Questo documento legale è disponibile solo in inglese. Fa fede la versione inglese.

This page explains how Scribblie approaches India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") for families who use our app and website. It is a plain-language summary for parents and caregivers. It is not legal advice and has not yet been reviewed by a lawyer. For full detail, also read our Privacy Policy.

What the DPDP Act is

The DPDP Act is India's national law for protecting digital personal data. It sets rules for how organizations collect, use, store, and share personal data, and it gives individuals rights over that data. Scribblie is designed with the DPDP Act's principles, child safety and parental control in mind for families in India and worldwide.

Who we are (Data Fiduciary)

Under the DPDP Act, [CONTROLLER LEGAL NAME], [POSTAL ADDRESS], acts as the Data Fiduciary for the Scribblie service. Our grievance contact is [GRIEVANCE OFFICER NAME], reachable at privacy@heyscribblie.com for privacy questions or requests.

What data Scribblie may process

Depending on how you use Scribblie, we process:

The parent's email address and the account ID from Google or Apple sign-in (Firebase Authentication)
The child's drawings and the characters created from them
The child's first name and age, and small facts the friend learns and the child confirms out loud (no surnames)
Conversation text, with phone numbers, email addresses, street addresses and card numbers removed
Voice clips of the friend; the child's own voice audio is deleted right after transcription
Pseudonymous diagnostics, and any support messages you send us

Parents or guardians are the account holders. The app has no ads, no third-party analytics or tracking SDKs, no public sharing and no in-app purchases.

Purpose and consent

We process personal data to provide the Scribblie features you use - understanding a drawing, bringing it to life as a friend that talks, remembering the facts your child has confirmed, and customer support. The app asks a parent or guardian for consent, and records it, before any child feature is used. You can withdraw consent at any time by deleting the account in the app (Profile > Delete account) or by emailing us.

Children and parental rights

Scribblie is built for families. When a child uses the app, we expect a parent or guardian to supervise and provide any required consent. We do not sell children's personal data, we do not show ads, and we do not track children for advertising. Parents may request access, correction or deletion of personal data associated with their account.

Your rights under the DPDP Act

Subject to the Act and applicable rules, individuals in India may have rights to:

Access information about personal data we process
Correct inaccurate or incomplete personal data
Erase personal data when it is no longer needed for the stated purpose
Withdraw consent where processing is based on consent
Nominate another person to exercise rights in case of death or incapacity, as the law allows

To exercise these rights, email privacy@heyscribblie.com with the subject line "DPDP request" and enough detail for us to verify the account holder. We will respond within a reasonable time consistent with the Act and our Privacy Policy.

Sharing and processors

We use Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Cloud Logging, Secret Manager) for hosting, Google Firebase Authentication for parent sign-in, and Google Vertex AI (Gemini models) to understand drawings, speak the friend's lines and write the friend's replies. The full list is in our Privacy Policy. We do not sell personal data.

Retention and security

We keep personal data until you delete it or the account. After deletion, database backups keep a copy for up to 7 days and technical logs are kept for up to 30 days. We use encryption in transit and access controls to help protect data. No online service can promise perfect security; we work to reduce risk and respond quickly if a serious incident occurs.

Cross-border processing

Scribblie runs on Google Cloud and may process data on servers outside India, subject to any restrictions notified under the DPDP Act.

Grievances

If you have a complaint about how we handle personal data under the DPDP Act, contact us first at privacy@heyscribblie.com. You may also have the right to approach the Data Protection Board of India once applicable grievance procedures under the Act are available.

Updates

We may update this summary when the law, rules, or Scribblie practices change. The "Last Updated" date at the top of this page shows the latest revision.

DPDP Act - India Data Protection