Privacy Policy

1. The short version

• A parent or guardian signs in with Google or Apple. Children do not create accounts.
• A parent gives consent inside the app before any child feature is turned on.
• We collect what the app needs to bring your child's drawing to life and let it talk: the drawing, your child's first name and age, small facts your child chooses to share with their friend, and the text of their conversations with personal details removed.
• Your child's voice recordings are used only to turn speech into text and are deleted right after transcription.
• No ads. No third-party analytics or tracking SDKs in the app. No public sharing. No in-app purchases. We do not sell personal information.
• You can delete the account and all of its data inside the app at any time (Profile > Delete account).

2. Who is responsible for your data

[CONTROLLER LEGAL NAME], [POSTAL ADDRESS], is responsible for (the "controller" of) the personal information described here. Contact us at privacy@heyscribblie.com for privacy questions and requests, or support@heyscribblie.com for anything else.

3. Information we collect in the app

From the parent or guardian (the account holder):

• Account details: your email address and the account identifier (user ID) issued by Firebase Authentication when you sign in with Google or Apple. We do not receive your Google or Apple password.
• Consent record: that you gave parental consent in the app, and when.
• Support messages you send us, if you email us.

From and about your child, only after you have given consent:

• Drawings your child makes or scans, and the character ("friend") created from each drawing.
• Your child's first name and age. The friend asks for these out loud and confirms them back; we do not ask for, and are designed not to store, surnames.
• Small facts the friend learns during play (for example a favourite colour or a pet's name), each one confirmed out loud before it is saved.
• Conversation text: what your child says to the friend and what the friend says back, stored as text after we automatically remove patterns that look like phone numbers, email addresses, street addresses and payment card numbers.
• Voice clips of the friend: the audio of the friend's own lines, so they can be replayed.

Your child's voice: when your child talks to their friend, the recording is sent to Scribblie's own speech-to-text service, turned into text, and the audio is deleted right after transcription. We do not keep recordings of your child's voice.

Diagnostics: pseudonymous technical information such as error reports, app version, device type and operating system, linked to an internal identifier rather than to your name. We use it to keep the app working and secure.

We do not collect your child's surname, photo of their face, precise location, contacts, or advertising identifiers.

4. Information we collect on the website

Visiting heyscribblie.com does not require an account. Our hosting provider processes standard server information (such as IP address, browser type and the pages requested) to deliver and protect the site. If you accept analytics cookies in the cookie banner, Google Analytics also measures how visitors use the site; if you decline or do nothing, Google Analytics is not loaded. See our Cookie Policy for details. If you email us, we receive your email address and message.

5. How we use information

• To run your account and let you sign in.
• To understand your child's drawing and bring it to life as a friend that moves and talks.
• To let the friend remember your child's first name, age and the small facts your child has confirmed, so conversations feel personal.
• To keep the friend's replies age-appropriate and the service safe and secure, and to fix problems.
• To answer support requests and handle privacy requests.
• To meet legal obligations.

We do not use personal information for advertising, we do not build advertising profiles, and we do not sell or rent personal information.

6. How AI is used

Scribblie uses Google's Vertex AI service and its Gemini models, operated by Google as our service provider, to bring every drawing to life:

• the model sees the drawing so it can understand what was drawn and make a realistic picture of the friend, its home and the things drawn into its world;
• that picture is then turned into a moving 3D friend on Scribblie's own GPU servers (on Google Cloud); the 3D friend is stored with your other data and deleted with it.

Two further features may be switched on for the service; when they are:

• the model speaks the friend's lines (text-to-speech), producing the friend's voice clips;
• the model may see the redacted conversation text, together with the first name, age and confirmed facts, so it can write the friend's next reply.

Your child's voice audio is not sent to Vertex AI; it goes only to Scribblie's own speech-to-text service. AI-generated replies can occasionally be wrong or unexpected; please see the Terms of Service and contact us if something concerns you.

7. Children's privacy

Scribblie is designed with children's privacy laws such as the US Children's Online Privacy Protection Act (COPPA), the EU and UK GDPR and India's DPDP Act in mind. In practice this means:

• Only a parent or guardian can create an account, and the app asks for parental consent, recorded in the app, before any child feature is used.
• We collect only what the features described above need: a first name, an age, drawings, confirmed small facts and redacted conversation text.
• We do not show ads, we do not include third-party analytics or tracking SDKs in the app, and there is no public sharing, chat with other people, or in-app purchase.
• Personal information about your child is never sold and is not used for advertising or profiling.
• A parent can review the information we hold about their child by emailing us, and can delete it at any time in the app (Profile > Delete account, behind a grown-up check) or by email.
• Parental consent can be withdrawn by deleting the account; we then stop collecting information from the child.

If you believe a child has used Scribblie without a parent's consent, email privacy@heyscribblie.com and we will delete the information.

8. Who processes data for us

We use a small number of service providers. They process data on our instructions and not for their own advertising:

• Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Cloud Logging, Secret Manager) - hosting, database, file storage, technical logs and key management for the app's backend.
• Google Firebase Authentication - parent sign-in and account identifiers.
• Google Vertex AI (Gemini models) - understanding drawings and making the pictures the 3D friend is built from, and, where switched on, speaking the friend's lines and writing the friend's replies, as described in section 6.
• Google and Apple - as sign-in providers, when you choose "Sign in with Google" or "Sign in with Apple". Their own privacy policies apply to your Google or Apple account.
• Our website hosting provider - serving heyscribblie.com.
• Google Analytics - website only, and only if you accept analytics cookies.

We may also disclose information if the law requires it, to protect the safety of a child or anyone else, or as part of a merger or acquisition, in which case this policy will continue to protect the information or we will notify you.

9. How long we keep data

• Account, child profile, drawings, friends, confirmed facts, conversation text and friend voice clips: until you delete them or the account.
• Your child's voice audio: deleted right after transcription.
• Database backups: a copy may remain for up to 7 days after deletion, then it is overwritten.
• Technical logs: up to 30 days.
• Support emails: as long as needed to resolve your request, and then deleted unless we need them for a legal reason.

10. Security

Data is encrypted in transit, stored on Google Cloud infrastructure, and access is limited to people and systems that need it. Secrets are kept in Google Secret Manager. No service can promise perfect security; if a breach affects your data we will notify you and the authorities where the law requires.

11. International transfers

Scribblie runs on Google Cloud, so your information may be stored and processed in countries other than your own. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the contractual terms Google Cloud offers its customers.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to object to or restrict some processing, and to withdraw consent. You can delete everything in the app at any time. For any other request, email privacy@heyscribblie.com from the email address on the account so we can verify it is you. We aim to respond within 30 days. You can also complain to your local data protection authority. Region-specific information is on our GDPR, CCPA and DPDP pages.

13. Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top. If the change is significant, especially for children's data, we will tell parents in the app and ask for consent again where the law requires.

14. Contact

[CONTROLLER LEGAL NAME], [POSTAL ADDRESS]. Privacy: privacy@heyscribblie.com. Support: support@heyscribblie.com.