Skip to content
Crayonday
العربيةGet the app

Privacy Policy

Last updated: November 1, 2026

This policy explains how Crayonday, developed by Ibtikar Al Ula for Information Technology and E-Marketing Co. Ltd., handles your information when you use the app. It describes the app as it works at launch.

In short

  • No account. We never ask for your name, email or phone number. An anonymous identifier stands in for your install of the app.
  • Your journal stays on your phone: your doodles, the photos they came from, and your notes.
  • A photo leaves your phone only after you agree in the app, and only the one you choose to draw. AI models draw it through OpenRouter.
  • We delete the original photo from our servers as soon as the doodle is made or the request fails, and at most 24 hours later if a request never completes. Server copies of doodles are deleted 48 hours after they are made.
  • To keep free limits fair, the app sends a one-way hashed device code with a Google Play Integrity check. We keep only the hashed code, for up to 24 months after your last activity.
  • No ads, no third-party analytics, no tracking across apps, and we never sell your data.

Information we process

The photo you choose to draw

Before the first upload, the app asks for your explicit consent to send photos for AI drawing. After that, when you pick a photo from the camera or gallery, the app shrinks it on your phone and uploads only that photo to our servers. The app does not access the rest of your gallery.

Anonymous identifier

On first launch, the app signs in anonymously with Firebase Authentication (Google) and receives a random identifier. It is not linked to your name, email or phone number. With it we keep a device record:

  • The platform (Android, or iOS later) and the app version.
  • The device language.
  • The device's time zone, so we can work out your local day for daily limits.
  • Your plan (free or Pro).
  • First-use and last-use times.

Fair use and fraud prevention

On Android, the app sends a code derived from an Android app-specific identifier (an ID unique to our app on your phone). The code is hashed one-way, so the original ID cannot be recovered from it, and it is sent together with a Google Play Integrity check. This lets us count free limits per device, so they cannot be reset by reinstalling the app. We store only the hashed form, use it only for usage limits and abuse prevention, and keep it for up to 24 months after your last activity.

We also use Firebase App Check (Google) to check that requests come from our genuine app. It uses Google Play Integrity on Android and App Attest on Apple devices. The verification token the app sends contains no personal content.

Drawing request log

For each drawing request we keep the style you chose, the time and status of the request, the AI model that handled it, and its processing time and cost. This log does not contain the photo or the doodle.

Reports

If you report a doodle, we keep the report: the reason you picked, any note you add, and which drawing it is about. We use reports to review the AI's output and improve the service.

Crash reports

If the app crashes, it sends a report through Firebase Crashlytics (Google). It includes the device model, the operating system and app versions, and technical details of the error. It never includes your photos, doodles or notes. Crash reports are kept for 90 days.

Purchases

Subscriptions are handled by Google Play billing (and by the App Store once the iPhone version launches). We use RevenueCat to manage your purchase status. RevenueCat receives the anonymous app user ID and the store's purchase receipts, never your payment card details.

Technical data

Our server logs may record your IP address and the time of a request. We use them for security, abuse prevention and troubleshooting.

What stays on your phone

  • Your journal: the doodles, the photos they came from, and the calendar.
  • The notes you write on your doodles. They are never sent to us.
  • Reminders. They are scheduled locally on your phone, and no server sends them. You can turn them off in your phone's notification settings.

What we don't do

  • No ads, and no advertising identifiers.
  • No third-party analytics, and no tracking across other apps or websites.
  • We never sell your data.
  • We don't use your photos to train AI models.

How we use information

  • To draw your doodle and deliver it to your phone.
  • To apply the free and Pro limits fairly.
  • To prevent fraud and abuse, and to protect the service.
  • To review reported doodles.
  • To fix crashes, and to monitor service quality and cost with aggregate statistics.

AI drawing

To make a doodle, we send your photo with drawing instructions to OpenRouter, an AI service provider. OpenRouter routes the request to the developer of the drawing model, such as Black Forest Labs or ByteDance. They process the photo to return the doodle, under their own terms and privacy policies. We do not use your photos to train AI models.

Where data is processed

Our servers and database run on Google Firebase and Cloud Functions in the European Union (Frankfurt, Germany). Photos and doodles are stored temporarily on DigitalOcean Spaces, also in Frankfurt. The AI model providers reached through OpenRouter, and the other service providers listed below, may process data in other countries.

Retention

  • Original photo on our servers: deleted as soon as the doodle is made or the request fails, and at most 24 hours later if a request never completes.
  • Doodles on our servers: deleted 48 hours after they are made. The copy on your phone stays until you delete it.
  • Device record: kept while you use the app, until you use Delete my data, or until you ask us to delete it.
  • Drawing request log: kept while you use the app, or until you ask us to delete it.
  • Hashed device code and its free-plan counters: up to 24 months after your last activity.
  • Reports: kept to review the AI's output, until you use Delete my data or ask us to delete them.
  • Crash reports: 90 days.
  • Data on your phone: stays until you delete it or uninstall the app.

Sharing and service providers

We do not sell your data. We share it only with the service providers that run Crayonday for us, and only as much as they need:

  • Google: Firebase (Authentication, Cloud Functions, database, Crashlytics and App Check) and Google Play (billing and Play Integrity).
  • DigitalOcean: temporary file storage (Spaces) in Frankfurt.
  • OpenRouter and the AI model developers it routes requests to, such as Black Forest Labs and ByteDance: to draw your doodle.
  • RevenueCat: to manage subscription status.
  • Apple (App Store and App Attest), once the iPhone version launches.
  • When the law requires it, or a competent authority makes a lawful request.

Security

  • Data travels between the app and our servers over encrypted connections.
  • Files on our servers are not public. They open only through signed links that expire.
  • Access to our admin systems is restricted and protected.

Your choices and rights

  • Delete doodles: deleting a doodle in the app removes it, and its photo, from your phone.
  • Delete my data: in Settings, Delete my data erases this install's copies on our servers (drawings, reports and the device record) and the anonymous account. The hashed device code and its free-plan counters are kept for up to 24 months to prevent fraud.
  • Withdraw AI consent: you can withdraw your consent to AI drawing in Settings at any time. The app then stops uploading photos.
  • Write to us: you can ask for a copy of your data, ask us to delete it, or object to its processing, including server-side data such as the device record, the hashed device code and reports. Email ahmedd17208@gmail.com. Because we don't link data to a name or email, we may ask for details that help us find it, such as the dates of your doodles.
  • Depending on where you live, you may also have the right to complain to your local data protection authority.

Children

The app is not directed at children under 13, and we do not knowingly collect their data. If you learn that a child has used it, contact us and we will delete the data.

Changes to this policy

We may update this policy and will publish the new version here with its date. If a change is significant, we will tell you in the app.

Revision history

  • November 1, 2026: Rewritten for launch under the new name Crayonday. Added the in-app consent before uploads, the hashed device code with Play Integrity for fair-use limits, the device time zone, reports, RevenueCat, Delete my data in Settings, and the full list of service providers.
  • October 30, 2026: Added Crashlytics, App Check, the anonymous identifier and the current retention periods.

Contact us

Privacy questions: ahmedd17208@gmail.com. General support: info@ibtikaralula.com.