Privacy Policy
Imagine & Color · Effective 18 August 2026
Imagine & Color is a coloring book app for iPad. Your artwork stays on your device except for the temporary processing and retry cache described below. We built the app to collect as little as possible.
Who we are
Imagine & Color is made by Mark Zimlich, an independent developer, who is the data controller for the information described here. You can reach us at support@ImagineAndColorApp.com.
What stays on your device
Your coloring pages, projects, palettes, and settings are stored on your iPad. If you turn on iCloud backup in the app, copies are stored in your own iCloud Drive and are not accessible to us.
The app creates a random anonymous purchase identity in the Apple Keychain so purchased Sparks can survive a reinstall. If iCloud Keychain is enabled, Apple may sync that identity to your other devices. It is not your Apple ID, name, or email, and we cannot use it to learn those details.
What our server processes
When you use the Studio, the app sends your chosen theme, category, and optional scene description to our server, which passes them to OpenAI to draw the coloring page and to screen the request for kid-appropriate content. Your scene description is not stored in our database. The finished page is held in a short-lived cache for up to 24 hours, so that an interrupted request gives you the page you already paid for rather than charging you twice.
The scene description is a free text box, so please do not type names, addresses, or anything else personal into it. Describe the picture you want, not the people you know.
To prevent abuse, the app uses Apple's App Attest. Our server keeps the pseudonymous records needed to run the service: the anonymous purchase identity, device verification records, the status of page-creation requests, Spark and membership balances, and a history of purchases. None of it is linked by us to a name, email address, Apple ID, advertising identifier, contacts, photos, or location.
When you buy a Spark Pack or a membership, Apple processes the payment. Our server receives Apple-signed transaction and lifecycle-notification data such as the transaction identifier, product, purchase environment, dates, status, and anonymous purchase identifier. We never receive your card or other payment details.
Our hosting provider may retain limited operational request metadata and error logs under our service configuration. Our application logs use random support references, request identifiers, the collection and theme you chose, and outcomes; they do not intentionally log scene descriptions or generated image contents. Financial and security records are kept as needed to operate the service, restore purchases, investigate abuse or disputes, and meet legal obligations.
Why we are allowed to process it
Where the UK or EU GDPR applies, we rely on these legal bases:
- To provide the app and deliver what you have bought — performance of our contract with you. This covers creating pages, tracking Sparks and memberships, and honouring purchases.
- To keep the service working and stop abuse — our legitimate interests in security, fraud prevention, and running a service that does not fall over. App Attest, request records, and rate limiting sit here.
- To keep financial records — our legal obligations for accounting, tax, and dispute handling.
We do not rely on consent for any of the above, so there is no consent to withdraw. We do not use your information for advertising or profiling, and we make no automated decisions that produce legal or similarly significant effects.
How long we keep it
- Generated pages in the retry cache: up to 24 hours.
- Page-creation request records: about 90 days, for support and abuse investigation.
- Purchase, ledger, and subscription records: up to 7 years, because accounting and tax rules require it.
- Device verification and security records: for as long as the anonymous account exists, then deleted with it.
- Operational logs held by our hosting provider: short-term, under that provider's own retention settings.
Deleting your server data removes the records that are eligible to go. The rest is kept only for the periods above.
Where it is processed
Our service providers are based in the United States, so information described here may be processed there. Where the UK or EU GDPR applies, those transfers rely on the safeguards each provider offers, such as standard contractual clauses or an approved adequacy framework.
Your rights
Wherever you live, you can ask us to delete eligible server records from inside the app: Settings › Legal › Data & Privacy › Delete Server Data. You can also email support@ImagineAndColorApp.com with the support reference shown in Settings, which is how we find your records without knowing who you are.
If the UK or EU GDPR applies to you, you have the right to access, correct, delete, port, restrict, and object to our processing of your personal information, and the right to complain to your data protection authority — in the UK, the Information Commissioner's Office.
If you live in California, you have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information and we do not use it for cross-context behavioural advertising, so there is nothing to opt out of. We will never treat you differently for exercising any of these rights.
Because the app has no accounts, we identify your records only by the support reference in Settings. Please include it, or we may not be able to find what you are asking about.
What the app doesn't do
- No advertising, no analytics SDKs, no tracking.
- No selling or sharing of data.
- No collection by us of names, emails, contacts, photos, location, or advertising identifiers.
Service providers
- Apple processes purchases and device attestation.
- Cloudflare hosts our server.
- OpenAI generates images and screens prompts. Requests are subject to OpenAI's API data handling terms; OpenAI does not train on API data.
iCloud
If you choose to back up your pages, they are copied to your own iCloud Drive under your Apple Account. That copy is yours — it is not sent to us and we cannot see it.
Children's privacy
The app is designed to be family-friendly and children use it. We do not ask for a name, email address, contact details, location, or photographs, and there is no sign-in, no profile, no chat, and no way for one person using the app to reach another.
The app does create the anonymous identifiers described above. We use them only to run the app, verify the device, prevent abuse, and make sure a purchase is honoured — never to build a profile, never for advertising, and never to contact anyone. We do not knowingly collect personal information from a child beyond that.
Purchases are made through the Apple Account that set up the device, and Apple's own parental controls and Ask to Buy govern whether a child can spend anything.
If you are a parent or guardian and believe your child has given us information we should not have, email support@ImagineAndColorApp.com and we will delete it.
Keeping it safe
Traffic between the app and our server is encrypted in transit. Requests are verified with Apple's App Attest before a page is drawn. Credentials are stored as one-way hashes, never in a readable form. Access to production data is limited to the developer. No system is perfectly secure, and we do not claim otherwise.
Deleting your data
Deleting the app removes its local artwork and settings, but may not remove an iCloud Drive backup, the synchronizable Keychain identity, or server-side purchase and security records. Use Settings → Legal → Data & Privacy → Delete Server Data to delete eligible server records, or contact us at support@ImagineAndColorApp.com with the support reference shown in Settings. Deletion forfeits remaining Sparks. Some transaction and ledger records may need to be retained for fraud prevention, accounting, dispute handling, or legal obligations.
This website
Everything above describes the app. This section is about imagineandcolorapp.com, the website you are reading, which is separate and behaves differently in one respect.
The website uses Cloudflare Web Analytics to count visits. It is cookieless: it sets no cookies, stores nothing on your device, does not fingerprint your browser, and cannot follow you to any other site. It reports totals — page views, referrer, country, device type — and never builds a profile of an individual. There is no advertising network, no third-party tracker, and nothing is sold or shared.
The app still collects no analytics of any kind. Turning on website measurement changed nothing inside the app, and the commitments above continue to describe it exactly.
Contact
support@ImagineAndColorApp.com
Changes
We will update this page and the effective date if our practices change.