How we handle your child's drawings
Photographs of a child's artwork can carry their name, their age and their handwriting, so we treat all of it as personal data. This page says what the site does today, in plain words. It is not a lawyer's document, and it changes when the product does. Last updated 22 September 2026.
What we collect
- Your email address, to send you a sign-in link. There is no password.
- Your child's first name, and the month they were born if you choose to give it.
- Photos of their drawings, and the day each was drawn if you set it (otherwise the day you added it).
- Your confirmation, when you add a child, that you are their parent or guardian.
What it is used for
- Keeping each photo in your child's record, exactly as drawn.
- Describing what is in it: who, what, where, what it was made with, and whether there is writing on it. The writing is not read and a name on the page is never used.
- Suggesting when a figure looks like a character from an earlier drawing, for you to confirm or reject.
- Nothing else. Never to train a model, never shown to another family, never in our marketing without your written permission.
Who else touches it
Each is sent only what its job needs.
- Supabase stores the records and the photos, in the EU (Ireland), and sends the sign-in email.
- Anthropic's model reads each drawing to describe it; the photo is sent for that reading.
- fal lifts a drawing off its paper when that is switched on; the photo is sent for that step.
- Vercel serves the site. Inngest runs the reading as a background job and sees only record ids.
- Upstash counts requests per address to stop abuse; it sees your IP address and nothing else.
- Resend delivers email we send ourselves. When something fails we are alerted with record ids, never a photo or a name.
- PostHog, when analytics is switched on, receives counts: a page was viewed, a drawing was added. Never an email, a name, a photo or anything read from one. A signed-in family is a random id.
Who can see it
You, and anyone you give a link to. There is no public gallery and no way to find a child's record. A share link is a long random token, stored only as a hash, shows the child's first name and the drawings and nothing else, and can be switched off at any time. A child's name is never in a web address.
How long it is kept
- A drawing in a child's record stays for as long as the record exists.
- Anything not in a child's record, such as a photo whose upload failed, is deleted after 90 days.
- A share link stops working after 90 days, or the moment you switch it off.
- A sign-in link works once and lasts an hour.
Deleting it
- Remove one drawing from a child's page, and its photo and everything read from it are deleted.
- Remove a child, and every drawing, character and link in their record goes with them.
- Delete your account, and your family, your children's records and your email go too. Deletion removes the files, not just the rows.
All three are buttons on your own pages. Nothing to email, nothing to wait for.
How it is protected
Every photo is decoded and saved afresh before it is kept, so what is stored is a real image with the phone's own data removed. Records and photos are only ever reached by the server, never by the browser directly. Sign-in is by emailed link, so there is no password to leak.