Privacy policy
Last updated 1 August 2026
The short version
- A grown-up can create an optional account (Clerk). The child uses the app under supervision.
- Drawings, characters and books stay on your device by default. We do not keep image files.
- Prompts are sent to OpenAI to generate line art. We may retain hashed or truncated prompt text for product improvement and SEO theme research.
- We use privacy-friendly analytics only when you allow cookies on the website, and product events in the app to improve Squiggleworks.
- Subscriptions go through Apple, Google or Stripe via RevenueCat. We never see card numbers.
Who this is about
Squiggleworks turns a described scene into a printable colouring page. This policy covers the iOS and Android apps, the web app at app.squiggleworks.com, and this marketing site. Contact details are at the bottom.
Accounts and identity
You can start anonymously. The first drawing request creates a random user ID and a device token (stored in the Keychain / secure storage on native, or local storage on web). Signing in with Clerk (email or social login) links that same ID to the grown-up account when possible, so usage and Plus stay attached.
When you sign in we store your Clerk user id and email on our server so we can recover your account, send transactional mail you opt into, and attach purchases. The parent holds the account; children should not create one.
What we store on our server
- user id, hashed API token, platform, creation time
- optional Clerk user id and email
- subscription entitlement state from RevenueCat webhooks
- usage counts for free and Plus limits
- first-touch and last-touch UTM / referral attribution
- optional prompt logs (see below), referral codes, and product event rollups
- short-lived rate-limit counters and daily inference spend totals
We do not store your finished drawings, character portraits, or photo uploads after the generation request finishes.
AI generation, prompts and images
Generation is provided by OpenAI. We send the scene text, optional character descriptions, and any photo you choose. The image returns through our server to your device and is not kept by us.
We may log prompt text, whether generation succeeded, and whether a download followed, so we can improve safety and understand which themes families ask for. For analytics exports we hash or truncate prompts that may contain children’s names. You can email us to delete prompt history tied to your account. See the OpenAI privacy policies.
Photographs
Photo-to-page is optional and only runs when a grown-up or child deliberately picks a photo. The photo is resized on device, sent to OpenAI for redrawing, and not stored by Squiggleworks.
Voice
Voice chat (Plus) streams microphone audio to OpenAI for the live session only. We do not keep the audio or a transcript after the call ends.
Subscriptions and payment
Purchases use RevenueCat with Apple App Store, Google Play, or Stripe (web). We receive subscription status, product id and expiry for your user id. Card details stay with Apple, Google or Stripe. See the RevenueCat privacy policy.
Analytics and cookies
The marketing site uses a cookie banner. Essential storage powers the free generator and attribution cookies. Analytics (Plausible) load only if you choose “Allow analytics”. The app sends product events (for example page generated, paywall viewed) to our API and, when configured, PostHog in the EU region. There is no advertising SDK and we do not sell personal data.
Children
Squiggleworks is designed for children to use with a grown-up nearby. The parent holds any account. Settings, spending and grown-up sign-in sit behind a parental gate. We do not offer social features, public profiles, or advertising aimed at children.
Hosting and security
Our API and sites run on Cloudflare. Traffic uses HTTPS. See the Cloudflare privacy policy.
Retention and deletion
Account and usage records stay until you ask us to delete them, or until they are no longer needed for limits and billing. Prompt logs may be retained up to 24 months, then deleted or aggregated. Email privacy@squiggleworks.com to request deletion of your user id, email, prompts and attribution data.
Your rights
Depending on where you live (including the UK GDPR), you may ask for access, correction, deletion, or restriction of processing. Contact us and we will respond within a reasonable time.
Companies that help us
- OpenAI — image, chat and voice generation
- Cloudflare — hosting and network security
- Clerk — optional grown-up authentication
- RevenueCat / Apple / Google / Stripe — subscriptions
- PostHog and Plausible — product and web analytics when enabled
Contact
Squiggleworks · privacy@squiggleworks.com
Also see our Terms of use.