Privacy Policy
Last updated: 15 July 2026
DrawTogether ("we", "the app") is a private collaborative drawing product
for families. Parents hold accounts; children use parent-created profiles
and never create independent accounts.
Who this policy covers
- Parents / guardians — account holders who manage households, connections, and safety settings.
- Children — profile users who draw solo or with parent-approved friends. We minimise child data by design.
Information we collect
Parent / guardian
- Email address and authentication credentials (via our provider, Supabase Auth)
- Display name
- Parent PIN (stored only as a one-way hash; we never store the raw PIN)
- Optional push notification device tokens (only if you opt in)
- Device session labels for parent security (e.g. platform name)
- Consent records when you accept household terms versions
Child profiles (minimal)
- Nickname (first name / nickname only)
- Broad age group (category, not a birth date)
- Illustrated avatar identifier and optional preferred drawing colour
- Artwork images you choose to save, and collaborative drawing room activity necessary to operate the product
- Safety reports a child submits ("Tell a grown-up") and related audit metadata
We do not collect
- Child email addresses or phone numbers
- Exact birth dates or school names
- Facial photographs for identity
- Advertising IDs or behavioural ad profiles
- Public social discovery data (there is no stranger discovery)
How we use information
- Operate accounts, households, and parent PIN protection
- Enable parent-approved friend connections and collaborative drawing
- Store gallery artwork for your household
- Deliver optional parent safety-report alerts
- Enforce play hours and collaboration controls you configure
- Provide genuine deletion of child data at a parent's request
Sharing
We use infrastructure providers that process data on our behalf, notably Supabase (authentication, database, storage, realtime, edge functions). We do not sell personal data. We do not use advertising or analytics SDKs in the current release.
Storage and security
- Artwork and snapshots live in private cloud storage with access controlled by household membership.
- Sensitive actions are authorised server-side.
- Transport uses HTTPS.
Retention and deletion
- Parents may delete child profiles and associated data from Privacy settings.
- Parent account deletion removes associated household membership and related child data as implemented in our backend deletion flows.
- Push tokens are removed when you turn notifications off.
Children's privacy
DrawTogether is designed for parental control and data minimisation
consistent with COPPA / GDPR principles: children do not create accounts;
connections require parent approval on both sides; camera and notification
features are parent-only.
Your choices
- Manage children, connections, play hours, and safety reports in parent settings (PIN-gated)
- Opt in or out of push safety alerts
- Request deletion of child data from Privacy settings
- Sign out of parent sessions
Contact
Email: [email protected]
Changes
We may update this policy. Material changes will be communicated to account holders and reflected in an updated "Last updated" date.