Privacy Policy
Color A Picture, LLC (California) · colorapicture.com Effective date: October 27, 2026 · Last updated: October 27, 2026
This policy explains what we collect when you use Color a Picture, what we do with it, who else sees it, how long we keep it, and the choices you have. It is written to match how the service actually works. If we change how the service works in a way that matters, we change this policy first.
Contact: privacy@colorapicture.com · Color A Picture, LLC, 909 Heather Dr, San Carlos, CA 94070 · or use the form at colorapicture.com/contact.
1. The short version
- Color a Picture turns a photo or a short description into a printable coloring page.
- If you are not signed in, we never store the photo you upload. It is converted in memory and discarded.
- If you are signed in, we hold a reduced-size copy of your photo for up to one hour in private storage so our conversion queue can process it, and delete it as soon as the conversion finishes or fails — unless our child-safety hold applies, which is the one case we must keep it (sections 3a and 6).
- Every photo and every text description is sent to outside AI providers to be checked and converted. They are named in section 6. None of them is permitted to use your content to train their models.
- We keep the finished coloring page: in a shared cache for 7 days, and, if you are signed in, in your private library until you delete it.
- We do not sell your personal information, do not share it for advertising, and there is no advertising on the service. We will update this policy before any advertising is ever introduced.
- Accounts are for adults (teachers, parents, caregivers). We do not create accounts for children under 13 and do not knowingly collect their personal information.
2. Who this service is for, and children
Color a Picture is a tool for teachers, homeschool parents and caregivers. You must be 13 or older to create an account and 18 or older to buy anything. We expect children to sit with you and help choose what to make; that is the point of the product. But the account is the adult's, the uploads are the adult's choice, and we do not direct the service at children as customers.
Children under 13. We do not knowingly collect personal information from a child under 13, and we do not let children under 13 create accounts. We do not ask anyone's age or date of birth, because collecting that would itself be new personal information about every visitor. If we learn that an account belongs to a child under 13, or that a child under 13 has given us personal information, we delete it. Email privacy@colorapicture.com.
Photos of children. A photo you upload is sent to outside AI providers (section 6) to be converted. If it shows a recognisable child, that is a disclosure of the child's image to those providers. We ask you to prefer drawings, objects, pets and scenery, and we say so again at the point of upload. If you are a teacher, your school or district may require written parental permission before a student's image is sent to an outside service, and their rules govern. We are not a "school official" under FERPA, we do not sign student-data agreements today, and we do not collect students' names or any education records. Do not upload a student's photo unless you are authorised to.
3. What we collect, and why
3a. The photo you upload
| Not signed in | Signed in | |
|---|---|---|
| Where it goes first | Decoded in memory on our conversion server | Reduced-size copy written to a private storage bucket only our systems can read |
| How long | Discarded when the request finishes; never written to a file, log or cache | Deleted the moment the conversion finishes or fails; a daily sweep removes anything older than one hour as a backstop |
| What is removed | Camera metadata (EXIF, including location) is stripped when we re-encode the image before sending it to any AI provider | Same |
| Also sent to | The AI providers in section 6 | The AI providers in section 6 |
One exception to the row above. If a photo is still in that private storage when our child-safety hold is triggered (section 6), we preserve it instead of deleting it, for as long as the law requires us to keep material behind a report of suspected child sexual exploitation.
Before any conversion, every upload is checked automatically for content we do not allow (section 6: OpenAI moderation and Google Cloud Vision SafeSearch). A blocked upload is discarded and the attempt is recorded without the image.
A recovery thumbnail on your own device. When you are signed in, your browser keeps a tiny (≤96 px) thumbnail of the photo in its own local storage, only so a page reload during a conversion still shows what is running. It never leaves your device and is removed when the conversion finishes, or after 48 hours at most.
Your browser downscales the photo to 2048 px before upload. We never receive the full-resolution original.
3b. Descriptions you type (text-to-image)
If you ask for a page from a description, the description is sent to the providers in section 6 to be screened and drawn. The description is kept as the title of the resulting page in your library until you delete the page. Please do not type personal information into a description.
3c. The coloring pages we produce
- Shared cache, 7 days, everyone. We keep each finished page for 7 days, indexed by a fingerprint (SHA-256 hash) of the image it came from, so converting the same file twice is instant. The cache holds no account, email, session or IP information. Because it is keyed by the file's contents, two people who upload the byte-identical file get the same cached page. That cannot happen with a photo you took yourself.
- Your library, until you delete it, signed-in users only. Every page you make while signed in is saved privately to your account. We also generate a short text description and a numerical "embedding" of the finished line drawing (never the photo) so you can search your library; the description is written not to identify real people. Delete a page and its file, description and embedding are deleted with it.
- Pages carry an on-screen label that they were made by an AI model and not reviewed by a person. The downloaded file carries no hidden marking.
3d. Account and billing information
- Email address and sign-in method (magic link; Google sign-in where offered), an optional display name, your plan, and your marketing-email preference (off unless you turn it on).
- Credit balance and a ledger of every grant, purchase, spend, refund, expiry and dispute.
- If you subscribe or buy credits: your Stripe customer ID and Stripe's identifiers for the session, invoice and price. We never see or store card numbers; Stripe handles payment.
3e. Usage and abuse-prevention records
For every conversion request we record: a fingerprint of the uploaded image (not the image), whether you were signed in or your anonymous session ID, a hashed IP address (we store a keyed hash, not the address), your network provider's ASN and country, the request's outcome, which AI model produced the page, timings, and the automated safety-check results. We keep these records for 90 days to meter the free allowance and to detect abuse, then delete them automatically. If an upload or message triggers our child-safety hold (section 6), we keep the IP address and browser identifier (user agent) un-hashed with the preserved material, for the preservation period described there.
Signed-out visitors get a signed cookie (ec_anon, 30 days) that counts the
free conversion, and a short-lived per-network counter (about 48 hours) in
our rate-limiting store. Where we use Cloudflare Turnstile to tell people
from bots, your IP address is sent to Cloudflare for that check.
3f. Support, reports and feedback
- Problem reports on a page send us the finished page, the options you chose, and your note. We only receive your original photo if you have separately agreed in writing to a diagnostic arrangement with us, so we can re-run the conversion. Under that arrangement: if the report triggers our child-safety hold (section 6), we preserve the photo; otherwise it is kept with the report and removed when your account is finalised (section 7).
- Support tickets store your message, the email you give us for a reply, an optional screenshot, and context about your account and recent activity so we can help. Kept until resolved and for up to 24 months.
- Support messages, titles and descriptions are run through automated content checks (section 6).
3g. Technical logs and error reports
Server logs and error reports contain request IDs, timings and error text. They do not contain your images or your descriptions, and our error-reporting configuration does not attach your email or identity.
4. How we use information
To provide the service you asked for; to meter free use and prevent abuse; to take payment and keep required financial records; to answer support requests and problem reports; to keep the service secure; to send transactional email (sign-in links, receipts, account notices); to send marketing email only if you opted in; and to comply with law.
We do not use your photos, descriptions or pages to train AI models, to advertise, or for any public gallery. Our sample gallery is made from our own descriptions, never from users' content.
5. Advertising, cookies and tracking
- There is no advertising on Color a Picture. No advertising or third-party analytics scripts run on the site, we set no advertising cookies, and we use no advertising identifiers. If that ever changes, we will update this policy before any advertisement appears.
- We count page views, anonymously. Each time a page is opened, our own code adds one to a daily total for that page (for example, "/pricing: 41 views on a given day"). The count is sent without cookies, and what is stored is only the page name and the number: no IP address, no browser details, no referring site, no account and no identifier of any kind, so it cannot be tied to you or to a device. We keep the daily totals for about 13 months to see how the site is used. A browser that sends Global Privacy Control or Do Not Track is not counted at all.
- Cookies we set: your sign-in session (Supabase Auth), the
ec_anonfree-use counter, and, where Turnstile is enabled, Cloudflare's bot-check cookie. No advertising or analytics cookies; the page-view count above uses no cookie. - Do Not Track and Global Privacy Control. We do not sell or share personal information, so there is nothing for an opt-out signal to switch off; we treat a browser's GPC signal as confirmation of that choice. The one thing we do differently for a browser that sends GPC or "Do Not Track" is that it is left out of the anonymous page-view count above. We change nothing else for it, because we do no other tracking to disable.
6. Who receives your information (processors)
We use the following companies to run the service. Each receives only what is listed, only to provide its service to us, and none is permitted to use your content to train its models.
| Provider | What it receives | Why | Their retention, per their terms |
|---|---|---|---|
| OpenAI (US) | Every uploaded image and typed description, titles and support messages, for automated content moderation; the reduced-size image, for conversion by the gpt-image model; the finished line drawing, for the short searchable description; text-to-image descriptions, for screening and drawing | Safety checks, conversion, generation, library search | API data is not used for training; abuse-monitoring logs up to 30 days |
| Google Cloud (US) | Every uploaded image, for Cloud Vision SafeSearch | Safety check | Not used for training |
| Google Gemini API (US) | The reduced-size image and our conversion instruction, when OpenAI declines to convert it | Fallback conversion | Paid-tier API data is not used for training; logged for a limited period for abuse prevention |
| fal.ai (US) | The reduced-size image and our conversion instruction, only for images that passed every safety check and that both OpenAI and Google declined | Last-resort conversion using an open model | We send a no-storage instruction with each request and a 60-second expiry for the result |
| xAI (US) | Your text-to-image description only (never a photo), when the first model's result fails our quality check | Fallback generation | Not used for training; retained up to 30 days |
| Supabase (US) | Account, database, saved pages, the one-hour conversion queue storage, support screenshots | Hosting of accounts and data | Per our instructions |
| Upstash (US) | Hashed-IP rate-limit counters, the 7-day page cache, daily spend counters | Rate limiting and caching | 7 days or less |
| Stripe (US) | Email, purchase and subscription details; card data goes to Stripe directly | Payments | Stripe's privacy policy |
| Resend (US) | Your email address and the content of transactional emails we send | Email delivery | Per their terms |
| Sentry (US) | Error reports with request IDs and error text; no images, descriptions or identities | Error monitoring | 90 days |
| Vercel (US) and DigitalOcean (US) | Our application and conversion servers run here; request logs | Hosting | Platform log retention |
| Cloudflare (US) | Your IP address and a challenge token when Turnstile runs; our conversion server is reached through Cloudflare's network | Bot protection, network security | Per their terms |
| Slack (US) | Internal alerts to our own team, including a support ticket's reply email and a short preview of its text | Running the service | Per their terms |
You cannot choose which AI provider converts a given image; the route depends on which provider accepts it.
Legal requests. We disclose information only when required by law or to protect people or the service. For a signed-out visitor's upload there is nothing stored to disclose; for a signed-in upload, a copy exists for at most an hour — except where the child-safety hold below applies, in which case it is preserved for the period stated there.
Apparent child sexual abuse material is reported to the National Center for Missing & Exploited Children as the law requires. When this happens, we preserve the material and account records — including the IP address and browser identifier un-hashed, unlike everywhere else in this policy — for the period the law requires: at least one year for a reported item (extendable), at least seven days for one cleared on review, and indefinitely for one still under review.
Business transfer. If the business is sold or merged, your information transfers with it, under this policy.
7. How long we keep things
| Information | Kept for |
|---|---|
| Uploaded photo, signed out | Not stored |
| Uploaded photo, signed in | Until the conversion finishes or fails; one hour at most, except under our child-safety hold (section 6) |
| Finished page, shared cache | 7 days |
| Finished page, your library (with its description and embedding) | Until you delete it or your account is finalised |
| Text-to-image description (as the page title) | With the page |
| Usage and abuse-prevention records | 90 days |
| Anonymous-visitor cookie | 30 days |
| Account details | Until your account is deleted (30-day grace, then finalised) |
| Credit and payment ledger | Kept after deletion in anonymised form (amounts, reasons, dates; no link to you) for 7 years for tax, accounting and dispute-handling purposes |
| Support tickets and screenshots | Until resolved and up to 24 months |
| Problem reports (page and note) | Until your account is finalised |
| Photo attached to a problem report | Not received unless you have agreed to a diagnostic arrangement; then kept with the report until your account is finalised, except under our child-safety hold (section 6) |
| Error reports | 90 days |
8. Your choices and rights
- Delete a page at any time from your library. The file, its description and its embedding are deleted.
- Delete your account from the account page. Your account is deactivated immediately, with a 30-day window to change your mind by email link. When the window ends, we delete your email, name, saved pages, problem reports, support screenshots and sign-in record, remove your network identifiers and image fingerprints from usage records, and anonymise your credit ledger. See the Terms for what happens to credits.
- Purge a cached page without an account. Email privacy@colorapicture.com with the image fingerprint your browser can compute, or simply wait 7 days.
- Access and portability. Email privacy@colorapicture.com and we will send you a copy of the information we hold about your account within 45 days. You can download your saved pages from the account page at any time.
- Correct your display name and email preference on the account page.
- Marketing email is off by default; turn it on or off on the account page, or use the unsubscribe link in any marketing email. Transactional emails (sign-in links, receipts, account notices) are sent regardless.
California residents (CCPA/CPRA). You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights. The categories we collect are: identifiers (email, hashed IP, cookie and session IDs, Stripe customer ID); commercial information (purchases and credits); internet activity (the usage records in section 3e); and the content you provide (uploads, descriptions, pages, support messages). Sources: you, your browser, and our payment processor. Purposes: section 4. Disclosures: the processors in section 6, for business purposes only. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16. To exercise any right, email privacy@colorapicture.com or use colorapicture.com/contact; we verify requests by sending a confirmation link to the email on the account, and you may use an authorised agent if the agent provides your signed permission.
Other US states. Where your state gives you similar rights, the same process applies.
Outside the United States. Color a Picture is offered to users in the United States. We do not offer the service in the European Union, European Economic Area or United Kingdom and block access from those regions. If you reach the service from elsewhere, your information is processed in the United States under this policy.
9. Security
Everything moves over encrypted connections. Saved pages and queued uploads live in private storage that only your signed-in session, or our own systems, can read, through links that expire. Card details never touch our servers. IP addresses are stored only as keyed hashes, except for a child-safety hold (section 6), where the address is kept un-hashed with the preserved material. Access to production systems is limited to the people who run the service. No system is perfectly secure; if we learn of a breach affecting your information we will notify you as the law requires.
10. Changes to this policy
We post changes here with a new "last updated" date. For a material change we email account holders at least 14 days before it takes effect, and the change does not apply to information collected earlier in a way that reduces your rights.
11. Contact
privacy@colorapicture.com · Color A Picture, LLC, 909 Heather Dr, San Carlos, CA 94070 · colorapicture.com/contact