🎨 Privacy Policy
1. Who we are
Coloring World ("we", "us") operates the website coloringworld.app — an online coloring app for children managed through a parent account. Questions about this policy: support@coloringworld.app.
2. Children's privacy (COPPA / GDPR-K)
Coloring World is directed at families, and we treat children's privacy as the core design constraint of the product:
- Children do not create accounts, do not provide any personal information, and cannot make purchases. All account creation, settings, and payments are done by a parent or legal guardian (18+).
- A parent may create a child profile inside their own account. Such a profile contains only what the parent chooses to enter: a first name or nickname, an avatar (an icon, or a photo the parent uploads), a learning language, and a color-theme preference. We never request more.
- Verifiable parental consent is obtained at account creation: the account is created by the parent, who confirms they are an adult creating the account for their child's use.
- We show no advertising of any kind and use no behavioral tracking of children.
- Children's artwork and profiles are private to the parent's account — nothing is public.
Parents may review or delete their child's profile and saved artwork at any time from the Parent Dashboard, or by emailing us. Deleting a child profile permanently removes that child's saved works. A parent may also refuse to permit any further collection or use of their child's information by deleting the profile or closing the account. We do not condition a child's use of the Service on the provision of more information than is reasonably necessary to provide it.
3. What we collect
- Parent account: email address, an optional display name, and a password (stored only as a secure hash by our authentication provider). Optionally a 4-digit parent PIN (stored only as a salted hash).
- Child profiles (entered by the parent): name/nickname, avatar, language, theme.
- Artwork: the colorings saved in the account.
- Preferences: interface language, audio settings — stored in your browser (localStorage) and/or your account.
- Payments: handled entirely by our payment provider, Paddle (see below). We never see or store card numbers.
We do not run third-party advertising or analytics trackers on the app.
4. How we use data
Only to provide the service: signing you in, saving artwork to the right profile, remembering preferences, managing your subscription, and sending essential service emails (e.g., email confirmation, sign-in links). Legal bases under GDPR: performance of our contract with you, and consent.
5. Service providers
- Supabase — authentication, database and file storage (account data, profiles, artwork).
- Paddle — payment processing and subscription billing, acting as merchant of record. Paddle processes the payment data (card details, billing country) under its own privacy policy.
- Resend — delivery of transactional emails (confirmation, sign-in links).
These providers process data only to deliver their function to us. We do not sell personal data and do not share it with anyone for marketing.
International transfers. Our providers' infrastructure may be located in the European Union and/or the United States; where personal data is transferred outside your jurisdiction, it is done under appropriate safeguards (such as the providers' standard contractual clauses and equivalent mechanisms).
6. Cookies and local storage
We use only functional storage: your sign-in session and app preferences (language, audio, trial state). No advertising or cross-site tracking cookies.
7. Data retention and deletion
Account data is kept while the account exists. You can delete child profiles (and their artwork) from the dashboard at any time. To delete the entire parent account and all associated data, email support@coloringworld.app from the account's email address — we will complete deletion within 30 days. Some billing records may be retained where required by law (handled by Paddle).
8. Your rights
Depending on your location (including under GDPR), you have the right to access, correct, export, or delete your personal data, and to withdraw consent. Contact us at the email above; we will respond within 30 days. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.
9. Security
Data is transmitted over HTTPS; passwords and PINs are stored only as secure hashes; artwork and profiles are protected by per-account access rules. No method of transmission or storage is 100% secure, but we design for data minimization: the less we collect, the less can ever be exposed.
10. Changes
If we make material changes to this policy, we will update the date above and, for significant changes affecting children's data, notify parents by email before they take effect.