🎨
DoodlePet
Legal

Privacy Policy

Effective Date: May 1, 2025  ·  Last Updated: September 12, 2026

🔍 The short version

🚫We don't collect personal information from children
📱Creatures, drawings and app data stay on your device — no accounts required
🤖Drawings go to OpenAI to be transformed, kept up to 30 days for abuse checks, never used to train AI
💳Purchases handled entirely by Apple
☁️Your token balance backs up to your own iCloud — we can't read it
🎨No ads, no analytics, no tracking, no data sold
👨‍👩‍👧App Store rated 4+, Made for Ages 6–8, COPPA compliant

1 Who We Are

DoodlePet is developed and published by Colazul Labs LLC ("we," "us," or "our"). DoodlePet is a mobile application available on the Apple App Store for iPhone and iPad that allows children to photograph hand-drawn creatures and transform them using AI into characters they can play with.

DoodlePet is distributed in the United States only. This Privacy Policy describes how we handle information in connection with DoodlePet. We are committed to protecting the privacy of all users, especially children.

2 Children's Privacy (COPPA)

DoodlePet is listed in the App Store's Kids Category with an age rating of 4+ and is Made for Ages 6–8. We comply with the Children's Online Privacy Protection Act (COPPA) and with Apple's Kids Category requirements.

✅ DoodlePet does not collect, store, or transmit any personal information from children. There are no accounts, no profiles, no names, no email addresses, and no location data collected from child users. Children never type free text anywhere in the app — every name and attribute is chosen by tapping an item from a preset list.

All creature data, drawings, transformed images and app state are stored locally on the device. We operate no server that receives or stores creature data. Two limited exceptions are described in Section 3: the single drawing image sent for AI transformation, and the numeric record of purchases backed up to the user's own iCloud account.

3 Information We Process

DoodlePet processes the following limited information to deliver its core features:

📸 Drawing Images (AI Transformation) When a user photographs a drawing and requests a transformation, that single image is transmitted over HTTPS for AI processing and the transformed image is returned and saved on the device. We do not store images on any server we operate. The image passes through our transformation proxy and then to OpenAI, both described below. Nothing else from the device — no other creature, no app data — is transmitted.
☁️ Transformation Proxy (Cloudflare Workers) Drawing images are not sent to OpenAI directly. They are sent over HTTPS to a proxy we operate on Cloudflare Workers, which forwards the image to OpenAI and returns the result. The proxy exists so that our AI service credentials are never placed inside the app. The proxy does not store drawings, transformed images, or creature data. It writes a short operational log entry for each request — timestamp, HTTP status code, and country. These log entries do not include the device's IP address. IP logging was removed on 11 September 2026. The proxy still reads the IP address momentarily to rate-limit abuse, but does not record or store it. Cloudflare's handling of data in transit is governed by its own Privacy Policy.
🤖 AI Processing (OpenAI) The drawing image is processed by OpenAI's image API to produce the transformed character. Two things about this are worth stating plainly rather than burying.

OpenAI does not use it to train its models. Its service agreement commits that customer content is not used to develop or improve its services unless the customer explicitly agrees, and we have not agreed to that.

But the image is not deleted the moment it is processed. By default OpenAI keeps API inputs and outputs in abuse-monitoring logs for up to 30 days, and then deletes them. That retention exists so OpenAI can investigate misuse of its own service. Removing it requires a separately approved Zero Data Retention agreement, which we do not have. We would rather tell you that than let “we don't store your drawings” imply something broader than it means.

OpenAI's handling of API data is governed by its Privacy Policy and API usage terms.
💳 In-App Purchases (Apple StoreKit 2) All purchases are processed entirely by Apple. We do not receive, handle, or store payment information. Purchase records are managed by Apple's App Store and the StoreKit 2 framework. Apple's Privacy Policy governs these transactions.
🔄 Purchase Backup (Apple iCloud Key-Value Store) So that reinstalling the app or moving to a new device does not destroy tokens a family has already paid for, DoodlePet backs up a small amount of numeric purchase state — the remaining token balance, whether the one-time feature unlock has been purchased, and a cumulative count of tokens spent — to Apple's iCloud Key-Value Store. This data is stored in the user's own iCloud account. Colazul Labs LLC has no access to it and cannot read it. No drawings, creature images, names, or personal information are ever synced. This backup can be turned off in iOS Settings by disabling iCloud Drive for DoodlePet.
📲 Device-Local Storage Creature images, drawings, room and canvas state, and app preferences are stored locally in the device's app sandbox (Documents directory and UserDefaults). This data is not transmitted anywhere except as described above.

4 What We Do NOT Do

5 Camera Permission

DoodlePet requests access to the device's camera and photo library so that a child can photograph a hand-drawn creature. This is the core function of the app.

Photos taken within the app are saved locally on the device. A photographed drawing is transmitted for AI transformation as described in Section 3 and is not shared with any other third party.

Camera permission can be revoked at any time in the device's Settings app. The app will continue to work for viewing existing creatures; new transformations will not be possible without camera access.

6 Third-Party Services

DoodlePet uses the following third-party services. Each operates under its own privacy policy:

Cloudflare Transformation proxy (Cloudflare Workers). Processes drawing images in transit; does not store them. cloudflare.com/privacypolicy
OpenAI Image transformation API. openai.com/policies/privacy-policy
Apple App Store / StoreKit 2 In-app purchase processing. apple.com/legal/privacy
Apple iCloud (Key-Value Store) Backup of numeric purchase state into the user's own iCloud account. apple.com/legal/privacy

7 Parental Rights

Because DoodlePet stores creature data on the device and does not collect personal information from children, there is no account or centralized profile for us to access, correct, or delete. All creature data is removed by deleting the app from the device.

The numeric purchase state described in Section 3 lives in the family's own iCloud account. It can be disabled in iOS Settings by turning off iCloud Drive for DoodlePet, and it is removed with the rest of the app's iCloud data through Apple's standard iCloud storage management.

Every purchase in DoodlePet is gated behind Apple's native payment authentication (Face ID, Touch ID, or the Apple ID password), so a purchase cannot complete without an adult's credentials.

Parents with questions or concerns about their child's use of DoodlePet are welcome to contact us using the information in Section 9.

8 Data Security and Retention

We operate no server that stores user data. The only content transmitted from the device is the single drawing image sent for transformation, which travels over HTTPS through our Cloudflare Workers proxy to OpenAI. We do not store it at any point. OpenAI keeps it in abuse-monitoring logs for up to 30 days and then deletes it, and does not use it to train its models. This is described in full in Section 3.

Operational request logs at the proxy contain no image data, no creature data and no IP addresses. They are retained for a short operational period and are used only to keep the service running and to limit abuse.

All other app data is retained locally on the device until the app or the relevant data within it is deleted. Deleting the app removes all locally stored creature images and app state.

9 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

For material changes affecting children's data, we will make reasonable efforts to notify users through the app or App Store release notes.

Questions? We're here.

If you have questions about this Privacy Policy or DoodlePet's privacy practices — especially regarding your child's use of the app — please reach out.

[email protected]