Privacy Policy

Scribbletastic is a children's creative drawing and record app run by Expressions Creative Studio.

Data controller: Expressions Creative Studio
Contact: expressionscreativestudio@gmail.com

This policy explains how I collect, use, store and protect personal data, in line with the UK and EU General Data Protection Regulation (UK GDPR and GDPR).

Scribbletastic is made for children aged 3 and over, along with parents and guardians, teachers, therapists and other professionals.

Children: a child account is set up by a parent or guardian, who confirms they have given permission. I ask for that consent for any child under 16. That is stricter than the law requires, because the age of digital consent in the UK is 13 under GDPR Article 8, and I have chosen the stricter approach as this is a children's app.

Therapists and professionals: accounts with a therapist or admin role are covered by their own professional rules on handling data. I provide the tools, and therapists remain responsible for meeting their own regulator's requirements.

I collect only the minimum I need:

• Account data: email address, first name, and the role chosen (child, parent, teacher, therapist, or clinic or NHS licence holder). If a child has an account I also store the age band they pick, such as 6 to 8.
• Parent or guardian contact: the email address of the parent or guardian who gives permission for a child account, and the address of any grown-up a child chooses to invite to see their drawings.
• Drawing data: the artwork, the stroke by stroke recording, how long the drawing took, the prompt used, and the child's first name attached to the drawing.
• Mood and feeling data: the feeling a child picks, and any words they add, either as a note on a drawing or in the "just type it out" box. Anything typed there is shown to the parent, teacher or therapist linked to that child.
• Class data (teachers): class name, pupil first names, parent email addresses, and any therapist ID a teacher chooses to link.
• Billing data (grown-ups only): which plan you are on and whether your subscription is active. Card details are handled entirely by my payment provider, Stripe, and never reach me.
• Enquiry data (schools, clinics and NHS teams): if you ask me to invoice you, I store the organisation name, whether it is a school or a clinic, the contact name and email address, an optional headcount, and any notes you add.
• Usage data: simple, combined counts of features used, such as how many drawings were saved.

I do not collect location data, biometric data, photographs, dates of birth, or advertising or behavioural profiles of children.

I use the data I collect only to:

• run the app, including saving drawings, mood tracking and rewards
• let a linked therapist, teacher or admin review a child's creative work for their support
• improve how the app performs, using combined, anonymous numbers only
• take payment for subscriptions and licences, and handle invoice requests from schools and clinics
• reply to support requests, or to requests to see or delete data

Legal basis: I rely on my legitimate interest in running the app, and on your consent for the optional feeling data.

All data is stored securely on an encrypted cloud platform with access controls. It is held on servers in the United States, operated by my hosting provider. Where data is transferred outside the UK, the transfer relies on the safeguards set out in my hosting provider's data processing agreement, which include the standard contractual protections required by UK data protection law.

Who can see what: only you can reach your own records. A child's drawings and mood check-ins are shared only with the parent, teacher or therapist linked to them. Therapist notes are visible only to the person who wrote them and to administrators.

Artwork and stroke files are stored privately. They are not on public links. Opening one needs a short lived link that the app issues only to someone allowed to see that drawing, so only you and the parent, teacher or therapist linked to a child can open it.

I use strong security measures to protect data against unauthorised access, loss or disclosure.

I never sell or rent personal data, and I never share it for marketing. The one exception is the Google Ads conversion tag described in section 9, which runs for grown-ups only and is never loaded for a child.

Data is shared only with:

• Linked therapists, teachers and admins on the same Scribbletastic account, so they can review a child's creative work
• The companies that help me run the app, working under contract: my hosting, database and sign-in provider, whose servers are in the United States, and Stripe for payments. Stripe receives grown-up billing details only, never a child's drawings or mood data.
• Law enforcement, if the law requires it

I keep personal data for as long as an account is active. When an account is deleted:

• if you delete your account in the app, your drawings, mood data and personal information are removed straight away; if you ask me by email instead, I action it within 30 days
• combined, anonymous usage numbers may be kept
• saved artwork images and drawing recordings are held as files in storage, and I have no way to delete those files. Deleting a drawing removes it from the app straight away, but the stored file itself stays

Under UK and EU GDPR, you (or a parent or guardian acting for a child) have the right to:

• Access: ask for a copy of all the data I hold about you
• Rectification: have inaccurate data corrected
• Erasure: ask me to delete all your data, the "right to be forgotten"
• Restriction: limit how I use your data
• Portability: receive your data in a format you can move elsewhere
• Object: object to processing based on legitimate interests
• Withdraw consent: at any time, without affecting what happened before

To use any of these rights, email expressionscreativestudio@gmail.com. I will reply within 30 days.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, or to your local data protection authority in the EU.

Scribbletastic uses only essential cookies and local browser storage. These keep you signed in and do nothing else. The app cannot work without them, and they are never used to track you across other sites.

I do not use third party analytics, tracking pixels or advertising cookies anywhere a child uses the app. No third party script loads on the drawing canvas, the games, or any page a child sees.

One advertising measurement tag runs for grown-ups only, on the subscription page and on the final step of setting up an adult account. It is Google Ads conversion measurement, and its only job is to tell me which of my adverts led to a subscription or a sign-up. It is never loaded for a child, and it is not used to build a profile of anyone.

I may update this policy from time to time. When I do, I will update the "Last updated" date at the top and, for significant changes, tell users by email or in the app. Continuing to use the app after a change means you accept the updated policy.

For any privacy question, or to make a data request: