Privacy Policy

Last updated: 2026-09-29

This Privacy Policy explains how DoodleMe, a mobile photo-to-image generation app MVP, handles information when you use the app.

DoodleMe is a working product name for the current MVP. The app is designed around a simple flow: you choose a photo from your device, DoodleMe sends that photo with a fixed internal prompt through a relay-backed generation path, and you receive one generated image result.

This policy is the canonical MVP privacy document for the product. App screens, web mirrors, and store-facing legal links should reuse this document rather than maintain separate privacy wording.

Scope

This policy covers the current MVP experience only. It does not describe features that are out of scope for the MVP, including accounts, social features, creator profiles, history feeds, or long-term cloud media libraries.

Information We Process

Source photos

Before the app opens the photo picker for a new generation, it asks you to explicitly agree to the current AI photo processing disclosure. After your agreement is saved on your device, you can choose a source photo for DoodleMe to generate a transformed image. Cancelling the disclosure or opening its Privacy Policy link abandons that photo-selection attempt. Source photos are processed transiently during upload, relay handling, and provider generation. Source bytes are not persisted in DoodleMe's lifecycle database or generated-output Storage. Your photo may contain personal information that is visible in the image itself.

Generated outputs

When a generation succeeds, DoodleMe processes the generated output image and stores it in the private generated-images bucket for viewing, saving, sharing, delivery, or retry handling inside the MVP flow. Generated outputs are not available through public object URLs.

Access to a generated output is request-scoped. DoodleMe authorizes access only when the app presents the matching request capability in the x-doodle-request-capability header. The RevenueCat anonymous App User ID is used for trial and entitlement checks only and is not treated as authenticated ownership. After authorization, DoodleMe delivers the output with short-lived signed URLs that expire after five minutes.

For the current result flow, the app may keep one temporary local copy of the generated output in the operating system's cache storage. This copy lets the result preview, dimensions, Save, Share, and foreground return reuse the same downloaded file instead of requesting another remote download. The operating system may evict cache files at any time. DoodleMe removes its owned temporary result files when a new generation starts and during later app-start cleanup; it does not promise immediate deletion while the app is stopped. This temporary cache is not completed-result history or restart-based result reopening. Copies that you save to the photo library or send through the platform share sheet are separate copies controlled by you or the selected destination.

Trial, purchase, and device-local state

DoodleMe may process limited state needed to operate the MVP, such as:

• install-scoped free-trial usage state
• Premium paid-period and daily allowance state, successful-result reservations, dispatched-attempt limits, and free-budget reconciliation holds
• aggregate operational notification state for quota warnings and free-generation pauses
• paywall, purchase, and entitlement state
• request status and error state
• a cached anonymous RevenueCat App User ID
• device-local state needed to continue or recover the generation flow
• a device-local AI processing consent record containing only its schema version, disclosure consent version, and acceptance time; this record is separate from billing and generation state and is not sent to the relay or providers

The MVP does not require you to create a user account before using the core flow. DoodleMe does not intentionally collect IDFA or another advertising device ID, payment-card details, advertising data, in-app customer-support form data, or product-interaction analytics.

Crash and diagnostic data

When release observability is enabled, DoodleMe may send Sentry crash and diagnostic data such as exceptions, request IDs, routes, components, failure stages, error codes, retryability, source, and environment. The DoodleMe Sentry wrapper does not send source-image bytes. The funnel analytics runtime sink is currently a no-op.

Technical request data

DoodleMe may process technical data needed to operate and measure the generation request path, such as request IDs, one-way request capability hashes, MIME type and filename, selected model, explicit quality and output-size settings, timestamps, status, output path, provider-attempt numbers and retry links, provider request IDs, durations, outcomes, available numeric usage, attribution category, cost classification, quota owner and paid-period references, allowance counters, free-budget holds, and error category information. The raw request capability is not persisted. Attempt measurement does not store source photo bytes, prompts, generated image payloads, secrets, or authorization headers.

How We Use Information

DoodleMe uses the information described above to:

• run the photo-to-image generation flow
• deliver generated outputs to you
• enforce the MVP trial and subscription rules
• diagnose generation failures and service issues
• support saving or sharing generated outputs from your device
• respond to support or privacy questions

DoodleMe does not describe the MVP as an on-device-only image generation service. The generation request uses a networked relay/provider path.

Processing Path

When you start a generation:

1. the app sends your selected photo and a fixed internal prompt through DoodleMe's relay-backed request path
2. the relay forwards the generation request to OpenAI's Images Edits endpoint using the configured supported image model, currently defaulting to gpt-image-2
3. the provider returns a generated output or an error state
4. DoodleMe returns the result to the app for display, saving, or sharing

This means your selected source photo and generation request are processed outside your device during the generation flow. Provider secrets are not stored in the mobile app client bundle.

Sharing and Service Providers

DoodleMe shares relevant data with named service providers only as needed to run the MVP:

Supabase relay, database, Storage, and operational logs

Supabase hosts the relay path, request lifecycle data, install-scoped trial records, Premium quota owners and paid-period counters, reservation and free-budget accounting, private generated output objects, signed URL operations, technical provider-attempt records, anonymized daily generation summaries, quota notification outbox entries, and operational logs. Source photo bytes are not stored in the DoodleMe lifecycle database, attempt tables, daily summaries, quota accounting, or generated-output Storage. Detailed attempt records are eligible for deletion after 30 days; cleanup first compacts them into daily summaries retained for 13 months. Settled generation reservations and paid-period summaries are eligible for deletion 30 days after the later of settlement, the paid-period end, or the latest verified grace observation; unresolved cost holds remain until reconciliation. Trial totals and quota identity/alias/subscription links have no repository-defined expiry or automatic cleanup. Supabase operational-log retention follows the active project and plan settings, and DoodleMe does not make a fixed retention promise for those provider-controlled logs.

OpenAI image processing

OpenAI receives the selected source photo and fixed prompt through the relay to create the image result. The current Images Edits path uses the configured supported model, default gpt-image-2. Provider retention and abuse-monitoring rules are controlled by OpenAI's current terms and project settings; DoodleMe does not promise provider-controlled retention beyond the settings it has verified for the release.

RevenueCat billing and entitlement processing

RevenueCat receives the anonymous App User ID, purchase history, subscription state, and entitlement information needed to enforce the free trial and determine paid access. The anonymous ID is a pseudonymous install-level identifier for App Privacy purposes, not a real-world DoodleMe account. RevenueCat retention follows its policy and the applicable project agreement. For a provider privacy request, contact DoodleMe support with the relevant anonymous App User ID if available; the provider/operator process controls deletion.

Sentry diagnostics

Sentry receives crash and diagnostic context for release triage when observability is enabled. It does not receive source-image bytes or the App User ID directly from the DoodleMe wrapper. Request IDs may be correlated with the corresponding install-scoped request record. Sentry retention follows the active project, plan, and DPA settings; DoodleMe does not make a fixed retention promise for Sentry-controlled diagnostics.

Apple App Store and Google Play

Apple and Google process store billing, transactions, renewals, refunds, and purchase history. The stores and RevenueCat control the applicable transaction and purchase-history retention. DoodleMe does not receive payment-card details and does not link the anonymous MVP purchase history to a real-world DoodleMe account.

DoodleMe does not promise broader data sharing uses that are not part of the MVP workflow described in this policy.

Retention Boundaries

DoodleMe is designed around narrow MVP retention boundaries:

• source photos are processed transiently during upload, relay handling, and provider generation and are not retained in DoodleMe's lifecycle database or generated-output Storage
• generated output objects are eligible for deletion after 7 days in DoodleMe Storage; a daily scheduled cleanup normally processes eligible objects after the cutoff through the Supabase Storage API, but temporary delay can occur if the scheduler or cleanup service is unavailable
• generated-output lifecycle rows are eligible for deletion after 30 days; the same cleanup process normally processes eligible rows after the cutoff, but temporary delay can occur if the scheduler or cleanup service is unavailable
• detailed provider-attempt rows are eligible for deletion after 30 days and are compacted into anonymized daily summaries retained for 13 months; summaries contain no request ids, anonymous App User IDs, source photos, prompts, generated payloads, raw capabilities, secrets, or authorization headers
• signed output URLs expire after five minutes
• temporary generated-result cache files are stored only for the current result flow, may be evicted by the operating system, and are cleaned on a later generation start or app launch; DoodleMe does not promise immediate deletion while the app is stopped
• anonymous trial totals, quota owner IDs, customer aliases, and subscription-owner links are retained for allowance enforcement and restore continuity; these records have no repository-defined expiry or automatic cleanup
• settled generation reservations and paid-period summaries are eligible for deletion 30 days after the later of settlement, the paid-period end, or the latest verified grace observation; unresolved cost evidence remains until reconciliation
• OpenAI's current Images Edits path has no application-state retention for image edits under its current documentation, but default abuse-monitoring logs may be retained for up to 30 days and image-review exceptions may apply
• RevenueCat purchase, entitlement, and anonymous App User ID data follows RevenueCat's policy and project agreement; a provider privacy request requires enough information, such as the anonymous App User ID, for the provider/operator to identify the record and handle deletion
• Sentry diagnostics and Supabase operational logs follow active provider project and plan settings; DoodleMe makes no fixed provider-log retention promise
• Apple and Google store billing systems and RevenueCat control transaction and purchase-history retention
• if you save or share a generated output from your device, copies stored on your device or in destinations you choose are controlled by you or those third-party destinations
• device-local app state related to trial, entitlement, billing, or in-progress generation may remain on your device until you clear the app, reinstall it, or the app updates that state

Because the MVP uses third-party infrastructure to run the generation flow, provider-controlled operational copies and limits may also apply in those provider environments. DoodleMe does not control provider retention, processing, or operational copies outside the DoodleMe storage and lifecycle windows described above.

Your Choices

You can decline AI photo processing before the photo picker opens. Choosing a photo alone does not grant consent. After you explicitly agree and the app saves your acceptance, future photo selections skip the disclosure while that consent version remains current. Missing, invalid, outdated, or unreadable consent does not authorize new photo submissions. Material changes to the processing disclosure require renewed agreement.

You can withdraw AI processing consent in Privacy. Withdrawal immediately blocks new photo submissions in the current app session and clears the staged source photo. The app confirms withdrawal only after it verifies that the saved acceptance is invalidated. If saving withdrawal fails, the app shows a retry action and keeps new submissions blocked in the current session; it cannot guarantee that an unsuccessful withdrawal survives closing the app. Retry withdrawal before closing the app.

Withdrawal does not cancel requests already sent, delete existing results, or cancel a subscription. You can still retrieve results from requests already sent. Cancelling the photo picker after successful acceptance keeps your consent and sends no photo.

You can delete generated images saved on your device using your device controls.

If you purchased a subscription, billing and restore behavior is handled through the app's subscription flow and the applicable Apple App Store or Google Play billing system. Store cancellation and payment-card questions should be handled through the applicable store.

Children's Privacy

DoodleMe is an MVP consumer app and is not designed as a service directed specifically to children. If you believe personal information was submitted inappropriately through the app, contact the support address listed below.

Changes To This Policy

DoodleMe may update this Privacy Policy as the MVP evolves. When the canonical policy changes, the updated version should replace this document and carry a new "Last updated" date.

Contact

For privacy questions or requests, contact: support@doodleme.app. DoodleMe can explain its retention boundaries, but the app has no account or in-app deletion dashboard. Requests about provider-controlled records must include enough information, such as an anonymous App User ID, for the applicable provider/operator to identify the record and follow its process. Do not send a source photo unless support specifically asks for it.

This address is the canonical support contact for the MVP legal/support surfaces and should stay aligned with the Terms of Service, support surface, web mirrors, and release metadata.