Draft. This page is not final yet. Words in square brackets and notes marked TODO are still to be filled in.

Pinito privacy policy

Last updated [EFFECTIVE DATE]

Pinito is an iPad app that draws your child's idea as a page to color. It is made for children from 3 to 12, and a parent sets it up. This policy says what we collect, why, who helps us, how long we keep it and how you stay in charge. We wrote it for parents. If anything here is unclear, write to us at [SUPPORT EMAIL].

The short version

A parent sets up Pinito and holds the family account. Children never sign in and never need an email address.
We keep your email address, each child's name or nickname, age band, avatar and interests, and the pictures your children make and color. That is how their pictures follow them to every iPad in your family.
To draw a picture, we send your child's idea to OpenAI, the AI service that rewrites the idea and draws the page. We don't send OpenAI the name in your child's profile or your email address.
Pinito has no ads, no tracking, no analytics, no chat and no sharing with other families.
You can delete the whole family account from the app at any time.

Who we are

Pinito is made by [CONTROLLER NAME], [CONTROLLER ADDRESS]. We decide how personal data in Pinito is used, so under the EU's General Data Protection Regulation, the GDPR, we are its controller. You can reach us at [SUPPORT EMAIL].

Pinito's working name was Coloring Pages. Until the rename is finished you may still see "Coloring Pages" in the app and as the sender of our emails. It is the same app.

How Pinito is set up

A parent or legal guardian, aged 18 or over, sets up Pinito on the iPad. You sign in with your email address and a 6-digit code we email to you, or with the link in that email. Then you add each child.

Children use Pinito without an account of their own. Each child taps their avatar on the first screen and starts drawing. The parents' area, where you change settings, answer requests and delete things, opens only after Face ID, Touch ID or the iPad's passcode. If the iPad has no passcode, iPadOS has nothing to check, so the parents' area opens without a check and Pinito shows a reminder to set one.

In the Netherlands a child under 16 can't agree to an online service on their own. Other EU countries set this age between 13 and 16, and in the United States the age is 13. Pinito never asks a child to agree to anything. You set up the account, add each child and choose their settings, and everything we keep about a child is there because you set Pinito up for them.

What children can and can't do

In Pinito a child can:

tap, type or say an idea, or tap Surprise me, and get a page drawn for it
change a picture up to three times
color it and print it. On each iPad, a child can print 3 pages a day without asking, and you can change that number or turn it off
ask you for more pictures, or for a print once the day's pages are used up
speak an idea, but only if you turn on voice input for that child

A child can't:

chat or send messages to anyone
share or post a picture, or see other families' pictures
see ads, open links out of the app, or buy anything
sign in, or see your email address

Saving pictures to Photos is off until you turn it on, when you set up the first child or later in the parents' area.

What we collect and why

Data	Comes from	What we use it for	Legal basis	How long we keep it
Your email address	You	Signing you in. Sending you your children's requests for more pictures or for a print. Checking it's you before the account is deleted.	Contract	Until you delete the family account
Sign-in attempts: your email, a random id for the iPad, its language and time zone, the code in scrambled form	You and the iPad	Checking the code and stopping anyone who tries to guess it	Contract, legitimate interest	One hour. A code works for 10 minutes.
Family settings: the language and time zone of the iPad you first sign in on	The iPad	Starting each child's week on Monday in your time zone, and writing our emails in your language	Contract	Until you delete the family account
Each child's profile: first name or nickname, age band, language, avatar, color, interests, and the settings and limits you choose	You enter the name, age band and language. Your child picks the avatar, color and interests from the app's own choices.	Showing the right child on every iPad, and fitting each picture to the child's age	Contract	The name and interests: until you remove the child, then 90 more days. The rest, without the name: until you delete the family account. See "Removing one child".
Ideas: the words your child taps, types or says to ask for a picture or a change, and what Surprise me fills in	Your child, or a grown-up who types it for a young child	Drawing the picture	Contract	Until you remove the child, then 90 more days, or until you delete the family account
Pictures and coloring: each page, its title, every version after a change, the suggested changes, your child's coloring, and an older copy of the coloring when two iPads change the same picture	Pinito draws the page, your child colors it	Keeping the pictures on every iPad in your family and bringing them back after a reinstall	Contract	Until you remove the child, then 90 more days, or until you delete the family account. After those 90 days, a blank record of each picture, with no image and no words, stays until you delete the account.
Requests and print history: requests for more pictures or a print, your answers, the prints you approved, and each week's counts	Your child and you	Running the limits you set and showing you the print history	Contract	Until you remove the child, then 90 more days, or until you delete the family account
iPads and sessions: a random id the app makes for each iPad, its language, the app version, when it last connected, and the keys that keep it signed in	The iPad	Keeping each iPad signed in, and ending every sign-in when you delete the account	Contract, legitimate interest	Until you delete the family account. Sign-in keys last up to 90 days, and expired ones are removed.
Plan status: whether your family has a trial or a plan, which plan, and when it renews or ends	Apple, through RevenueCat	Unlocking new pictures for your family	Contract	Until you delete the family account
Word suggestions: the words suggested for a sentence	OpenAI	Showing the word chips faster when the same request comes again	Legitimate interest	Up to 7 days in our server's cache. The cache holds only the suggested words, filed under a scrambled key made from the request, and doesn't name your child. Deleting the account doesn't clear it early. It expires on its own.
Usage records: how many AI requests a picture took and what they cost us, tied to the child's random id	Our servers	Keeping costs in check and spotting misuse	Legitimate interest	Until you delete the family account
IP address and request details	The iPad, or the browser that opens a link in our email	Counting sign-in attempts and visits to the links in our emails, to block abuse	Legitimate interest	Our counters keep the IP address and the iPad's random id for at most one hour. For Cloudflare's own logs, see "How long we keep data".
Emails you send us	You	Answering you	Legitimate interest	[SUPPORT EMAIL RETENTION]

What the legal bases mean:

Contract. We need the data to give your family the service you asked for. GDPR Article 6(1)(b).
Legitimate interest. We need it to keep Pinito safe and working, and this doesn't outweigh your family's rights. GDPR Article 6(1)(f). You can object, see "Your rights".

You don't have to give us any of this. Without your email address Pinito can't make an account, and without a child's age band it can't fit pictures to the child. We don't make decisions about you or your children by automated means that have legal or similarly serious effects.

Please keep ideas to things to draw. If your child types a full name, an address or something private, it goes along with the idea.

What stays on the iPad

What your child says. With voice input on, the iPad turns speech into words by itself. The recording never leaves the iPad. Only the words go out, as the idea. If a grown-up uses the dictation key on the iPad's keyboard instead, that is Apple's dictation and follows Apple's privacy rules.
Face ID and Touch ID. iPadOS runs the check, and Pinito only learns whether it passed.
Photos. Pictures you save stay in your photo library, even after you delete the account. Pinito doesn't upload anything from your photo library. If you turn on "Keep them in an album", iPadOS asks for full Photos access, which Pinito uses only to put its own pictures into its album.
A few settings and records live only on that iPad, such as spoken guidance, how many pages a child may print each day without asking, and the prints made within that number.

What we don't collect

Pinito has no camera feature and never asks for your location or your contacts. It doesn't use the advertising identifier. It has no analytics, crash reporting or advertising software inside. Apart from Apple's own code libraries, the only outside software in the app is RevenueCat's, for the subscription. If you have chosen in the iPad's settings to share analytics with app developers, Apple may send us crash reports that don't identify you.

The AI part, in plain words

Pinito uses AI to draw the picture from your child's idea. The AI comes from OpenAI. Here is what happens to an idea.

What OpenAI receives. The app sends the idea to our server, and our server sends OpenAI:

the words of the idea, and the choices Surprise me filled in
the child's age band, the picture content setting you chose, and the language for the picture's title
for a change: the picture, the words for the change, and the spot your child circled
for the suggested changes: a small copy of the picture and its idea
for the word chips under the idea field: the sentence typed so far, the child's interests, the theme they picked, the titles of their recent pictures, and a scrambled code that groups one child's chip requests so OpenAI can answer faster
for a reference: the search words, and small copies of the photos the search finds on other websites
for the final check: every new or changed page

OpenAI doesn't receive the name in your child's profile, your email address or your account details. If a child types a name into an idea, that name goes to OpenAI with the idea. We send pictures to OpenAI as the image itself, never as a link to our storage, and your child's coloring never goes to OpenAI.

The scrambled code is made from the random id we give each child, and it stays the same for that child. It lets OpenAI tell that several chip requests come from the same child. It doesn't tell OpenAI the child's name or who the child is.

The idea is rewritten for your child's age. An OpenAI text model turns the idea into one scene and a title. For ages 3 to 5 it allows nothing violent, scary or sad. For 6 to 8 it allows storybook adventure, like a knight's sword, with nobody hurt. For 9 to 12 it allows mild adventure, with nothing gory or truly violent. You can make pictures gentler for any child in the parents' area, under Picture content. The model doesn't refuse an idea. It turns an unsuitable idea into the closest version that fits the age.

The page is drawn. An OpenAI image model draws a black-and-white page. The model has its own content rules and sometimes refuses. Then your child sees "That's one I can't draw.", and the try doesn't count against the week's pictures.

Sometimes a reference is looked up first. When an idea names one specific thing, like a certain model of car, OpenAI's web search may look for a photo of it so the drawing looks right. The search words come from the rewritten idea. We don't filter the search or its results. The page drawn from it gets the same check as every other page.

Every finished page is checked. Before your child sees a new or changed page, it goes through OpenAI's moderation check. If the check finds sexual or violent content, or if the check can't run, Pinito throws the page away and your child never sees it.

Pinito doesn't block words before drawing. The rewrite fits the idea to your child's age, and the check on the finished page is the final stop. No check is perfect. If a page seems wrong for your child, write to us at [SUPPORT EMAIL].

We don't use your children's ideas or pictures to train AI models, and we don't sell them.

What OpenAI keeps. Every request to OpenAI's text models asks OpenAI not to store it. OpenAI's image and moderation services have no such setting. OpenAI processes the data on its own servers, which aren't limited to one region.

[TODO COL-175] Still to confirm with OpenAI: how long it keeps requests for abuse monitoring (its documented default is up to 30 days for text and image requests); whether zero data retention or modified abuse monitoring is approved for our account; that sharing data for training is off for our account; that logging and evaluation capture are off in our OpenAI project; and which search provider OpenAI's web search sends the search words to. Add each answer here, then remove this note.

Who helps us run Pinito

These companies process data for us. Each may use it only to do this work for us. [DPA STATUS: CONFIRM A SIGNED DATA PROCESSING AGREEMENT WITH CLOUDFLARE, OPENAI, REVENUECAT AND THE SUPPORT EMAIL PROVIDER]

Company	What it does for us	What it receives
Cloudflare, Inc.	Runs our servers, database and picture storage. Sends our sign-in and request emails. Makes the small copies of pictures. Keeps technical logs.	Everything kept in your family account, and the emails we send you
OpenAI	Rewrites ideas, draws and changes pages, checks every finished page, suggests next words and changes, and looks up references	What is listed under "The AI part"
RevenueCat, Inc.	Keeps track of your family's subscription	A random family id, the purchase and subscription records Apple shares, and technical details its software sends, such as the app version and the iPad's system version
[SUPPORT EMAIL PROVIDER]	Holds the emails you send us	Your email and what you write

A print request email names the child and the picture's title, and carries a small copy of the picture. A request for more pictures names only the child.

Apple sells the subscription, takes the payment, handles refunds and runs Family Sharing. Apple does this as its own controller, under Apple's privacy policy. We never see your payment details.

Where your data is stored

Our servers, database and picture storage run on Cloudflare's network. We haven't pinned them to one region yet, so we can't promise which country your data is stored in. [DATA LOCATION: IF THE DATABASE AND PICTURE STORAGE MOVE TO CLOUDFLARE'S EU JURISDICTION, SAY THAT THE FAMILY ACCOUNT AND PICTURES ARE STORED IN THE EU, AND THAT OPENAI, OUR EMAILS, LOGS AND SHORT-LIVED CACHES STILL RUN OUTSIDE IT. NEVER SAY ALL DATA STAYS IN THE EU.] OpenAI and RevenueCat are based in the United States. When data goes outside the European Economic Area, we rely on [TRANSFER BASIS], such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Write to us for a copy of the safeguards.

How long we keep data, and how you delete it

We keep your family's data while you use Pinito, and delete it when you delete the family account. [INACTIVE ACCOUNTS: STATE WHAT HAPPENS TO A FAMILY ACCOUNT THAT ISN'T USED FOR A SET TIME, FOR EXAMPLE "IF NO IPAD CONNECTS FOR 24 MONTHS, WE EMAIL YOU AND THEN DELETE THE ACCOUNT"]

Removing one child. In the parents' area, tap the child, then "Remove [name] from the account". The child and all their pictures disappear from every iPad in the family. We keep the child's data on our server for 90 more days, so we can bring it back if you ask us. After 90 days we delete the child's ideas, pictures, coloring and requests, and blank the name and interests. A record with no name stays until you delete the family account. It holds the child's age band, language, avatar, color, settings and dates. For each picture it keeps a blank record and what the picture cost us, with no image and no words. We keep it for our usage records.

[TODO COL-175] A way to erase a removed child at once is on the fix list. Until it ships, a removed child's data stays the full 90 days. Once it ships, add: "If you want it gone sooner, write to us and we will erase it at once."

Deleting the family account. In the parents' area, tap "Delete the family account" at the bottom of the Family screen. We email you a code to check it's you. When you confirm, we do this:

We delete your family's records from our database in one step: the children's profiles, ideas, pictures, coloring, requests, print history, iPads and sessions.
We delete the stored picture files at once, then check again after an hour, a day, a week and weekly after that, until two checks in a row find nothing.
Five minutes later we ask RevenueCat to delete its record of your family, and we retry for several hours if it fails.
Other iPads lose the account the next time they connect.

Deleting the account doesn't cancel your subscription. Cancel it in the iPad's Settings, under your name, then Subscriptions. Pictures you saved to Photos stay there.

Signing out takes the family off that iPad only. The account stays, and signing in again brings it back.

Backups and logs. Our database can be rolled back to any point in the last 30 days, so data you delete can still exist in that copy for up to 30 days. Cloudflare keeps our request logs for up to 7 days. Those logs leave out ideas, prompts and picture titles, and show an email address only in masked form.

[TODO COL-175] Still to confirm: whether Cloudflare's request logs hold IP addresses, and how long Cloudflare keeps the logs of the emails we send. Add both here, then remove this note.

Your rights

Under the GDPR you, as the parent, can ask us to:

show you the data we hold about your family and give you a copy
correct it
delete it
limit how we use it, or stop using it where we rely on legitimate interest
give it to you in a common format so you can take it elsewhere

Some of this you can do yourself in the app. To change a child's name, age band or language, open the child in the parents' area and tap "Name and language". To keep a copy of every picture, turn on "Save to Photos" under "Photos on this iPad", then tap "Save all pictures now". To remove a child or delete the family account, follow the steps above.

For anything else, write to [SUPPORT EMAIL] from the email address of your family account, so we know it's you. We answer within one month. You can also complain to the data protection authority where you live, or to [LEAD SUPERVISORY AUTHORITY].

For parents in the United States

This part is our notice under the Children's Online Privacy Protection Act, COPPA.

What we collect from children under 13. The ideas they tap, type or say, which may hold anything a child types; the avatar, color and interests they pick; their coloring; and their requests for more pictures or a print. The parent enters the child's first name or nickname, age band and language. Speech never leaves the iPad, only the words do. To run the service we also handle a few technical identifiers: a random id the app makes for the iPad, the IP address, usage records tied to the child's random id, and a scrambled code that groups one child's word-chip requests. We use these only to run Pinito and keep it safe.

How we use it. Only to draw and keep the child's pictures, to run the limits you set and to keep Pinito safe. Never for ads, profiling or selling.

Who we disclose it to. OpenAI, to rewrite, draw and check pictures. Cloudflare, to store the data and send our emails. RevenueCat gets no names, ideas or pictures. Its software in the app sends the random family id and technical details from the iPad, such as the app version. We don't disclose children's data to anyone else, unless the law requires it.

How you give consent. You sign in with your email address and prove it's yours with the code we send. Then you add each child yourself, in the parents' area. We collect nothing from a child before you have done this. [PARENTAL CONSENT METHOD: LAWYER TO CONFIRM THIS COUNTS AS VERIFIABLE PARENTAL CONSENT UNDER COPPA, INCLUDING SEPARATE CONSENT FOR SENDING CHILDREN'S IDEAS TO OPENAI, OR NAME THE METHOD TO ADD]

Your choices. You can review your child's data in the app or ask us for it. You can remove the child or delete the whole account at any time, which stops all further collection. You can turn off voice input for any child. We never ask a child for more data than drawing a picture needs.

You can reach us at [CONTROLLER NAME], [CONTROLLER ADDRESS], by phone at [CONTROLLER PHONE] or by email at [SUPPORT EMAIL].

Security

Everything between the app and our server travels encrypted.
The parents' area opens only after Face ID, Touch ID or the iPad's passcode, if the iPad has a passcode set.
A sign-in code works for 10 minutes and allows five wrong tries. We store it only in scrambled form.
Pictures sit in private storage. The app gets links to them that stop working after an hour.
An iPad stays signed in with keys that renew themselves. Deleting the account cancels every key at once.
Our own logs leave out your children's ideas, prompts and picture titles, and show an email address only as its first letter and domain.

No system is perfect. If something goes wrong that puts your family's data at risk, we will tell you and the authorities as the law requires.

Our website

This website, pinito.app, is hosted on Cloudflare. It sets no cookies, uses no analytics and loads nothing from other websites. When you open a page, Cloudflare's network handles your IP address to deliver the page and to block attacks.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change affects how we use your family's data, we email the address of your family account before it applies.

Contact us

[CONTROLLER NAME]
[CONTROLLER ADDRESS]
[SUPPORT EMAIL]