Wrap Brush: Custom Car Wraps Privacy Policy

Last updated: October 12, 2026

Wrap Brush: Custom Car Wraps (also known as WrapBrush for Tesla) is an independent vehicle wrap design tool. This policy explains how the app handles information when you create wrap designs, use template downloads, make purchases, or send feedback.

Who Is Responsible for Your Information

Xiaoqian Zhang, based in Shenzhen, Guangdong, China, is the developer and data controller responsible for the processing described in this policy. Contact the developer at feedback@shawnsoft.com for privacy questions, requests, or complaints.

No Account Required

The app does not require you to create an account or sign in to a developer-operated account. The app does not include advertising SDKs or use your activity for cross-app advertising tracking. The app does not automatically collect product usage analytics or crash reports.

Photos, Designs, and Exports

Photos you import, stickers you place, generated wrap images, and exported PNG files are processed locally on your device. Editing and exporting do not upload these files to a developer-operated server. If you choose to attach an image to an in-app feedback submission, that attachment is uploaded as described below.

Template and 3D Model Downloads

The Template tab may contact a developer-operated template service to download the latest template catalog and template PNG files. The app also downloads 3D vehicle model files when needed for a preview and caches downloaded resources on your device. These requests deliver app functionality and do not upload your photos, designs, or exported wrap files. Feedback uses a separate submission endpoint as described below.

Like most web services, the hosting and network providers used for the download service may process technical request information, such as IP address and request timing, to deliver files, prevent abuse, and maintain service security. We do not use this information for advertising or user tracking.

Usage Analytics and Error Reports

The app does not include a third-party product analytics or automatic crash-reporting SDK. It does not send app usage, subscription page visits, purchase cancellations or auto-renewal changes to an analytics service. Technical details included in feedback you choose to submit are handled only as described in the In-App Feedback section below.

Your Privacy Choices

You decide whether to send feedback, provide a contact email, or attach images. Editing and exporting do not upload your photos or designs. To request access, correction or deletion of information you submitted, email feedback@shawnsoft.com or use in-app feedback and identify your request as a privacy request. The procedure and time limits are described in Your Privacy Rights below.

In-App Purchases and Subscriptions

Paid features are sold through Apple's App Store payment system. The app offers a monthly auto-renewable subscription and a one-time lifetime unlock purchase. Previously purchased yearly subscriptions remain recognized. Purchase, subscription, cancellation, refund, and payment-card handling are managed by Apple. The app uses StoreKit to load product information, start purchases, restore purchases, verify entitlement status, and open Apple's subscription-management interface.

We do not receive or store your full payment-card details in the app.

In-App Feedback

Feedback is uploaded only when you choose to submit it. The feedback service runs on a developer-operated Hostinger VPS in Kuala Lumpur, Malaysia, and is delivered through Cloudflare. Submissions may include the message you type, an optional contact email you choose to provide, screenshots or reference images you attach, selected vehicle and template-request details, app version, iOS version, device model, locale, and the app's current StoreKit entitlement category. When an active subscription or lifetime unlock is available, the app may also include Apple-signed transaction and renewal information so the service can verify paid access, including a configured billing grace period, and apply the correct request limit. We use an optional contact email only to reply to that feedback or send its resolution status. The feedback flow does not use the iOS Mail composer.

To prevent feedback abuse, the app also sends a random, app-local installation identifier with a submission. The Hostinger service converts that identifier and the request source IP address into non-reversible, server-keyed SHA-256 values used only for rate limiting. Raw installation identifiers and IP addresses are not stored in feedback records, and expired daily rate-limit rows are removed after two days. These values are not used for advertising, cross-app tracking, or analytics. These hashes are pseudonymous technical data.

Apple-signed transaction and renewal information is verified while the feedback request is processed and is not stored in its original form or included in logs or email. Alongside the app-reported access category, the service stores the verified access category, product identifier, optional expiration date, and a non-reversible, server-keyed hash of the original transaction identifier for request-rate limiting. Free and unknown access categories do not include an App Store transaction identifier.

Feedback replies and resolution notifications are delivered through Resend, our transactional email provider. For these messages, the provider processes the recipient email address, the reply or resolution text, and delivery information. We retain message identifiers and delivery status to avoid duplicate notifications and handle delivery failures. Apple-signed purchase information is not included in these emails. We do not use feedback contact details for marketing. New-feedback notifications to the developer contain only limited case metadata and a link to the protected support dashboard, without your message, contact email, or images.

Feedback messages, optional contact emails, attachment names, and attachment contents are encrypted at rest. Feedback marked completed or unable to complete, together with its attachments, is scheduled for deletion 180 days after that final status. Feedback still being handled is retained until it is resolved or a valid deletion request is completed. Anonymous daily submission counts may be retained for service capacity and reliability records.

Why We Process Information

Where the GDPR or UK GDPR applies, our legal bases depend on the purpose:

• Contract, to provide the service you request: delivering templates and models, handling your feedback or customization request, and verifying paid access where needed to provide that service.
• Legitimate interests: protecting the service from abuse, enforcing reasonable request limits, securing systems, and handling service reliability and support administration. We limit this processing to what those purposes need and consider your rights.
• Legal obligations: responding to applicable legal requirements and privacy rights requests where the law requires it.

A contact email and feedback attachments are optional. Some technical request information is necessary to deliver downloads, and a feedback message is needed to handle a feedback request. Apple purchase verification may be needed to apply paid-service request limits. We do not make solely automated decisions that produce legal or similarly significant effects on you. AI-assisted defect investigation helps review software; it does not decide your eligibility or price.

Service Providers and International Processing

We collect the information described above from you, your app and device, technical requests, and Apple-signed entitlement information. Access is limited to the developer and providers needed for the stated purposes:

• Hostinger: the feedback and download service on a VPS in Malaysia, including its hosting backups.
• Cloudflare, Inc.: network delivery and security, and hosting the policy website. Cloudflare operates a global network; request handling and provider support may involve countries outside your own.
• Backblaze, Inc. (United States): encrypted recovery backups of the Hostinger service in its EU Central storage region.
• Resend (Plus Five Five, Inc.): transactional email delivery in the United States for support replies, resolution messages, and limited developer notifications.
• Apple: App Store payments, subscriptions and entitlement verification. Apple handles its payment and account information under its own privacy terms.

The developer may access support and privacy-request information from China. Other provider support locations are described in their applicable processing terms. This means that information may be processed outside the EEA, United Kingdom, or your country, where privacy laws may differ. Transfers that require safeguards must be covered by binding data processing terms and an applicable transfer mechanism before the relevant processing begins. Depending on the provider and destination, these may include the European Commission's Standard Contractual Clauses and the UK Addendum for UK transfers. Contact our privacy email for information about the safeguards applicable to your information, or a copy with confidential details redacted.

Provider processing terms are available from Hostinger, Cloudflare, Backblaze, and Resend. We may also disclose information when legally required, or as necessary to protect rights and service security, subject to applicable law. We do not sell personal information or provide it for advertising.

Security and Recovery Backups

We use encrypted network connections, restricted administrative access, private attachment storage, and encryption for the feedback service and its recovery backups. No system can guarantee absolute security. Please avoid including passwords, payment-card details, government identifiers, or other unnecessary sensitive information in feedback or images.

Deletion from live feedback storage does not immediately erase every recovery copy. The Hostinger service's encrypted Backblaze backup series keeps at most the latest 30 snapshots, including manual snapshots; older snapshots are pruned as new snapshots are made. This is a snapshot count, not a guarantee of deletion within 30 calendar days. Hostinger also provides hosting backups on the current weekly plan. Recovery copies are restricted to recovery and security purposes and are not used for routine support. When restoring a backup, deletion requests must be reapplied before normal use resumes. Provider copies and email delivery records follow the relevant provider's retention and deletion procedures. We explain any remaining copies or legally required retention when handling your request.

Your Privacy Rights

Depending on the law that applies to you, you may request access to and a copy of your personal information, correction, deletion, restriction of processing, and portability of information you provided where applicable. You may object to processing based on legitimate interests. You may also complain to the relevant data protection authority. We do not charge for ordinary rights requests or discriminate against you for exercising your rights, subject to lawful exceptions.

Email feedback@shawnsoft.com with the subject "Privacy request" and describe your request. For feedback, provide the case reference or the email you used, if available. We may ask for limited information needed to verify that the records belong to you; please do not send identity documents unless we specifically explain why a lawful verification step is necessary. An authorized agent may submit a request where applicable law permits, with proof of authority.

We respond without undue delay, normally within one calendar month. We follow any shorter applicable deadline and tell you if a legally permitted extension is needed, including its reason. If a request is refused or information must be retained, we explain the reason and available complaint or appeal options. Rights can be limited by applicable law, for example where retention is necessary for a legal obligation or a legal claim. Without an account or a reference, we may be unable to locate particular records; we do not collect additional identifiers solely to identify every app user.

To raise a privacy complaint, use the same email with the subject "Privacy complaint". We acknowledge complaints within 30 days, investigate appropriately, and explain the outcome without undue delay. Where a US state law provides an appeal, reply with "Privacy appeal" and we will review the decision and respond within the applicable deadline, with information on contacting the relevant regulator if the appeal is denied. These procedures do not restrict your right to contact a regulator directly. EEA residents may contact their local supervisory authority; UK residents may contact the Information Commissioner's Office.

Additional Information for US Residents

The categories we process include app-local identifiers, device and diagnostic information, purchase and entitlement information, and the contact details and content you choose to include in support requests. The sources, purposes, recipients, and retention criteria for each are described above. Where a state privacy law applies, its access, correction, deletion, portability, opt-out, and appeal rights can be exercised through the procedure above.

We do not sell personal information, "share" it for cross-context behavioral advertising, use it for targeted advertising, or profile you for decisions with legal or similarly significant effects. We do not use or disclose sensitive personal information to infer characteristics about you. The app has no third-party advertising SDKs that collect activity across other apps or websites. There is therefore no sale, advertising-sharing, or targeted-advertising activity to opt out of.

Children's Privacy

This is a general-audience vehicle design tool and is not directed to children under 13. We do not knowingly collect personal information from children below the applicable age of consent. If you believe a child has provided personal information through feedback, contact us so we can investigate and delete it where required. We do not offer a parental-consent verification flow.

Changes to This Policy

We may update this policy when the app's features, services, or legal requirements change. The updated version will be posted on this page with a new "Last updated" date. For material changes, we provide an appropriate notice in the app or on this page.

Contact

For privacy questions or deletion requests, email feedback@shawnsoft.com, or submit an in-app feedback request and mark it as a privacy question in the message.