How we handle your child's drawings

What we collect

• Your email address, to sign you in. If you choose a password, it is kept only as a scrambled hash that cannot be read back, by us or anyone.
• Your child's first name, and the month they were born if you choose to give it.
• Photos of their drawings, and the day each was drawn if you set it (otherwise the day you added it).
• Your confirmation, when you add a child, that you are their parent or guardian.

What it is used for

• Keeping each photo in your child's record, exactly as drawn.
• Describing what is in it: who, what, where, what it was made with, and whether there is writing on it. The writing is not read and a name on the page is never used.
• Suggesting when a figure looks like a character from an earlier drawing, for you to confirm or reject.
• Nothing else. Never to train a model, never shown to another family, never in our marketing without your written permission.

Who else touches it

Each is sent only what its job needs.

• Supabase stores the records and the photos, in the EU (Ireland), and sends the sign-in email.
• Anthropic's model reads each drawing to describe it; the photo is sent for that reading.
• fal lifts a drawing off its paper when that is switched on; the photo is sent for that step.
• Vercel serves the site. Inngest runs the reading as a background job and sees only record ids.
• Upstash counts requests per address to stop abuse; it sees your IP address and nothing else.
• Resend delivers email we send ourselves. When something fails we are alerted with record ids, never a photo or a name.
• PostHog, when analytics is switched on, receives counts: a page was viewed, a drawing was added, and the country it came from. Never an email, a name, a photo or anything read from one. A signed-in family is a random id.
• fal also paints a background when a member describes one. Only the words are sent, with your children's names taken out of them first: never a drawing, a photo or a name. The picture is kept with your family's own files and goes when your account does.
• When you ask for a story book, Anthropic's model writes the story from how your child's characters are drawn and what you choose; it is never told a name. fal paints each place from words, with nobody in it, and your child's drawing is stood in the picture by us afterwards: no drawing is sent to an image model. Anthropic's model then looks at each painted place to check it. The story and its pictures are kept with your family's own files and go when the story, the child or your account does.

Who can see it

You, and anyone you give a link to. There is no public gallery and no way to find a child's record. A share link is a long random token, stored only as a hash, shows the child's first name and the drawings and nothing else (and, only if you tick it for that link, the stories they have finished, never with a brother's or sister's drawing in them), and can be switched off at any time. A child's name is never in a web address.

If you are helping with a gift

A family can ask someone to help make a gift from their child's drawing. If that is you:

• We ask for your first name and your email address, which you type yourself. The family sees your first name, never your address.
• Your email is your way back to the gift, and how you hear that it was sent. That is two emails at most.
• You see one drawing, the one the family chose, and only after you have joined. You can change the message and the background, not the drawing.
• The link works for 30 days or until the family switches it off. The gift and your email are deleted 90 days after it was last changed, or the moment the family deletes it.
• Remove my email, on the gift's own page, deletes your address straight away.
• Hearing about Feltip is a separate box that starts unticked. If you tick it, nothing is sent until you have used the link we emailed you, and every email carries a way to stop. That list holds your address and first name and nothing about the family.

If you draw for a family

A family can send you a private link and ask you to draw something for their child. If that is you:

• You need no account and we ask for no email or address: only the first name you type, and a line for the family if you write one.
• What you draw or photograph goes to that child's parent and nobody else. They decide whether it joins the child's record; until they do, it is kept apart, and if they say no it is deleted.
• The link works for 30 days and the parent can switch it off at any time. A link that has run out is cleared, with anything still waiting on it, 60 days later.
• If the parent says yes, your drawing is kept for the child like any other, under your first name as the note the family sees; it is read and lifted off its paper the way every drawing is, and it is never used to train anything.
• We count that a link was opened and that a drawing was sent, as numbers with nothing about you attached.

If you find a hunt's secret code

• On a seasonal hunt page, the faint doodle over the pictures hides a discount code, one for each Feltip account. If you tap it without being signed in, nothing is kept and no cookie is set.
• If you tap it signed in, we keep a fingerprint of your account next to the code we showed you, so you see the same code wherever you sign in. The fingerprint is a one-way keyed hash, never your email or your name, and it is used for nothing else.
• It goes when that season's codes stop working, which is the date on the code. If you use the code, Stripe sees it at checkout like any other code.

How long it is kept

• A drawing in a child's record stays for as long as the record exists.
• Anything not in a child's record, such as a photo whose upload failed, is deleted after 90 days.
• A share link stops working after 90 days, or the moment you switch it off.
• A sign-in link works once and lasts an hour.

Deleting it

• Remove one drawing from a child's page, and its photo and everything read from it are deleted.
• Remove a child, and every drawing, character and link in their record goes with them.
• Delete your account, and your family, your children's records and your email go too. Deletion removes the files, not just the rows.

All three are buttons on your own pages. Nothing to email, nothing to wait for.

How it is protected

Every photo is decoded and saved afresh before it is kept, so what is stored is a real image with the phone's own data removed. Records and photos are only ever reached by the server, never by the browser directly. A password is never stored as typed, only as a hash, and wrong tries are limited by address and by account. You can still sign in by emailed link and have no password at all.