Privacy Policy

Effective date: August 22, 2026

Crayon Wish ("we," "us") is operated by CTF Designs. This policy explains what we collect when you use crayonwish.com and what we do with it. The short version: we collect the minimum needed to run a coloring-page generator, we don't sell your data, and we never share or sell mobile information.

Who Crayon Wish is for

Crayon Wish is designed for parents, guardians, and educators. Creating an account requires you to be at least 18 years old (or the age of majority where you live). We do not knowingly collect personal information from children under 13. Children may color the printed pages — the paper does not report back to us. If you believe a child has created an account or submitted personal information, contact us at the address below and we will delete it.

What we collect

• Account info: your email address and a hashed password, stored with our database provider (Supabase). We use your email only to verify your account and send essential service messages.
• Prompts and generated images: the text prompts you type and the coloring pages generated from them. Generated pages are added to the public gallery (see the Terms of Use). Don't put personal information in prompts — they may be visible to other users.
• Usage analytics: if you accept analytics cookies, we use PostHog to understand how the site is used (pages viewed, features clicked). This is gated behind the cookie banner — decline and it never loads.
• Technical basics: our host (Cloudflare) processes IP addresses and request logs to serve the site, prevent abuse, and enforce rate limits.

How prompts are processed

Prompts are sent to OpenAI to (1) screen them for kid-safe content and (2) generate the coloring page. Prompts are processed under OpenAI's API terms, which do not permit OpenAI to train models on this data.

Service providers

We use a small set of processors to run the service: Supabase (database & authentication), Cloudflare (hosting & security), OpenAI (image generation & content moderation), Resend (verification and service emails), and PostHog (analytics, only with your consent). Each receives only what it needs to do its job.

What we don't do

• We do not sell or rent your personal information.
• We do not share or sell mobile numbers or mobile information; text-messaging originator opt-in data and consent are never shared with third parties.
• We do not run third-party advertising on Crayon Wish today. If that ever changes, this policy and the cookie banner will be updated first.

Your rights

Depending on where you live (including California under CCPA/CPRA and the EU/UK under GDPR), you may have rights to access, correct, delete, or export your personal information, and to opt out of analytics. You can delete your account and associated personal data by emailing us. We respond to verified requests within 30 days and do not discriminate against you for exercising your rights.

Data retention

Account data is kept while your account is active and deleted on request. Generated images in the public gallery may remain after account deletion (they are not linked publicly to your identity), but we will remove them on request too.

Security

Traffic is encrypted (HTTPS), passwords are hashed, database access is restricted with row-level security, and API keys are never exposed to the browser. No system is perfect — if we learn of a breach affecting your data, we will notify you as required by law.

Changes

We'll post any changes here with a new effective date. Material changes get a notice on the homepage.

Contact

CTF Designs — roman@ctfdesigns.com