Privacy Policy

This policy applies to the app currently called Crayonymous. The short version is simple: Crayonymous does not upload or save a selected photograph of anybody. Your Character Cards and finished coloring sheets stay on your device. When you generate a sheet, the scene and only the drawing traits you approve are sent to the drawing service.

Who we are

Crayonymous is made and operated by Jeff Surette, a sole proprietor based in Massachusetts, USA, trading as Surettech (“Crayonymous,” “we,” “us”). We are the controller of the personal information described here. Email hello@crayonymous.com with any question about it.

What stays on your device

Character Card names, saved profiles, and generated coloring sheets are stored locally by the app. We do not receive them.

If photo assist is available in your version, the app receives only the photograph you select through Apple's system picker. It creates a metadata-free, size-limited image in memory and asks Apple's on-device model to draft a few drawable traits. There is no remote fallback for that analysis. You can inspect and change the draft before saving it, and Crayonymous does not save the selected photograph.

Character Cards drafted from a photo also record which screening rules were applied when you approved them. A later record can then say what actually ran, rather than assuming today's rules.

Each request also records a private check value on this device, derived from the details you approved. The app compares it locally so it can tell you whether a card still matches what was sent. The check value itself is never shown and never leaves your device.

What is sent when you make a sheet

The app sends your scene description and only the approved, visible drawing traits you selected: an approximate age band, hair silhouette, visible markers, and signature clothing. It does not send a saved Character Card nickname, photograph, photo URL, photo metadata, unrestricted photo caption, or face embedding. Your scene description is sent exactly as you write it, so any names you type there would be sent — if you do not want names sent, simply don't type them in.

A Character Card can describe a person of any age, not only a child, so the protections in this policy are written for whoever a card describes. The age band is a coarse choice you pick and can see — toddler through older grown-up — and it is sent because it governs how a person is drawn. It is not a date of birth and we do not ask for one.

Our server sends that limited request to OpenAI to create the image. We do not store the scene, character traits, generated image, or the image provider's response body in our database or application logs. OpenAI states that API data is not used to train its models by default; under its standard API controls, image-generation inputs and outputs may be kept in abuse-monitoring logs for up to 30 days.

App Store identity, purchases, and usage

Apple provides a signed, pseudonymous app transaction identifier so the server can recognize the same Apple Account and app across reinstalls without a Crayonymous account. We store that identifier, the App Store environment, verified subscription transaction identifiers and dates, and generation allowance records. We use this information only to verify purchases, restore access, enforce the three-sheet free allowance and paid-period allowance, prevent replay or abuse, and provide support.

We also record request timestamps for rate limiting. We do not use this information for advertising or tracking, and we do not sell or share personal information for cross-context behavioral advertising.

The website waitlist

If you join the waitlist on this website, we store the email address you submit and the date you submitted it. We use it for one purpose: to write to you when there is something to try. It is not a newsletter, and we do not sell or share it.

That list is kept apart from everything the app records. A waitlist address is not linked to an app transaction identifier, a subscription, an allowance record, or any sheet, and nothing in the app writes to it. Joining the list does not identify you to the drawing service, and using the app does not add you to the list.

To throttle abuse of the open form, we store a salted, one-way digest of the submitting connection's network address for 24 hours. A cleanup job that runs once a day removes it, so it can persist up to a day longer than that. We do not store the address itself.

Cookies and analytics on this website

This website sets no cookies. It carries no advertising tags and no cross-site trackers, so there is no consent banner to dismiss. The waitlist form sends the address you type and nothing else.

The website uses privacy-friendly, cookieless analytics (Vercel Web Analytics) to count aggregate page views and see which pages people read. It sets no cookies, collects no personal information, and does not follow you to other sites or connect what you read to your identity. This applies to the website only. The app does not do this, and nothing measured here is joined to the waitlist, to an app transaction identity, or to a subscription.

Service providers

Apple processes purchases and supplies signed StoreKit records. Vercel hosts the application server and provides the website's cookieless analytics, Neon stores entitlement and allowance records, and OpenAI generates coloring sheets. Each provider processes information on our behalf under its own terms and privacy commitments.

Retention and security

A cleanup job runs once a day, so each window below is the age at which a record becomes eligible for deletion rather than the moment it disappears: a record can outlive its window by up to a day. Rate-limit events are deleted at 24 hours, and completed reservation records at 90 days. A stalled reservation is refunded 30 minutes after it stalls, either at the next attempt from the same device or by the daily job, whichever comes first. We retain aggregate allowance periods, the pseudonymous app transaction identifier, and purchase-entitlement records while they are needed to restore access, enforce lifetime and billing-period limits, prevent fraud, meet legal obligations, or resolve support issues.

The value that binds a redraw to the drawing it paid for stops being useful 30 minutes after the request. It is cleared at your next request after that, or by the daily job for a device that doesn't come back, whichever comes first. It never reaches the 90-day window above.

We keep a waitlist address until the app is released and we have written to you about it, or until you ask us to remove it, whichever comes first.

We use signed Apple records, encrypted network connections, scoped production secrets, and database constraints to protect this data. No internet service can promise absolute security.

Children

Crayonymous is for adults. You must be 18, or the age of majority where you live, to buy a subscription or operate the app. Its App Store rating describes the sheets it makes. It does not mean a child should run the app alone.

Crayonymous is made for a parent or other adult to operate with and for children. The purchase, the App Store relationship, and everything we receive belong to that adult. The app does not create child accounts, does not ask a child for personal information, and we do not knowingly collect personal information from a child under 13.

A child's photograph is never uploaded, and a saved Character Card nickname is never sent. A name you type into a scene description is sent, because the description goes exactly as you write it. If you believe a child's personal information reached us anyway, email us so we can investigate and delete it when appropriate.

Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete personal information, or object to certain processing. Email hello@crayonymous.com with your request.

To leave the website waitlist, write from the address you signed up with and we will delete the row. That one we can match directly.

App records are different: the app has no account and stores no email address, so there is nothing to match a request against. We may need a safe way to verify that a pseudonymous record belongs to your app before acting on it. Deleting records does not create a new free allowance or change Apple's purchase records.

California privacy rights

If you live in California, you have the right to know what personal information we collect and how we use it, which is described above; to request access to it or a copy; to request correction or deletion; and not to be treated differently for asking. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.

Email hello@crayonymous.com to make a request. Because app records are pseudonymous rather than tied to an account, we may need a safe way to confirm a record belongs to your app before acting on it.

UK and EU rights

If you are in the UK or the EEA, you have the rights to access, correct, erase, restrict, and port your personal data, and to object to certain processing. Our lawful bases are: performing the service you asked for, which covers purchases, entitlement, allowance, and generating a sheet; your consent, which is the basis for the website waitlist and which you can withdraw at any time by writing to us; and our legitimate interest in operating and protecting the service, which covers rate limiting, fraud prevention, and the website's aggregate, cookieless analytics.

The controller is Jeff Surette. Email hello@crayonymous.com to exercise any of these. You also have the right to lodge a complaint with your local data protection authority.

Changes

We may update this policy as the app changes. We will post the revised date here and provide additional notice when a material change requires it.

Contact

Questions about privacy? Email hello@crayonymous.com.