Short version: Sketchling is a learn-to-draw app for children and families. A grown-up holds the account. We collect only what the app needs to save drawings and progress. No ads, no advertising SDKs, no selling or renting of data, no tracking across other apps or websites. You can delete everything at any time.
1. Who we are
Sketchling is made by HinaYuri Labs (an independent app studio based in Vietnam), the "controller" of the personal data described here. Contact: sketchling@hinayurilabs.com.
2. Children's privacy
- Sketchling is designed for children (about 4–12) drawing with a parent or other grown-up. The account belongs to the grown-up.
- Before a child uses the app, onboarding asks a grown-up to confirm permission ("A quick check for grown-ups"). Settings, the grown-ups corner, sharing, external links and account deletion sit behind a grown-up check (a maths question).
- We ask only for a nickname (not a full name) and an age for each child profile. We never ask a child for an email, phone number, address or precise location.
- No ads, no behavioural advertising, no advertising ID, no third-party analytics or tracking SDKs, no public profiles, no chat between users.
- We follow the principles of the US Children's Online Privacy Protection Act (COPPA), Article 8 of the EU/UK GDPR ("GDPR-K") and Vietnam's Decree 13/2023/ND-CP on personal data protection. Parents and guardians can review, correct or delete their child's data and withdraw consent at any time (see section 8).
3. What we collect and why
| Data | When | Why |
|---|---|---|
| Account: a random account id; email address and password (stored only as a secure hash) if the grown-up saves the account; app language and storefront country | A guest account is created automatically after onboarding so drawings and progress can be saved; the email is added only if a grown-up chooses to | Sign in, keep progress and drawings safe, restore them on another device, account messages |
| Child profiles (up to 5): nickname, age, avatar, signature style, favourite subjects and short onboarding answers (e.g. how often the child draws, which materials they have) | Onboarding / Profiles | Personalise lessons and level, show the right content for the age |
| Progress: lessons done, sparks and levels, skills, collections, creatures and app settings | While using the app | Save progress and sync it between devices |
| Drawing photos taken with the camera of the child's paper drawing, the cut-out "living creature" image made from it, and on-screen drawings saved to the journal, with title and stickers | When the child photographs a drawing | Keep the child's journal and creatures, show them on other devices. Drawing feedback is computed on the device; numbers (not the photo) may be sent when a drawing is checked. |
| Voice recording (optional, max 60 s) | Only if the family chooses to answer the journal ideas survey by voice and taps record | Listen to product feedback |
| Feedback: optional text messages and short survey answers | Only when sent | Improve the app, answer support questions |
| Shares: when a grown-up shares a drawing, a private link with the drawing and its title (the child's name is not shown); the "awards" family members leave on that link (who they are, e.g. "Grandma", and a badge — no free text). The grown-up can stop sharing at any time, which deletes the link and its awards | Only after the grown-up check and a share action | Let family see and cheer the drawing |
| Reminder settings and push token: reminder days/time, time zone, language, device push token | Only if a grown-up turns on drawing reminders and allows notifications | Send drawing reminders |
| Usage analytics: a random install id, event names (e.g. "lesson finished"), short technical values, app version, platform, language; performance samples (start-up time, frame rate) | Only if a grown-up turns on "Share anonymous usage info" (off by default; change any time in Settings) | Understand which lessons work and fix slow screens |
| Purchase records (where subscriptions are offered: iOS, web): plan, period, status, renewal date, price, store transaction ids. We never see card details. | When a grown-up subscribes | Give access to the plan, handle renewals and refunds |
| Technical data: IP address and basic request data processed by our hosting provider for security and rate limiting; a hashed device id when a guest account is created or an invitation is claimed | Every request | Security, abuse prevention |
The camera is used only to photograph paper drawings. The microphone is used only for the optional voice answer. We do not collect precise or approximate location, contacts, or photos from the device's gallery other than the ones taken in the app. The teacher's voice is pre-recorded or uses the device's built-in text-to-speech.
4. Legal bases
We process data to provide the service the family asked for (contract), with parental consent where required (child profiles, optional analytics, voice answers, reminders), and for our legitimate interest in keeping the service secure. Where consent is the basis, it can be withdrawn at any time.
5. Who we share data with
We do not sell, rent or trade personal data, and we do not share it for advertising. We use a small number of service providers that process data on our behalf only:
- Cloudflare (hosting, API, file storage R2, network security) — global network.
- Our database server in Vietnam, reached through Cloudflare's encrypted tunnel.
- Where enabled: Google Firebase Cloud Messaging / Apple Push Notification service (reminder delivery), an email delivery provider (sign-in codes), and payment providers Apple App Store, Google Play, Stripe, RevenueCat for subscriptions (not used in the Android app at this time).
We may disclose data if the law requires it. Shared drawing links are visible to anyone who has the link; the grown-up can stop sharing by deleting the drawing or the account.
6. Where data is stored and international transfers
Account and progress data is stored in a database in Vietnam; photos and recordings are stored in Cloudflare R2. Cloudflare may process data in other countries, including the USA and the EU, under standard contractual safeguards. Copies also stay on your device until you sign out or delete the app.
7. Retention
- Account, profiles, progress, drawings and recordings: until you delete them or the account.
- Sign-in codes expire after minutes; sign-in tokens expire automatically.
- Analytics events: kept for as long as needed to improve the app and for at most 24 months.
- Deleted data disappears from encrypted backups within 14 days.
- Store and payment providers keep their own purchase records under their own policies.
8. Your rights and parental controls
A parent or guardian can at any time:
- See and correct a child's data (Profiles, the journal, the grown-ups corner);
- Delete a drawing, a profile or the whole account in the app (Settings → Account → Delete account) — see how to delete your account;
- Withdraw consent for analytics (Settings), reminders (Settings or the device settings), or ask us to stop processing;
- Ask for a copy of the data or any other request by writing to sketchling@hinayurilabs.com. We answer within 30 days and may ask you to confirm you control the account.
You can also complain to your data protection authority.
9. Security
All traffic uses HTTPS/TLS; the Android app refuses unencrypted connections. Passwords are stored only as salted hashes. Photo and recording links are signed and expire. Access to servers is restricted to the developer. No system is perfectly secure; if a breach affects you we will tell you as the law requires.
10. Changes
We will post changes here with a new effective date, and tell grown-ups in the app before important changes take effect.
11. Contact
HinaYuri Labs · sketchling@hinayurilabs.com