reviews it |
| Your anonymous ID (section 2) and a sign-in token from Firebase | To check the request comes from the app and to charge the right allowance | Our server |
Our server runs on Cloudflare Workers at tshirt-ai.auralab.cc. It passes your request to Google’s Gemini API, which may process it in the United States or other countries. Google handles it under the Gemini API Additional Terms of Service and may keep it for a limited time to detect abuse. We do not store your prompt or photo on our server after the sticker is returned (except in a report, below). The sticker is sent back to the app, where the background is removed on your device and it is saved with your project.
For each anonymous ID our server keeps:
Our server logs show a shortened anonymous ID, the result of each request and, for refused requests, the blocked word if one was found. They do not contain your photo.
Reporting a sticker. If you tap Report on a generated sticker, we store the reason you pick, whether it was made from a description or a photo, the style, the text you typed, the generated sticker image (not your original photo), your anonymous ID and the time, in our database on Cloudflare. Only we can read reports. We use them to review the sticker, to improve our content filters and to stop misuse, and we delete them when they are no longer needed for that.
The free version shows ads from Google AdMob. To show, measure and limit ads and to prevent fraud, Google collects information such as your IP address (used to estimate your general location), device model, operating system, app version, ad interactions and, on Android, your device’s advertising ID. Google may use this to show ads based on your interests where the law and your choices allow it. We do not receive these identifiers ourselves.
See how Google uses information from apps that use its services.
Premium (an auto-renewing subscription) and AI credit packs are sold through the App Store and Google Play, which handle payment. We never see your name, card or bank details. We use RevenueCat to check what you have bought, restore purchases and tell our server about new purchases, renewals and refunds so your AI allowance and credits are right. RevenueCat receives your anonymous ID (section 2) as your customer ID, the products you bought, transaction IDs and receipts, your country and store currency, and basic device information such as the OS and app version. We use this only to provide what you bought and to handle refunds or billing problems, never for advertising. Purchase records are kept while you use the app and for as long as accounting and tax law require. See the RevenueCat privacy policy.
We use Google Analytics for Firebase to learn how the app is used, for example how many people open it, which screens they visit, how long sessions last and whether purchases work. Google adds a random app-instance ID, the device model, OS and app version, your app language and an approximate country or city derived from the IP address, and on Android it may read the advertising ID. Analytics does not receive your designs, the text you type or your photos.
If the app crashes, Firebase Crashlytics receives a crash report: the error and the code that was running, the device model, OS and app version, free memory and disk space, and a random installation ID. It does not contain your designs, text or photos. Crash reports are kept for 90 days. Analytics and crash reports are switched off in developer (debug) builds. See Firebase privacy and security.
Request a feature. If you send an idea from Profile → Request a feature, we store the text you write (up to 500 characters), the category you pick (if any), your platform, app version and app language, whether you have Premium, your anonymous ID (section 2) and the time, in Google Firebase (Cloud Firestore). It is not linked to your name, email or advertising ID. Only we can read it, and we use it to plan improvements. Please do not include personal information in your idea. To have an idea deleted, email us its text and roughly when you sent it.
Send feedback. This opens your email app. We receive your email address and whatever you write, and use it only to reply to you.
The app is not directed to children under 13 and we do not knowingly collect personal information from them. AI stickers are filtered for all-ages content. If you believe a child has given us personal information, contact us and we will delete it.
Depending on where you live (for example under the GDPR in Europe, the UK GDPR, or US state privacy laws), you may have the right to access, correct or delete your personal information, to object to or restrict its use, and to withdraw consent. Email us and we will reply within 30 days. Because there is no account, we may ask you for something that lets us find your data, such as a store order or transaction ID, the text of a feature request or roughly when you sent a report.
You can also complain to your local data protection authority.
We share data only with the providers that run the app: Google (Firebase Authentication, Analytics, Crashlytics, Cloud Firestore and Storage, the Gemini API and AdMob), Cloudflare (our AI server and content storage), RevenueCat, and Apple and Google for purchases through their stores. They may process it in countries other than yours, including the United States, under their own safeguards such as standard contractual clauses.
Data is sent over encrypted connections. AI keys and payment checks stay on our server, and our server accepts requests only with a valid sign-in token from the app. No system is perfectly secure, so please keep personal information out of prompts, photos you send to AI stickers and feature requests.
We will update this page when the app changes how it handles data, and change the date at the top. For significant changes we will also tell you in the app.
Auralabs · ad.auralabs@gmail.com