Privacy Policy

Account data: email address and authentication identifiers.

Content you upload: reference images and photos of your drawings, and the text descriptions you write (“User Content”) that you submit to generate lessons, coloring pages, and pictures.

Usage data: lessons generated, feature usage, device and app version.

Purchase data: subscription status (processed by Apple, Google, or Stripe — we do not store your full payment card details).

To generate step-by-step drawing lessons from images you upload.

To operate, maintain, and improve the Service.

To process subscriptions and prevent abuse.

To send essential service communications.

Images you upload and descriptions you write are sent to a third-party AI provider (OpenAI) solely to check them against content rules and to generate your lesson, coloring page, or picture. This processing takes place on servers in the United States, so using the Service involves an international transfer of your image. We use OpenAI’s business API, whose terms exclude our data from training their models; we do not use your content to train models either. The provider may retain API requests for up to 30 days to detect abuse, after which they are deleted (see §5).

We share data only with: infrastructure providers (Supabase, Vercel), AI providers (OpenAI), payment processors (Apple, Google, Stripe), and analytics/error tools. We never sell your personal data.

Images you upload and descriptions you write: kept on our servers only while your result is being generated and deleted automatically within 30 minutes. We do not keep a long-term copy. The AI provider may hold the request for up to 30 days for abuse monitoring (see §3).

Generated lessons, coloring pages, and pictures: held on your device (“My Lessons”), together with the picture and description they came from. We do not keep a server-side copy, which also means we cannot restore an item you have deleted.

Moderation results: we do not store the outcome of automated content checks; a rejected request is simply not processed. Short-lived request counts used for rate limiting are held in memory only.

Account and purchase data: kept while your account is active, and deleted or anonymised within 30 days of an account-deletion request, except for records we are required to keep by law (for example tax, accounting and fraud-prevention records), which are retained only for as long as the law requires.

You can request deletion at any time via the contact below.

Depending on your region (GDPR/CCPA), you may access, correct, export, or delete your data. Use the contact below.

The Service is intended for users aged 13 and older, or the minimum digital-consent age in your country if that age is higher. It is not directed to children, and we do not knowingly collect data from anyone under 13. If you believe a child has provided data, contact us and we will delete it.

We use industry-standard measures to protect your data but cannot guarantee absolute security.

We may update this policy and will post the new date above.

ToDraw — info@todraw.app. The legal entity and postal address will be published here before public release.