Summary
Drawvy has no sign-in. Your drawings, progress and profiles are stored on your device. The app uses a random anonymous ID to talk to our servers. Free users see ads, and we use analytics and crash reporting to improve the app. AI feedback sends a photo to our AI provider to create the feedback, and the photo is not stored.
Data stored only on your device
The following stays on your device and is not sent to us. Operating system backups (iCloud, Google) may include it, under your OS settings.
- Your drawings, canvas layers, journal photos and exports
- Lesson progress, streaks, XP, badges and settings
- Profiles: name or nickname, avatar and age group
- Your drawing journal entries and AI results
Anonymous ID and our servers
On first launch the app signs in anonymously with Supabase, our backend provider. This creates a random ID with no name, email or phone number. We use it to protect our services from abuse (rate limits), to deliver remote app settings, to enforce AI usage limits and, for users aged 13 and over who allow notifications, to send push messages. The anonymous ID is also used as your purchase identifier with RevenueCat.
AI feedback and your photos
If you use AI feedback, the app sends a photo of your paper drawing and the lesson goal image to our server function, which forwards them to Anthropic, our AI provider, to produce a score and tips in your language. We do not store your photo or the goal image, and the photo is not kept in our database or storage. Anthropic acts as our service provider and handles the request under its commercial terms; it may keep API data for a limited period under its own policy, for example to prevent abuse. The score and tips are sent back to your device and saved only in your journal on your device. AI feedback is optional. For profiles under 13 it needs a parent to approve it through a parental gate.
To enforce the daily AI limits we keep a usage record tied to your anonymous ID: the day, how many AI feedback requests you used and, for each request, only metadata such as the lesson, language, age group (child, teen or adult), result status, response time, token counts and the score. This record contains no photo or drawing content. It is deleted when you use Delete my data.
Analytics, crash reports and notifications (Firebase)
We use Google Firebase to understand how the app is used and to fix crashes. Where the law requires it (for example in the EEA and UK) analytics and ad data are collected only after your consent.
- Firebase Analytics: events such as completing a lesson or opening a screen, with a random app instance ID
- Firebase Crashlytics: crash logs with device model, operating system and app version
- Firebase Cloud Messaging: a push token, only for users 13 and over who allow notifications. Under-13 profiles do not register for push and only get local reminders on the device
Ads (Google AdMob)
Free users see ads from Google AdMob. Premium users see none. In regions that require it, a consent message (Google UMP) asks for your choice, and on iOS the system asks for tracking permission (App Tracking Transparency). Depending on your choice, AdMob may use your advertising ID to show personalised ads, or only non-personalised ads. For under-13 profiles ads are child-directed, non-personalised and rated for general audiences. You can reset or limit your advertising ID in your device settings.
Purchases (RevenueCat, App Store, Google Play)
Payments are processed by Apple or Google. We never see your card details. We use RevenueCat to manage subscriptions. It receives your anonymous app user ID, the purchase status and entitlements, so we can unlock Premium and restore it on a new device.
Children
Drawvy is for a mixed audience, including children. At first launch we ask for age in a neutral way. For profiles under 13 we apply non-personalised, child-directed ads, no push registration, and parental gates for purchases and AI photo feedback. We do not knowingly collect personal information from children beyond what is described here. If you believe a child has given us personal information, contact us and we will delete it.
Who receives data
We share data only with service providers that run the app for us: Google (Firebase, AdMob), Supabase, RevenueCat, Anthropic (AI feedback only), and Apple or Google as the store. We do not sell your data. Some providers are located outside your country, including in the United States, and use safeguards such as standard contractual clauses.
Legal bases (GDPR, UK GDPR, KVKK)
We rely on: performance of a contract (providing the app and Premium), legitimate interests (security, crash fixing, basic analytics), and consent (personalised ads, analytics where required, AI photo feedback, notifications).
Retention
Data on your device stays until you delete it or uninstall the app. Anonymous server records are kept while the app is in use and are deleted when you use Delete my data. Analytics and crash data are kept for the periods set in the provider settings. AI photos are not stored by us.
Your rights
Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and to complain to your data protection authority. Because there is no account, the quickest way to delete data is Settings, Delete my data in the app. See the delete data page. You can also email us.
This website
This website sets no cookies and uses no tracking pixels. We may count visits in aggregate with a cookieless, privacy-friendly analytics tool that does not store personal data or follow you across sites. If you use the email link, your email provider handles your message.
Security and changes
We use encrypted connections and limit access to our services. No system is perfectly secure. We will update this policy when the app changes and change the date above. Material changes are also announced in the app.
Contact
Questions or requests about privacy: use the email on the contact page.