Privacy Policy | Color Garden

Color Garden Privacy Policy

Effective date: November 13, 2026 Version: 1

1. Who we are

Color Garden ("the app", "we", "us") is a coloring app for children, made by Bobby3. Contact for privacy questions and requests: support@colorgardenapp.com.

This policy explains what happens to information when you use the app, in plain words. It is written for grown-ups. The coloring part of the app for children does not collect personal information.

2. The short version

Children color pictures that are built into the app. We do not ask for a name, an email address, a birthday, or a password. There are no accounts to create.
There are no ads, no tracking, and no analytics tools from other companies in the app. Our website may use Cloudflare Web Analytics, which is cookie-free and collects no personal data (see "Our website" in section 3).
There is one optional feature for grown-ups: turning a photo into a coloring page. It lives in the Grown-ups area, behind an adult check. When a grown-up uses it, the photo is sent over the internet to our server and then to an AI service (OpenAI) that draws the coloring page. We do not keep the photo or the drawing on our server. The finished coloring page is saved only on your device, and only if you tap Save.
To count credits and free tries, the app creates a random anonymous number on your device. It is not linked to your name.

3. What we collect

3.1 Information the app creates, which is not your identity

What	Why	Where it is kept
An anonymous account number: a random number the app creates the first time it needs the photo service, kept in the device Keychain. It is not derived from your name, your Apple Account, or your device.	To keep track of photo credits and free tries, and to let you ask us to delete your data.	On your device (Keychain). On our server it is kept with your credit records, until you ask us to delete them (see section 8).
A support code (ten letters and digits) derived from that number.	So you can tell us which account to help, without telling us anything about you.	Shown in Grown-ups > Settings. Our staff can look up an account with it.
Purchase records: Apple's transaction number for each credit pack you buy, the number of credits, and a time stamp. We receive this from Apple through the App Store, not your payment details.	To add the credits you bought, never add them twice, and take them back if Apple refunds a purchase.	On our server, with the anonymous account number. Because credits are tied to that number, each device has its own balance; Apple does not allow consumable purchases such as credit packs to be shared through Family Sharing.
Free-try and credit use: how many free photo tries were used, credits added, held, spent or refunded.	To work out your balance and stop misuse.	On our server.
Technical records of each photo conversion: date and time, which style you chose (Standard, Detailed, Scene), whether it worked or why it was stopped (for example "photo not allowed" or "service error"), how long it took, and our estimated cost. These are tied to a scrambled form (a "hash") of the anonymous account number, not to the number itself.	To run the service safely, fix problems, and keep costs under control.	On our server for up to 400 days, then deleted automatically. They are tied only to the scrambled reference.
Abuse-prevention counters: counts of recent requests and of recent refused photos, tied to a scrambled form of the anonymous account number and a scrambled form of the network (IP) address. We do not keep the plain IP address in these records.	To slow down automated misuse and block repeated attempts to upload unsuitable pictures.	On our server, deleted after about 24 hours (free-try counters for a network or for all users: up to 3 days).
Promo or gift codes you enter, if any. Codes are stored only in a scrambled form. We record that a code was used on your account number.	To apply gifts and stop one code being used more than allowed.	On our server.

3.2 Photos (only when a grown-up uses photo coloring pages)

A grown-up picks a photo from the photo library, or takes one with the camera. The app asks for camera permission only if you use the camera. Picking from the photo library uses Apple's picker, which shares only the one photo you choose.
Before sending, the app shrinks the photo (longest side at most 1536 pixels) and saves a fresh copy with the hidden photo information removed, such as the location, camera details and date. Our server does this again on arrival.
We do not collect your name, your location, or the other photos in your library.
A photo may show people, including children. Please read section 5 and section 9.

3.3 What we do NOT collect

Names, email addresses, phone numbers, postal addresses, birthdays or ages. (If you email us for help, we receive your email address and what you write. See section 12.)
Location.
Advertising identifiers; we do not track you across other companies' apps or websites.
Analytics, advertising, or crash-reporting tools from other companies. The app contains none. (Our website may use Cloudflare Web Analytics: no cookies, no personal data, no ads, no cross-site tracking.)
Contacts, microphone recordings, or your photo library as a whole.
Your payment card or Apple Account details. Payments are handled entirely by Apple.
A copy of your photo or of the coloring page we make (see section 6).

3.4 Information stored only on your device

Your drawings and saved coloring pages, grown-up settings (such as the daily photo limit and whether you agreed to the photo notice), the date you agreed to the photo notice, and the anonymous account number (Keychain). We cannot see this information.

Backups. The app asks the system to leave coloring pages made from a photo (the pages, their previews and your child's colored versions of them) out of iCloud and computer (Finder/iTunes) backups, so they are not copied there by the app. Your child's drawings and colorings of the built-in pictures, and grown-up settings, are ordinary app data and may be included in your device backups if you use them; deleting the app removes them from the device. The anonymous account number in the Keychain may be restored from an encrypted device backup.

Our website

If analytics is switched on for colorgardenapp.com, we use Cloudflare Web Analytics to count visits. It sets no cookies, uses no personal data, shows no ads and does not track you across other sites. It is not part of the app. If it is not switched on, the website uses no analytics.

4. How we use information

To make coloring pages from photos, keep your credit balance correct and process purchases and refunds.
To keep the service safe: automatic safety checks on photos and results, limits and temporary blocks for misuse.
To help you if you contact us (using your support code).
To meet legal duties and defend legal claims.

We do not sell personal information, we do not share it for advertising, and we do not use it to build profiles of children.

5. Who we share information with

Who	What they receive	Why
OpenAI	In up to three separate requests for one conversion: (1) the re-saved photo (metadata removed, at most 1536 pixels) for a safety check; (2) the same re-saved photo together with a fixed instruction text written by us (no text from you), asking it to draw the coloring page; and (3) the finished drawing, for a second safety check. OpenAI also receives our service credentials and the technical details every internet request carries (our server's network address). We do not send the anonymous account number, your name, or any other detail about you.	To check the photo is suitable and to draw the coloring page. OpenAI works for us as a service provider for this purpose. See section 7 for how long OpenAI may keep it.
Apple	Apple runs the App Store and payments. Our app gives Apple the anonymous account number as a purchase reference (Apple's "app account token") so a purchase can be matched to the right account. Apple tells our server about purchases and refunds.	Purchases and subscriptions. Apple's own privacy policy applies to what Apple collects.
Cloudflare	Cloudflare provides the network connection between the app and our server, and hosts our website. Traffic to our server passes through its network, including the technical details every internet request carries (such as the network address).	To run the website and carry connections to our service securely.
Authorities or others, when the law requires it.	As required.	Legal obligations.

We do not give personal information to advertisers, data brokers or analytics companies.

6. Photos are not stored by us

On our server a photo and the coloring page made from it exist only in the server's working memory while the request is being handled. They are not written to disk, not put in our logs, and not added to any database. When the request ends they are discarded.
Our records of a conversion contain no image and no description of the picture.
The coloring page you receive is saved only on your device, and only if a grown-up taps "Save to My Photos". It then appears in "My Photos" in the app and can be colored by your child. You can delete saved pages on the device.
If a grown-up chooses to export or print a page, or save it to the device's Photos library, that is done by the device and the app's grown-up area, not by us.

7. What OpenAI may keep

Our server sends photos to OpenAI's interface for developers (its "API"). We do not control OpenAI's systems. Our server does not select any special OpenAI data-retention setting, so OpenAI's own terms and policies for its API apply to what it receives, including how long it may keep it and what it may use it for.

We therefore cannot promise that a photo is erased everywhere the moment we finish. What we can say is that we do not keep it, and that we send OpenAI only the photo itself (and, for the second safety check, the finished drawing). For OpenAI's practices, see OpenAI's own privacy policy and API data pages on openai.com.

8. How long we keep information, and deleting it

Information	How long
Photos and coloring pages on our server	Not kept (section 6).
Credit, purchase and free-try records (tied to the anonymous account number)	Until you ask us to delete them. We do not currently delete them automatically.
Conversion technical records (scrambled account reference)	Up to 400 days, then deleted automatically.
Abuse-prevention counters	About 24 hours; shared free-try counters up to 3 days.
Records of actions by our staff in our support tools (who did what, and the reason they typed)	We do not currently delete them automatically.
Server technical logs	The server writes a line for each request outcome with a time, the scrambled account reference, the style, an outcome code and a cost estimate, and never an image or plain network address.

How to delete your data

In the app: Grown-ups area > Settings > Privacy > "Delete my photo data". (A grown-up must pass the adult check first.) There is a similar button in the Photo coloring page screen.
This deletes the credit and purchase records tied to your anonymous account number on our server, and the saved photo coloring pages on that device. The technical conversion records (scrambled reference, no photos) expire on their own after the period above.
Important consequences: deleting removes your credit balance. Credits already bought are lost.
What we keep on purpose after deletion, using scrambled references only, to prevent fraud and misuse: a record that a particular Apple purchase was already credited (so it cannot be credited twice), whether free tries were used (so deleting data cannot reset them), any amount owed after an Apple refund, any access or block set by our staff, and the short-lived abuse counters above. These do not contain your name, contact details or photos.
Deleting your photo data does not delete your drawings of the built-in pictures on the device, your Apple purchases, or anything held by Apple or OpenAI.
By email: write to support@colorgardenapp.com with your support code (Grown-ups area > Settings > Support). Because accounts are anonymous we can only find your records with that code. If you cannot get the code (for example you have removed the app), tell us what you can, such as the approximate time of your purchase; we may not be able to find your records.

9. Children's privacy

Color Garden is made for children, so we treat it as a service directed to children. We do not knowingly collect personal information from children through the coloring part of the app. The children's part has no accounts, no sign-up, no chat, no social features, no ads, no links to other sites and no third-party tracking.
Buying credits or a subscription, the photo feature, the support code, and the links to this policy and the Terms of Use are in the Grown-ups area, behind an adult check (a challenge that is easy for an adult but hard for a young child, with a lock that gets longer after repeated wrong attempts and survives restarting the app; an optional Face ID, Touch ID or passcode check can be used instead). Sharing, printing and saving a finished page (system share sheet, Messages, Mail, Print, Save to Photos) is controlled by the Grown-ups setting "Let kids share pages", which is ON by default: by default a child can start those actions without the adult check, and the app itself sends nothing; the child or grown-up chooses the recipient in the system sheet. Leaving the app closes the Grown-ups area.
Before the photo feature is first used, a grown-up sees a plain-language notice and must tick "I am a grown-up and I agree". The app stores the date of agreement on the device. If this policy changes in a way that matters, the notice appears again.
A photo might show a child. We designed the feature so that a grown-up chooses the photo, we do not keep the photo, we remove its hidden details, and we send it only to the service that draws the page. Please do not use photos that show private details (for example addresses, documents, school uniforms with names, or a child in a state of undress). Automatic safety checks may refuse some photos.
If you believe a child has used the photo feature without a grown-up, or that we hold information about a child that you did not intend, contact us at support@colorgardenapp.com and we will help delete it.
Parents can: ask what we hold (we hold only the records described above), ask us to delete it (section 8), and refuse further use by not using the photo feature or by deleting the app.
Apple's Ask to Buy and Screen Time can add further protection on the device (Settings app, Family).

10. Security

Connections between the app and our server use HTTPS.
The app proves who it is with a short-lived (one hour) signed token, and the server checks it on each request.
Photos are handled in memory only. Hidden photo information is removed. The server only accepts ordinary JPEG or PNG pictures, within size limits.
Account references in our records and logs are scrambled; the plain anonymous account number and the plain network address are not written to logs.
The server runs in a locked-down container (non-root user, read-only file system, no extra privileges).
Our staff support tool is reachable only from approved networks, requires named staff with passkeys (no shared passwords), uses roles (owner, support, read-only), and records every staff action with a reason. It shows scrambled account references, not photos, names or emails.
Safety checks run on both the photo and the result, and fail closed: if a check cannot be completed, no page is made and no credits are used.
No system is perfectly secure.

11. International transfers

Our server and OpenAI may process data in other countries, including the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your information may therefore be transferred outside your country.

12. Your choices and rights

Depending on where you live you may have rights to access, correct, delete or restrict the use of your information, to object, and to complain to a regulator. Because we do not hold your name, we can act on a request only for the anonymous account that your support code identifies. Email support@colorgardenapp.com. If you email us we will receive your email address and message and use them only to reply and keep a record of the request.

13. Subscriptions and purchases

Prices, free trials and renewals are shown and handled by Apple. We do not receive your payment details. See the Terms of Use.

14. Changes to this policy

If we change this policy in a way that matters, we will update the date above, and if the change affects the photo feature we will show the photo notice again and ask a grown-up to agree again.

15. Contact

Bobby3 support@colorgardenapp.com