WigglyPaint Privacy Policy

Effective Date: May 13, 2026 · Last Updated: May 13, 2026

1. The Two Products in Plain English

• WigglyPaint Drawing Tool (free). A drawing app that runs inside your browser. Brush strokes, animations, and exports all happen on your device. We do not upload your drawings or watch what you draw.
• AI Paint (paid, optional). You sign in, buy prepaid credits through Creem, and upload a photo. We send the photo to a third-party AI image-generation service to produce a stylized result. This requires us to process the data described below.
• Community gallery (optional). If you choose to publish artwork to the public Community gallery, that artwork becomes publicly visible alongside your profile name.

2. Information We Collect

2.1 If you only use the free Drawing Tool, signed out

• Standard server logs (IP address, user-agent, requested URL, timestamp) created by our hosting provider Cloudflare. These are retained for a short period for security and abuse prevention.
• Aggregated analytics from Google Analytics 4 (page views, device class, country). See "Cookies & similar technologies" below.
• Advertising data through Google AdSense on free, public pages. Ads are not loaded on AI Paint pages, sign-in / sign-up, your account pages (Profile, Edit Profile, Settings, Orders, Upload), the admin area, or these legal pages.
• Your drawings are not uploaded; they stay on your device unless you choose to export, share, or upload them.

2.2 If you create an account (required for AI Paint, Community uploads, profile)

• Account data: email address; a salted hash of your password if you sign up with a password; or your provider account identifier and basic profile (email, display name, avatar URL) if you sign in with a social provider such as Google. Session cookies that prove you are signed in.
• Profile data: the display name, handle, avatar, and bio you choose to put on your public profile.

2.3 If you use AI Paint

• Uploaded photos. The image you submit to the uploader. Stored on Cloudflare R2 inside our account, accessible only to you and to our backend.
• Selected template. Which AI Paint style preset (e.g. Crayon Kid, MS Paint Disaster) you chose.
• Generated images. The output the AI provider returns, stored alongside your account so you can find it later.
• Generation metadata. Timestamp, status, credit balance changes, provider task ID, and moderation decision.
• Payments. When you buy credits, Creem collects your payment details (card or other payment method, billing address, country) directly. We receive a confirmation containing the order ID, product purchased, amount, currency, and your customer ID at Creem — but we never see or store your full card number, CVC, or bank credentials.
• Order & credit ledger. Records of credit packs purchased, credits earned/spent/refunded, and the related Creem order ID. Visible to you on the Orders page.

3. Why We Process This Data (Legal Bases)

• To provide the Service you asked for — running the drawing tool, generating AI Paint images, displaying your account, processing your payments. Legal basis: performance of a contract (these Terms).
• To keep the Service safe — content moderation on AI Paint prompts (via Creem's moderation API), fraud prevention, abuse logging. Legal basis: legitimate interest in operating the Service.
• To meet legal obligations — tax records, sanctions screening that Creem performs on payments. Legal basis: legal obligation.
• To measure and improve the site — anonymized analytics on free pages. Legal basis: legitimate interest. In jurisdictions that require it, we ask for consent for non-essential cookies before loading them.
• To show ads on free, public pages — via Google AdSense. Ads are not loaded on AI Paint pages, sign-in / sign-up, account pages (Profile, Edit Profile, Settings, Orders, Upload), the admin area, or these legal pages.

4. Who We Share Data With

We share only what is necessary to operate the Service. The third parties we rely on are:

• Cloudflare — hosting, edge caching, R2 object storage for AI Paint uploads and outputs. Receives all standard server-log data and stored files.
• Creem (creem.io) — payment processor and prompt-moderation API. Receives the data needed to take payment from you (handled by Creem directly) and the AI Paint prompt text for safety screening before each generation.
• An AI image-generation provider — receives your uploaded photo and the preset prompt text in order to produce the AI Paint output. The provider is contractually limited to processing the request on our behalf.
• Google Analytics 4 (Google LLC) — receives site-usage data. GA4 does not log or store individual IP addresses by design.
• Google AdSense (Google LLC) — serves ads on free, public pages.
• Identity providers (e.g. Google) — only if you choose to sign in with that provider.

We do not sell your personal data, and we do not allow our processors to use your data for their own marketing.

5. How Long We Keep Data

• Drawings made in the free tool: not stored by us at all; lifetime is whatever your browser keeps them at.
• AI Paint uploads and generated images: kept as long as your account exists, so you can re-download them. You can delete individual items, or delete your account to remove them all. Cloudflare's edge cache may briefly retain copies after deletion.
• Account data: kept while your account is active, deleted within 30 days after you request account deletion (except where retention is required by law or for payment records).
• Payment & credit-ledger records: kept for the period required by financial and tax laws (typically 7 years), even after account deletion.
• Server logs: short retention by Cloudflare for security and abuse prevention.

6. Cookies & Similar Technologies

• Essential cookies: session cookies issued by our auth system to keep you signed in, plus a non-sensitive companion flag (wp_auth) used to hide/show the sign-in button without round-tripping to the server.
• Analytics cookies: set by Google Analytics 4 to count page views.
• Advertising cookies: set by Google AdSense on free, public pages.
• We do not currently use cookies for cross-site tracking beyond what Google's services include by default.
• You can disable cookies in your browser; the free drawing tool will still work, but sign-in will not function and some pages will not load analytics or ads.

7. Children

You must be at least 13 years old to create an account on WigglyPaint. The free drawing tool is suitable for all ages, but parents should supervise younger users' use of any third-party features (AI Paint, Community uploads). If we learn that we have collected personal data from a child under 13, we will delete it.

8. International Transfers

Our processors (Cloudflare, Google, Creem, the AI provider) operate global infrastructure, and your data may be processed in countries outside your own. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards put in place by those processors.

9. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your account and the personal data attached to it (you can do this yourself from the Settings page, or by emailing us);
• Request an export of your data (please email us — we do not yet have a self-service export);
• Object to or restrict processing based on legitimate interests;
• Withdraw consent for analytics or advertising cookies;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@wigglypaint.com from the address on your account. We will respond within the timeframe required by applicable law.

10. Security

We use HTTPS across the site, salted password hashing for password sign-ins, and least-privilege access controls for our processors. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you and any required authority in line with applicable law.

11. Changes to This Policy

When we make material changes that affect how we process your data, we will update the "Last Updated" date at the top of this page and, for changes that affect paid features, also notify signed-in users by email or in-product notice before the change takes effect.

12. Contact Us