Coloristo — Privacy Policy

Last updated: August 10, 2026 · Effective: August 10, 2026

Coloristo ("Coloristo", "we", "us") builds an iPhone app that turns your photos into digital coloring pages you can color on your device. This Privacy Policy explains what we collect, why, how long we keep it, and the choices and rights you have. It applies to the Coloristo app and our website.

Short version: we collect the minimum we need. Your photos are used only to make your coloring pages and keep your library working. We never sell your personal information, and we never use your photos to train third-party AI models unless you explicitly opt in.

1. Information we collect

A. Photos and content you provide

• Photos you upload, the coloring pages generated from them, and your colored artwork.
• Photos may contain images of faces. We do not perform facial recognition, identity matching, or biometric identification, and we do not create or store faceprints or other biometric identifiers.
• Optional feedback, support messages and any images you attach to them.

B. Account information (if you create an account)

• Email address, and name/profile image if you provide one.
• Sign in with Apple, Google or email. If you use Sign in with Apple with "Hide My Email", we only ever see the relay address.

C. Purchase information

• Subscription status, plan type, trial eligibility, renewal and cancellation events, provided to us by Apple and our subscription-management provider. We never receive your card number or full billing details — Apple processes all payments.

D. Device and usage information

• Device model, iOS version, app version, language, region, time zone, crash and performance diagnostics.
• Feature usage events (for example: onboarding steps completed, a photo converted, a page opened), so we can improve the app.
• An app-generated pseudonymous identifier and, where applicable, the Apple IDFV. We only access the IDFA for advertising measurement if you grant App Tracking Transparency permission.

E. Notifications

• Push token, if you allow notifications.

We do not knowingly collect precise location, contacts, health data, or biometric identifiers.

2. How we use information

Legal bases where GDPR/UK GDPR applies: performance of a contract (providing the app and subscription), legitimate interests (security, product improvement), consent (notifications, marketing, tracking), and legal obligations.

3. How photo processing works

When you upload a photo, it is transmitted over an encrypted connection to our processing infrastructure, converted into line art by automated image-processing systems (including third-party AI processing providers acting as our processors under contract), and returned to your device and library.

• Photos are encrypted in transit (TLS) and at rest.
• Processing is automated; our staff do not review your photos except where you explicitly ask for support with a specific image, or where required to investigate a safety report or legal request.
• Our AI processing providers are contractually prohibited from using your images for their own purposes, including model training.
• You can delete any photo or generated page in the app at any time.

4. Sharing your information

We share personal information only with service providers who process it on our behalf, under contract, for the purposes above:

• Cloud hosting and storage
• AI/image-processing providers
• Subscription management and receipt validation (e.g. RevenueCat) and Apple for payments
• Analytics and crash reporting
• Push notification and email delivery
• Customer support tooling

We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of users, and in connection with a merger or acquisition (you will be notified).

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

5. Data retention

• Photos and generated pages: kept while your account is active, or until you delete them. Deleted items are removed from active systems immediately and purged from encrypted backups within 30 days.
• Account data: deleted within 30 days of an account-deletion request.
• Purchase records: retained as long as legally required for tax and accounting.
• Diagnostics and aggregated analytics: retained in pseudonymous or aggregated form for up to 24 months.

If you use Coloristo without an account, photos are processed and stored only for as long as needed to deliver the result to your device.

6. Your choices and rights

You can, at any time:

• Delete individual photos, pages or your entire library in the app.
• Delete your account in the app (Settings → Account → Delete account) or by emailing support@coloristo.org. Account deletion permanently deletes your content.
• Turn notifications and photo-library access on or off in iOS Settings.
• Unsubscribe from marketing emails via the link in any email.
• Withdraw ATT tracking permission in iOS Settings → Privacy & Security → Tracking.

Depending on where you live, you may also have the right to access, correct, delete, restrict or object to processing, port your data, and — for California residents — to know what we collect, to delete, to correct, to opt out of sale/sharing (we do neither), and not to be discriminated against for exercising these rights. Nevada, Virginia, Colorado, Connecticut, Texas and other US state residents have comparable rights.

To exercise any right, email support@coloristo.org. We verify requests using the email associated with your account and respond within 30 days (45 days where permitted). You may use an authorised agent where the law allows.

7. Children

Coloristo is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact support@coloristo.org and we will delete it. Users under 18 should have a parent or guardian's permission before making in-app purchases.

8. Security

We use encryption in transit and at rest, access controls, least-privilege internal access, logging, and regular review of our providers. No system is perfectly secure; if a breach affects your personal information, we will notify you and the relevant regulators as required by law.

9. International transfers

We may process and store data in the United States and other countries. Where data is transferred out of the EEA, UK or Switzerland, we rely on Standard Contractual Clauses or another approved transfer mechanism.

10. User-generated content, conduct and reporting

We have zero tolerance for objectionable content and abusive behaviour. Prohibited content includes anything unlawful, sexually explicit, exploitative of minors, hateful, discriminatory, violent, harassing or invasive of another person's privacy. Prohibited behaviour includes harassment, threats, stalking, impersonation and spam.

Report content or users in the app (Report on any shared item) or at support@coloristo.org. We review reports within 24 hours and may remove content, suspend or permanently terminate accounts.

11. Changes to this policy

We may update this Privacy Policy. Material changes will be announced in the app or by email before they take effect, and the "Last updated" date will change.

12. Contact

Privacy questions or requests: support@coloristo.org

Appendix — App Store privacy label mapping (for App Store Connect)