Children's Privacy Policy

SayItColorIt.com — AI Coloring Page Creator for Kids

Plain-language summary: A parent account is required. We use a child's prompt only to moderate it and create the requested coloring page. We do not ask for the child's name, sell personal information, or show targeted ads. Parents can review, export, withdraw consent, or delete account data in the app.

1. Who We Are

SayItColorIt.com ("we", "our", "the app") is an AI-powered coloring page creator designed for children ages 3-12. This app is operated by Cimbolic Productions.

Because our app is directed to children under 13, it is designed to follow the Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule (16 CFR Part 312).

2. What Information We Collect

From Parents (via Google Sign-In)

Email address — for account management and consent verification
Name — to identify the parent in the consent record
Google account ID — a unique identifier for login (not shared externally)
Consent record — the notice version, date, verification method, and any withdrawal date

From Children

Text prompts — the words entered to create a coloring page. Prompt text is processed in memory and sent to our moderation and image providers, but is not written to our application database or application logs.
Speech transcripts — if the microphone button is used, the browser's speech recognition feature converts speech to text. SayItColorIt receives the transcript, not an audio recording. The browser provider may process audio under its own privacy terms.

Automatically Collected

Generated artwork — temporary coloring page files associated with the parent account so they can be downloaded or printed
Usage counts — how many pages have been generated (for free trial tracking)
Request metadata — limited operational logs such as time, route, response status, and network address. Prompt text is excluded from application logs.

Payment Information (Parents Only)

All payments are processed by Stripe. We do not receive or store the full card number. Stripe provides the payment status and Checkout Session identifier needed to prevent duplicate fulfillment. See Stripe's Privacy Policy.

3. What We Do NOT Collect

Physical address or phone number
Child name, date of birth, or exact age
Photos, videos, or stored audio recordings of children
Location data
Behavioral tracking or browsing history
Device identifiers for cross-site tracking
Social media profiles or friend lists

4. How We Use Information

Account management — logging in and tracking free trial / purchased credits
Creating coloring pages — sending prompts to our AI image generation service
Content safety — checking prompts through a moderation filter to block inappropriate content
Payment processing — credit purchases handled by Stripe
Parental controls — recording consent, withdrawal, export, and deletion choices

We do NOT: sell or rent personal information; show targeted advertising; create marketing profiles of children; share data with third parties for their marketing purposes; or use children's data for any purpose other than providing the coloring page service.

5. Third-Party Services

We use the following third-party services that may process data:

Google OAuth — for parent login authentication only. See Google's Privacy Policy.
OpenAI — prompt moderation and AI image generation. OpenAI receives the prompt solely so the app can provide the requested service. See OpenAI's privacy terms for how it processes service data.
Stripe — payment processing. See Stripe's Privacy Policy.
Vercel — website hosting and temporary storage of generated coloring pages, which are deleted after 24 hours. See Vercel's Privacy Policy.
Neon — database hosting for parent account, consent, and credit records. See Neon's Privacy Policy.

We do not use Google Analytics, Facebook Pixel, or any behavioral tracking tools.

6. Parental Consent (COPPA)

Before image generation is enabled, a parent or legal guardian must:

Sign in with their own Google account
Review the direct parental notice and this privacy policy
Explicitly authorize the collection, use, and integral service provider disclosures described there
Complete a $0.50 Stripe card transaction that includes one coloring credit and creates a discrete payment notification for the cardholder

A typed name or checkbox alone does not activate the account. Without the completed verification transaction, image generation and credit purchases remain blocked.

7. Your Rights as a Parent

At any time, you may:

View all account data through Parent Data Controls in the signed-in app
Export a copy as a portable JSON file through Parent Data Controls
Withdraw consent immediately, which disables image generation until a parent verifies again
Delete the account, its personal data, pending consent records, and associated temporary artwork

You may also email us for help with any of these requests.

8. Data Retention

Parent account and consent information — retained while the account is active and removed when the parent deletes the account
Prompt text — not stored in the SayItColorIt application database or application logs after the request completes
Generated artwork — expires after 24 hours and is removed by an hourly cleanup process, or sooner when the parent deletes the account
Unfinished verification attempts — removed within 48 hours; a completed attempt is reduced to the consent record on the parent account
Application logs — rotated daily and deleted within 30 days; prompt text is excluded
Payment records — retained by Stripe under Stripe's legal and operational retention requirements

Account deletion removes the user record and associated personal data immediately. We keep an anonymous deletion event and non-identifying Checkout fulfillment marker so the same payment cannot be credited twice.

9. Data Security

All data transmitted over HTTPS (encrypted in transit)
Session cookies are secure and HTTP-only in production
Content Security Policy headers protect against script injection
API keys and secrets are stored in environment variables, never in code
Prompt content is moderated before processing to ensure child safety

10. Contact Us

For privacy questions, data requests, or concerns about your child's information:

Email: privacy@sayitcolorit.com

If you believe we have collected information from a child without proper parental consent, please contact us immediately and we will delete the data.

11. Changes to This Policy

If we make material changes to these practices, we will provide parents direct notice and obtain new consent when required before applying the changed practices to children's information.

Effective Date: August 16, 2026 • Last Updated: August 16, 2026