Your family's play stays on your device

Short version: Paintiko has no ads and no child accounts, and nothing is measured where children play. What children make is saved in your browser. A grown-up account is required to set up play. Adult account actions, optional profile saving, kid-link setup and Family Pass checks contact our service. Parent information pages also use cookie-free page-view analytics. Local artwork is not cloud-backed up.

Saved on this device only

Paintiko is operated by Paintiko.

The app uses your browser's local storage and IndexedDB. Creations and progress stay here; account and pass credentials have server counterparts:

Colors painted, finished art-book pictures, stickers, progress and settings (sound, movement, experience). Local player profiles can also have account copies, described below.
An optional "secret pictures" sign-in for a player. It is three taps on pictures, only works on this device and is not a password for anything else.
Drawings made on the blank canvas.
Toy photo pages: the traced outline, its colors and the name a child gives it.
Local copies of access/session tokens and, if you bought the Family Pass, its signed token, device id and last-check date. Account and license requests transmit the relevant token or identifier; they are not local-only secrets.

Clearing this site's browser data deletes all of it, and we cannot recover it. Deleting a player in Players & settings removes that player's saves.

Camera and photos

The toy photo maker asks for camera permission, or lets you pick a photo. The picture is turned into an outline inside the browser. The photo and camera video are never saved and never uploaded, and the camera is switched off when the photo is taken or the maker is closed. Only the outline is kept.

When the app uses the internet

Loading the app from our web host, like any website. Once the app says Ready offline, downloaded activities and saved play access work offline. Initial setup needs an internet connection.
On the grown-up pages only (like this one), Vercel Web Analytics counts page visits without analytics cookies. This includes the dedicated account page, not the homepage or child play. Technical request data is processed by hosting providers; page-view analytics is not a claim that every request is anonymous.
When a grown-up enters a Family Pass license code, the app sends that code and the random device id to our license service to check it.
While a pass is present, the app asks the license service about once a week whether it is still valid (for example, not refunded). It sends the signed pass token, which contains a hash of the code and the device id.

Signing up, verifying email, signing in, recovery, profile saving and opening a kid link contact the account service even without a pass. Child play reads saved access locally; account actions are on adult surfaces. Fonts and pictures are served from our own host.

What the license service stores

For each pass: a one-way hash (SHA-256) of the license code, never the code itself; the random device ids that redeemed it (up to 5) with the time each was added; and a note if the purchase was refunded, disputed or charged back. These records are kept in a Neon Postgres database. No names or payment details are stored there, and no email address unless a grown-up saves the pass to an account (see below). Like most web services, our hosting providers may process technical data such as IP addresses to deliver requests and keep the service secure.

The grown-up account

A grown-up signs in once on each device to open the games, and the account can save the Family Pass and restore it on another device. Children never have accounts and never sign in. For an account we store your email address, a salted hash of your password (never the password itself), whether the email is confirmed, your sign-in sessions, and which pass is saved to the account. This data is kept in a Neon Postgres database run by the license service. We email you only to confirm your address or, when you ask, to reset your password. You can delete the account yourself under Grown-up account in the app (your password is needed), which removes live account records, sessions, profiles and kid links and unlinks its pass. Separate license/device/refund records remain; a Family Pass already on a device keeps working there. Or ask us and we delete it.

If you add your children to the account, we store for each child (up to four) the animal they play as, the level you chose and an optional nickname you type. We ask for a nickname, not a full name, and it can be left blank. This list follows you to other devices you sign in on. Pictures, stickers, progress and a child's secret picture code stay only on the device. You can change or remove the children on the account page, and deleting the account deletes them too.

If you choose to connect an AI assistant to your account, access is granted by a grown-up on a consent screen and is read-only: the assistant tools can see whether your Family Pass is active, its device count/limit and which packs it unlocks, and nothing about your children's play. Authorization requests can include identity and email scopes and continued access; review the consent screen and the assistant provider's own data policy. You can revoke it at any time by emailing us or by deleting your account.

Optional friend challenges

When you send a challenge, we store the participating account IDs, family avatar slots where applicable, puzzle, difficulty, board number, invitation dates and state, blocks, send-attempt counters, and the results you choose to submit. Older internal friend codes are retained for compatibility but are not required. This data is stored in the account service's Neon database. Outside-account invitations identify participants by account email; the send form explains this before you send. Family invitations identify the two selected players by their family names. Family profiles are never shown to another account.

Shared-account player selection is not a separate login: anyone using that signed-in family account can select its family members. Results are device-reported, not independently verified. Opening or refreshing challenges, sending and submitting results makes an account request. Ordinary solo play does not upload results. There is no public account directory or challenge email notification.

Invitations expire after 30 days, but their history remains until an associated account is deleted. Blocking ends open invitations between different accounts and prevents new ones. Family invitations can be declined or canceled. Deleting an account removes its live challenge profiles, invitations and blocks; provider backups and logs have separate retention.

Buying the Family Pass

Checkout opens our store on Gumroad in a new tab. Gumroad handles payment and your email address under its privacy policy, and shares the purchase details with us as the seller. We use them only to deliver your license, answer support requests and handle refunds.

Children

Paintiko does not ask children to register. A nickname entered by a parent may still identify a child, so use an animal name or leave it blank. See Children's privacy for the distinction between local creations and optional server profiles.

Kid links

A grown-up can create a family or individual kid link to authorize play on another device. The service stores the link token, account association, creation time and, for an individual link, the animal. Opening it sends the token and returns the relevant profiles. Anyone with the link can open that play space; it does not grant adult account access. Replace links in the account page to invalidate old links. Deleting the account removes server links but does not erase saves or access already on a device.

Providers, retention and deletion limits

Vercel serves the website and parent-page analytics; Neon hosts account and license records; Resend delivers confirmation and recovery emails; Gumroad handles purchases. Email delivery processes the adult address and message, including its confirmation or reset link. Hosts can process IP addresses and request logs for delivery and security. Depending on service configuration, account sessions may include an IP address and browser information.

Live account/profile records remain until removed or the account is deleted. Verification and reset links expire after one hour. License and refund records support restoration and enforcement and have no automatic deletion schedule in the app. Support correspondence and provider logs/backups have separate retention; deleting an account is not a promise of immediate erasure from every provider backup. Contact support for a records or deletion request and its applicable limits.

Your choices and requests

You can delete everything on a device by clearing this site's data. To ask what the license service holds for your code or your account, or to delete it, email support@paintiko.com with your adult account email or receipt/code as appropriate. Do not send a password or your child's details. If this policy changes, the date at the bottom of this page changes too.