Privacy Policy

Who we are

Colorkeet is published by Colorkeet, [Postal address], [Country] (“we”, “us” or “our”). We decide how the information described here is used, which makes us its “controller” under data protection laws such as the GDPR.

Questions or requests about privacy: hello@dodz.dev.

What this policy covers

This policy covers:

• the Colorkeet app for iPad (the “app”);
• the content service the app connects to for drawings, theme songs and subscription checks (the “content service”);
• this website, colorkeet.com.

When you use Apple services with the app, such as the App Store, iCloud and notifications, Apple handles that information under the Apple Privacy Policy.

Information we never collect

The app doesn’t ask for, collect or keep:

• names, email addresses, phone numbers or postal addresses;
• photos, camera or microphone input, contacts or location;
• advertising identifiers or any information for advertising;
• what your child colors, how long they play, or other usage analytics.

There’s no chat, no social feature, no public profile and no way for a child to send information to other people from inside the app.

Information the app uses, and why

On the iPad only

The age chosen at setup, the app’s settings (such as left or right hand, sound and the Idea button), downloaded drawings and your child’s artwork are stored on the iPad. We don’t receive any of it.

Artwork and iCloud

Sync My Art is on by default and can be changed in the parent area. When it’s on, artwork syncs through Apple’s iCloud (CloudKit) to the private iCloud storage of the Apple Account signed in on the iPad. That’s how it appears on your other iPads. Apple stores this data in your iCloud account under Apple’s Privacy Policy; we can’t access it. You can turn syncing off at any time.

The content service and the anonymous install ID

The free drawings come with the app. When the app needs anything else, such as the latest catalog, a drawing or a theme song, it connects to our content service.

To keep our content safe, the app first proves it’s the genuine Colorkeet app on a real Apple device, using Apple’s App Attest. The content service then gives it an access token that expires after 1 hour, tied to a random install ID created for that installation. The install ID isn’t linked to you, your Apple Account or your device’s hardware identifiers.

We use the install ID and token only to deliver content, to check whether Plus is active before a Plus download, and to protect the service from abuse, for example with rate limits.

The catalog lists the drawings for every age band and the app chooses which ones to show, so browsing never tells us your child’s age.

Subscription status

To unlock Plus downloads, the app sends the content service the signed purchase record Apple gives it after a purchase. We check Apple’s signature and keep the subscription’s status, linked to the install ID: the transaction identifier Apple assigns, the product, and when the subscription started and when it expires. Apple also sends us notifications when a subscription renews, ends or is refunded, so the status stays current. Apple’s record can include details such as the App Store country; we don’t use them to identify anyone. None of it includes your name, email address, Apple Account or payment details.

New collection alerts

Alerts are off until a parent turns them on in the parent area, behind the parental gate. When you turn them on, the app sends the content service:

• the push token Apple assigns to Colorkeet on that iPad;
• the age band, so a 3-year-old’s iPad never gets an alert about a teen collection;
• the time zone and your quiet hours (7 pm to 9 am by default), so alerts don’t arrive at night;
• the app’s language, so the alert is in the right language.

We use this only to tell you about new collections: about once a month, never more than once a week, and never for ads, sales or offers. Alerts are delivered by the Apple Push Notification service.

Turning alerts off in the app deletes this registration from our server. If the app is deleted, Apple tells us the token is no longer valid the next time we try to send an alert, and we delete it then.

Purchases

Colorkeet Plus is sold by Apple through the App Store. Apple handles payment, the free trial, renewals, cancellations and refunds under its own terms and privacy policy. We don’t receive your name or payment details. The purchase flow sits behind the parental gate, and with Family Sharing, Ask to Buy applies.

Sharing and printing

Sharing and printing sit behind the parental gate. Sharing uses the iPad’s own share sheet, so a picture goes only where you send it, such as Photos or Messages. Printing uses AirPrint. The optional “Colored by” line on a printout is blank, for writing a name by hand; the app doesn’t store a name. Nothing you share or print passes through our servers.

Reports from Apple

Apple gives app developers summary reports in App Store Connect, such as the number of downloads and sales. If you chose to share analytics with app developers in the iPad’s settings (Privacy & Security → Analytics & Improvements), Apple may also share crash reports and summary usage statistics with us. These don’t identify you or your child.

Basic connection details

Like any internet service, our servers see the IP address of the iPad or browser that connects, together with basic request details: the time, the address requested, and the app or browser version. Our hosting provider records them in request logs. We use them only to answer the request, keep the service secure and fix problems, and the logs are deleted after 30 days. We don’t use IP addresses to work out who or where anyone is.

This website

This website has no cookies, no analytics, no ads, no third-party scripts or fonts, and no forms. Our hosting provider keeps the request logs described above.

If you email us, we receive your email address and whatever you write. We use it only to reply, and we delete the conversation 12 months after the last message, unless we need it longer to meet a legal obligation. Please don’t send your child’s name, photos or other personal details.

Children’s privacy

Colorkeet is in the App Store’s Kids category for ages 5 and under, and it’s designed for children aged 3 and up, set up and supervised by a parent. We follow the US Children’s Online Privacy Protection Act (COPPA) and the extra protections the EU and UK GDPR give children (often called GDPR-K), including the UK Age Appropriate Design Code.

• No personal information from children. We don’t knowingly collect it. The install ID and push token are used only to run the app’s own features: delivering content, checking the subscription and sending alerts a parent asked for. They’re never used for advertising, profiling or tracking across apps and websites.
• No third-party code that tracks. The app contains no third-party advertising, analytics or tracking code.
• Parental gate. Purchases, the parent area (settings), sharing, printing, deleting artwork and every link that leaves the app, including links to this website, ask a grown-up question first.
• Alerts need a parent. Only a parent can turn on notifications, and children never see the iPad’s permission prompt.
• Privacy by default. Alerts, the only feature that sends anything about your child (the age band) to us, are off until a parent turns them on. Sync My Art is on by default, but it syncs only to your own iCloud.

If you think a child has sent us personal information, for example by email, contact us at hello@dodz.dev and we’ll delete it.

Legal bases (EU and UK)

Where the GDPR or UK GDPR applies, we rely on:

• providing the app you asked for (performance of a contract) for the content service, the install ID and subscription checks;
• consent for new collection alerts, which you can withdraw at any time by turning alerts off;
• legitimate interests in keeping our services secure and working (request logs, rate limits) and in answering your emails.

How long we keep information

Deleting information

You can delete information yourself at any time:

• One artwork: in My Art, tap the ••• button on the picture and choose Delete (it asks the grown-up question). With Sync My Art on, it’s deleted from iCloud too.
• All synced artwork: in the iPad’s Settings, tap your name, then iCloud, then Manage Storage (or Manage Account Storage), choose Colorkeet and delete its data.
• Stop syncing: turn off Sync My Art in the parent area.
• Downloaded drawings: in the parent area, under Downloads, tap Clear downloads.
• Alerts: turn off New collection alerts in the parent area. This deletes the registration from our server right away. Turning off notifications in the iPad’s Settings stops alerts on the iPad, but only the switch in the app deletes the registration from our server.
• Everything on the iPad: delete the app. Artwork synced to iCloud stays there until you delete it as described above. The install ID record is deleted after 12 months without contact, and the push token when Apple reports it’s no longer valid.

Because we don’t collect names or accounts, we usually can’t tell which records on our server belong to you, so the steps above are the fastest way to delete them. If you need help, email hello@dodz.dev.

Your rights

Depending on where you live, privacy laws such as the GDPR and UK GDPR, US state laws including California’s, and Brazil’s LGPD may give you the right to access, correct or delete personal information, to restrict or object to how it’s used, to receive a copy of it, and to withdraw consent. You can also complain to your data protection authority.

We don’t sell personal information, and we don’t share it for targeted advertising.

To use your rights, email hello@dodz.dev. We’ll reply within the time the law requires.

Who we share information with

We don’t sell information. We share it only with the providers that run the service for us, and only as needed:

• Railway, our hosting provider, which runs the content service, its database and file storage, and this website.
• Apple, which provides App Attest, the App Store, App Store Server Notifications, the Apple Push Notification service and iCloud. For services you use directly, Apple acts under its own privacy policy.

We may also disclose information if the law requires it, or to protect the safety of our users or our services. If Colorkeet is ever transferred to a new owner, this policy will continue to apply to information collected under it.

Where information is processed

The content service, its database and file storage, and this website are hosted by Railway in [Hosting region]. If you live elsewhere, the limited technical information described above (install ID, subscription status, alert registration and request logs) is processed there. When the law requires safeguards for these transfers, for example from the EU or UK, we rely on measures such as the European Commission’s Standard Contractual Clauses in our agreement with our hosting provider. Apple processes information for its services under its own policy.

Security

• All connections use HTTPS.
• Only the genuine app can use the content service, thanks to App Attest, and its access tokens expire after 1 hour.
• Drawings are kept in private storage and are reachable only through links that expire after 10 minutes.
• Administrative access uses separate keys with the least access needed, and every change is logged.
• The app contains no secrets or keys to our systems.

No system is perfectly secure. If you find a security problem, please tell us at hello@dodz.dev.

Changes to this policy

When we change this policy, we’ll update the “Last updated” date and add an entry to the change log below. If a change affects what the app collects, we’ll update this page before the change reaches the app and, where the law requires it, ask for your consent first. We’ll never start collecting personal information from children without verifiable parental consent.

Contact

[Postal address], [Country]

Email: hello@dodz.dev