WigglyPaint Privacy Policy

Effective Date: May 13, 2026 · Last Updated: August 22, 2026

1. The Two Products in Plain English

• WigglyPaint Drawing Tool (free). A drawing app that runs inside your browser. Brush strokes, animations, and exports all happen on your device. We do not upload your drawings or watch what you draw.
• WigglyPaint Android app. A mobile drawing app with optional Community, advertising, and Google Play subscription features. Drawings remain on your device unless you choose to publish them.
• AI Paint (paid, optional). You sign in, buy prepaid credits through Creem, and upload a photo. We send the photo to a third-party AI image-generation service to produce a stylized result. This requires us to process the data described below.
• Community gallery (optional). If you choose to publish artwork to the public Community gallery, that artwork becomes publicly visible alongside your profile name.

2. Information We Collect

2.1 If you only use the free Drawing Tool, signed out

• Standard server logs (IP address, user-agent, requested URL, timestamp) created by our hosting provider Cloudflare. These are retained for a short period for security and abuse prevention.
• Aggregated analytics from Google Analytics 4 (page views, device class, country). See "Cookies & similar technologies" below.
• Advertising data through Google AdSense on free, public pages. Ads are not loaded on AI Paint pages, sign-in / sign-up, your account pages (Profile, Edit Profile, Settings, Orders, Upload), the admin area, or these legal pages.
• Your drawings are not uploaded; they stay on your device unless you choose to export, share, or upload them.

2.2 If you use the Android app

• Google Mobile Ads SDK: automatically collects and shares an IP address (which may be used to estimate approximate location), app interactions such as app launches, taps, and ad video views, diagnostic information such as launch time, hang rate, and energy usage, and device or advertising identifiers. Google states that it uses these data for advertising, analytics, and fraud prevention. Data is encrypted in transit. Where required, the app presents Google's consent and privacy controls.
• Superwall subscription service: receives a random app user identifier while signed out and, after sign-in, our internal account ID; device and app information; paywall views and interactions; and Google Play purchase and subscription history. Superwall uses these data to select and display paywalls, determine subscription entitlements, restore purchases, and provide paywall and revenue analytics. We do not send your email address to Superwall.
• Community activity: Community posts, comments, and likes are optional. If you publish, we upload the artwork or photo you select, its thumbnail, title, optional description, and your public profile name. Posts and comments are shown publicly by design; likes are stored with your account.

2.3 If you create an account (required for AI Paint, Community uploads, profile)

• Account data: email address; a salted hash of your password if you sign up with a password; or your provider account identifier and basic profile (email, display name, avatar URL) if you sign in with a social provider such as Google. Session cookies that prove you are signed in.
• Profile data: the display name, handle, avatar, and bio you choose to put on your public profile.

2.4 If you use AI Paint

• Uploaded photos. The image you submit to the uploader. Stored on Cloudflare R2 inside our account, accessible only to you and to our backend.
• Selected template. Which AI Paint style preset (e.g. Crayon Kid, MS Paint Disaster) you chose.
• Generated images. The output the AI provider returns, stored alongside your account so you can find it later.
• Generation metadata. Timestamp, status, credit balance changes, provider task ID, and moderation decision.
• Payments. When you buy credits, Creem collects your payment details (card or other payment method, billing address, country) directly. We receive a confirmation containing the order ID, product purchased, amount, currency, and your customer ID at Creem — but we never see or store your full card number, CVC, or bank credentials.
• Order & credit ledger. Records of credit packs purchased, credits earned/spent/refunded, and the related Creem order ID. Visible to you on the Orders page.

3. Why We Process This Data (Legal Bases)

• To provide the Service you asked for — running the drawing tool, generating AI Paint images, displaying your account, processing your payments. Legal basis: performance of a contract (these Terms).
• To keep the Service safe — content moderation on AI Paint prompts (via Creem's moderation API), fraud prevention, abuse logging. Legal basis: legitimate interest in operating the Service.
• To meet legal obligations — tax records, sanctions screening that Creem performs on payments. Legal basis: legal obligation.
• To measure and improve the site — anonymized analytics on free pages. Legal basis: legitimate interest. In jurisdictions that require it, we ask for consent for non-essential cookies before loading them.
• To show ads on free, public pages — via Google AdSense. Ads are not loaded on AI Paint pages, sign-in / sign-up, account pages (Profile, Edit Profile, Settings, Orders, Upload), the admin area, or these legal pages.
• To operate Android ads and subscriptions — Google Mobile Ads supports ad delivery and measurement; Superwall and Google Play support paywalls, purchases, subscription status, restoration, and related analytics. Where consent is the appropriate legal basis, we request it through the available privacy controls.

4. Who We Share Data With

We share only what is necessary to operate the Service. The third parties we rely on are:

• Cloudflare — hosting, edge caching, R2 object storage for AI Paint uploads and outputs. Receives all standard server-log data and stored files.
• Creem (creem.io) — payment processor and prompt-moderation API. Receives the data needed to take payment from you (handled by Creem directly) and the AI Paint prompt text for safety screening before each generation.
• An AI image-generation provider — receives your uploaded photo and the preset prompt text in order to produce the AI Paint output. The provider is contractually limited to processing the request on our behalf.
• Google Analytics 4 (Google LLC) — receives site-usage data. GA4 does not log or store individual IP addresses by design.
• Google AdSense (Google LLC) — serves ads on free, public pages.
• Google Mobile Ads and Google Play (Google LLC) — serve ads in the Android app, process Android subscriptions, and provide purchase and entitlement information to the app.
• Superwall — provides Android paywalls, subscription entitlement management, purchase restoration, and paywall/revenue analytics using the Android data described in Section 2.2.
• Identity providers (e.g. Google) — only if you choose to sign in with that provider.

We do not sell your personal data, and we do not allow our processors to use your data for their own marketing.

5. How Long We Keep Data

• Drawings made in the free tool: not stored by us at all; lifetime is whatever your browser keeps them at.
• AI Paint uploads and generated images: kept as long as your account exists, so you can re-download them. You can delete individual items, or delete your account to remove them all. Cloudflare's edge cache may briefly retain copies after deletion.
• Account data: kept while your account is active, deleted within 30 days after you request account deletion (except where retention is required by law or for payment records).
• Payment & credit-ledger records: kept for the period required by financial and tax laws (typically 7 years), even after account deletion.
• Android advertising and subscription data: retained by Google and Superwall according to their service settings, legal obligations, and retention policies. We request deletion from service providers when it is required as part of an account-deletion request.
• Server logs: short retention by Cloudflare for security and abuse prevention.

6. Cookies & Similar Technologies

• Essential cookies: session cookies issued by our auth system to keep you signed in, plus a non-sensitive companion flag (wp_auth) used to hide/show the sign-in button without round-tripping to the server.
• Analytics cookies: set by Google Analytics 4 to count page views.
• Advertising cookies: set by Google AdSense on free, public pages.
• Android SDK storage: Google Mobile Ads and Superwall may store consent choices, identifiers, paywall assignments, and subscription state on the device; these are not browser cookies.
• We do not currently use cookies for cross-site tracking beyond what Google's services include by default.
• You can disable cookies in your browser; the free drawing tool will still work, but sign-in will not function and some pages will not load analytics or ads.

7. Children

You must be at least 13 years old to create an account on WigglyPaint. The free drawing tool is suitable for all ages, but parents should supervise younger users' use of any third-party features (AI Paint, Community uploads). If we learn that we have collected personal data from a child under 13, we will delete it.

8. International Transfers

Our processors (Cloudflare, Google, Creem, the AI provider) operate global infrastructure, and your data may be processed in countries outside your own. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards put in place by those processors.

9. Account and Data Deletion

Request WigglyPaint account deletion: in the Android app, signed-in users can open Settings → Account → Request account deletion. Anyone can also email support@wigglypaint.com from the address on the account. Include “WigglyPaint account deletion request” in the subject.

After we verify the request, we permanently delete the account and associated profile, Community posts, comments, uploaded artwork, AI Paint uploads, and generated images within 30 days. Records that must be retained for security, fraud prevention, tax, or other legal obligations are kept only for the required period described in Section 5.

Deleting a WigglyPaint account does not cancel an active Google Play subscription. Manage or cancel Google Play subscriptions separately in Google Play before deleting the account.

9.1 Your Other Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your account and the personal data attached to it;
• Request an export of your data (please email us — we do not yet have a self-service export);
• Object to or restrict processing based on legitimate interests;
• Withdraw consent for analytics or advertising cookies;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@wigglypaint.com from the address on your account. We will respond within the timeframe required by applicable law.

10. Security

We use HTTPS across the site, salted password hashing for password sign-ins, and least-privilege access controls for our processors. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you and any required authority in line with applicable law.

11. Changes to This Policy

When we make material changes that affect how we process your data, we will update the "Last Updated" date at the top of this page and, for changes that affect paid features, also notify signed-in users by email or in-product notice before the change takes effect.

12. Contact Us