Your photos. Your choices.

1. Who to contact

Qin is the contact for privacy questions, access or correction requests, withdrawal of consent and complaints. Contact Qin at @qinatthedisco on Instagram. Start with “Doodlé privacy request”.

Include the relevant date and a description of the issue. Do not send identity documents or someone else’s photos in your initial message. We may ask for proportionate information to identify records and protect other people’s privacy.

2. What you choose to send

Choosing Create or Fix asks us to process selected source and reference photos, your instructions and generation settings. A correction can also use the current illustration and original photo. Necessary image information is sent to OpenAI to produce the result.

Only submit images you have the right and permission to process, including permission from identifiable people where required. Obtain parent or guardian permission for children’s photos. Avoid identity documents, financial records and other sensitive material.

3. How image processing works

The app handles images in server memory. It does not write uploaded or generated images to its quota, analytics or cost-history files. Submitting a photo does not automatically publish it in Explore or any public gallery.

If you use the server download option, the existing image is sent to our server and returned as a file. That route does not generate another image or save it in the app’s server history.

Providers have their own processing and retention practices. These statements about the app’s files do not mean that all providers retain no information.

4. What stays in your browser

Saved Keepsakes, references, preferences and the current collectible-card draft are stored in your browser on your device. The app also keeps temporary browser-local result copies for recovery. They do not automatically sync across devices and are not a cloud backup.

You can remove Keepsakes and saved references in the app. Clearing site data removes local artwork, drafts, choices and any owner code stored there. Download anything you want to keep first. Deleting a local copy cannot recall content already shared with another app.

5. Essential allowance and service records

The public allowance is three image creations per public IP address per day, resetting at 08:00 Singapore time (00:00 UTC). Browsers and devices sharing that address share the allowance. Clearing cookies does not restore it. Changing networks or using a VPN may change the address. Owner creations do not consume the public allowance.

To enforce limits and protect the service, the server reads the verified connection address and stores a keyed hash rather than the raw address in its quota database. It also uses a signed session cookie lasting up to seven days, request identifiers, timestamps, reservation amounts and outcome codes. A keyed hash is a pseudonymous identifier, not a guarantee of anonymity. Infrastructure providers may separately process IP addresses in connection and security logs.

Generation metadata includes the selected style, request type, timing, result, provider usage information when returned and cost estimates. These records support security, troubleshooting, duplicate-charge prevention and spending controls.

Photos and custom messages are not included in app analytics events or the operational ledger. Essential service records continue even when optional analytics are off.

6. Optional analytics and your choice

Optional usage analytics are off until you allow them. If allowed, a browser identifier helps us understand page visits and actions such as selecting a photo, creating, saving, sharing or using a card. Events can include broad browser or device categories and broad referral sources. They do not include your photo or custom message.

If you allow analytics, a pseudonymous version of that browser identifier may also be attached to generation metadata so we can understand repeat use and troubleshoot requests. Detailed usage events are reduced to the most recent 30 days or 10,000 events when new activity is saved. Generation metadata, including an identifier attached while analytics were allowed, is reduced to the most recent 90 days or 5,000 records when a new generation record is saved. Turning analytics off stops future optional collection; it does not automatically erase records already received.

The app respects Do Not Track and Global Privacy Control. Choosing No thanks does not prevent creation, saving or sharing. Use the controls below to change the choice for this browser.

Turning analytics off clears the pending browser event queue and stops future optional collection on that browser. A request already sent may have been received. Contact Qin about information already held. Choices on one device do not automatically apply to another.

7. Providers and processing outside Singapore

Render hosts the application and OpenAI processes image requests. These providers may process information outside Singapore. External links and sharing destinations have their own privacy practices.

Doodlé does not sell your photos or use them for advertising. See Planned advertising and your choices for the proposed Google AdSense setup.

OpenAI states that API data is not used to train its models unless the account operator opts in. Its default abuse-monitoring retention may include customer content for up to 30 days, with exceptions for specified safety or legal purposes. Settings, endpoints and exceptions matter; Doodlé does not promise zero provider retention. See OpenAI’s data controls and Render’s privacy notice.

8. How long records stay

• Quota jobs: jobs older than 30 days are removed when the server starts or admits a new request, provided the reservation has expired.
• Detailed optional analytics: reduced to the most recent 30 days or 10,000 events when new activity is saved.
• Generation cost metadata: reduced to the most recent 90 days or 5,000 events when a new generation record is saved.
• Daily action totals: totals without browser identifiers may remain longer to show trends.
• Keepsakes, references and the current card draft: remain in the browser until removed, replaced or browser storage is cleared.
• Temporary result recovery: the browser keeps up to three recent result records. A record is available for recovery for up to 24 hours; older records are removed when another result is saved to that recovery store. Browser storage controls can remove them sooner.

Financial entries, support correspondence, required security evidence and recovery backups are separate records. They are reviewed and removed when no longer needed for their stated purpose or applicable legal requirements. Live-data cleanup does not instantly erase older backups or records held by providers.

9. Feedback you send us

Submitting the feedback form sends your selected answers, optional message and submission time to Doodlé. They are stored privately on our server so Qin can review ideas, investigate problems and improve the app.

When email alerts are enabled, feedback is also sent to Qin’s private inbox through Resend, our email delivery provider. This does not publish your feedback. Please do not include photos, passwords, access codes or unnecessary personal information. Contact Qin if you want to ask about or delete feedback you sent.

10. Your requests and choices

You can stop future photo processing by not submitting another request. Contact Qin to withdraw consent for processing we control, request access or correction, ask about deletion or raise a complaint.

Doodlé has no consumer account and stores artwork locally. We may not be able to identify a server record from your name alone. We will explain if essential processing is needed to provide a feature, if a request cannot be fulfilled or if a record must be retained for a lawful purpose.

We assess security incidents and make notifications where required. This policy may change as the app changes. The current policy and its update date will remain available on the live site.

11. Planned advertising and your choices

We plan to use Google AdSense to help support Doodlé. Ads and advertising consent controls are not yet active on Doodlé.

How advertising may use information

When ads are enabled, Google and any other participating advertising providers may place or read cookies. These can help Google and its partners select ads using visits to Doodlé and other websites, subject to your choices and applicable requirements.

When a page uses Google advertising services, your browser can send Google the page address and your IP address. Google may use this information to deliver and measure ads, prevent fraud and, depending on your settings and consent, personalise advertising.

Read how Google uses information from partner sites and Google’s Privacy Policy.

Your choices

You can manage or turn off Google ad personalisation in Google Ad Settings. Turning off personalisation does not necessarily remove ads or all advertising-related processing.

Before advertising starts, we will provide the applicable consent controls and identify the participating providers, with links to their information and available choices. Where consent is required, you will be asked before the relevant cookies or personalisation are used. The controls will explain how to change or withdraw your choice.

Using Doodlé or accepting its terms does not itself give consent to optional advertising cookies or personalised ads. Advertising choices are separate from Doodlé’s optional usage analytics.