Privacy
Inklingly draws on a server, so it holds things: your account, the pages you make, and — for a few minutes — a photograph if you give it one. This page says exactly what each of those is and what happens to it.
The short version
- A photograph you upload is used to make the page and then deleted. Not archived, not kept for training, not attached to anything you publish.
- Everything you make starts private and stays private until you publish it yourself, which is a deliberate act with a screen in front of it.
- There is no advertising and no third-party tracking — no ad network, no advertising identifier, no analytics SDK and no crash reporting. Our own server counts what happened; it never records who or what.
- Nothing is sold or shared for marketing, because nothing is collected for it.
What is stored
Your email address, so you can sign in and get back to what you made. Your password is not stored: signing in is handled by Supabase Auth, which keeps a hash of it and never the password itself.
A profile — a display name and, later, a handle and a picture, each of which is optional and none of which is asked for at sign-up. It deliberately holds no real name, no date of birth and no location. A colouring-page app has no business knowing where you live.
The pages you make, and what you asked for. One record per attempt, including the ones that failed: the description you typed if you typed one, the style, detail, who it was for and which way up it is, when it ran and whether it worked. The description you typed is the most private thing in the database and is treated that way — it is read back only for you, it never appears in a log, and it is never attached to a page anybody else can see.
The images themselves, held as files: the small watermarked preview, and the full-size printable and its PDFs once you ask for one.
Your Pages, and a record of each one spent. The balance and an append-only line for every credit that moved, because a record of what you were charged for is the thing that lets a mistake be found and corrected.
What you did with other people’s pages. If you publish, the published page is its own record — title, category and a public copy of the drawing. If you like one, save one, unlock one or report one, that is a row saying which account and which page, because there is no way to show you your own saved pages without one.
A count of how often you have called the service. A number per account, per limit, per minute or hour, so that one account cannot use the service up. It is a counter and nothing else: no addresses, no paths, no record of what any of the calls were.
Photographs, and what happens to one
If you hand over a photograph, it goes from your phone to our server and into storage that holds nothing else. It is used to make one drawing, and then it is deleted.
The delete happens on every path — when the drawing worked, when it failed, when the model refused it, and when something on our side went wrong. The failure path is the one nobody looks at, so it deletes first and asks no questions about how the generation went.
And there is a second mechanism underneath the first. The storage the photographs go into expires everything in it within a day, as a property of the storage rather than as a job we run — so a photograph whose generation never finished at all still goes.
No part of the app can serve one back. The code path that shows you an image cannot reach that storage at all: it holds no connection to it, it refuses to sign a link that points into it, and the database will not accept a row that says an image lives there and is safe to show. That is four separate locks, and it is deliberate — a photograph reachable from a published page is the one failure this design exists to make impossible.
Publishing a page never publishes the photograph it came from. The two are different objects in different places with different lifetimes, and by the time a page could be published the photograph is long gone.
One thing that is kept, and it is not your photograph
When the app draws a page, it keeps a clean, un-watermarked copy of its own drawing for a short while. That is what lets the printable be the same picture you approved rather than a second, different attempt at the same request.
This is the app’s output, not your photograph, and the two are not the same thing. It contains no part of any photograph you gave us — that was deleted when the drawing finished. The clean copy is deleted the moment you make the printable from it, and after fourteen days if you never do.
Who else it passes through
Supabase runs the hosted PostgreSQL database your account and your pages live in, and handles signing in.
Cloudflare runs the service the app talks to and the storage the images sit in. Which rows a signed-in account may read or write is decided by policies inside the database itself, and that service connects as a role that cannot bypass them — so one account cannot reach another’s pages even if the code in front of the database were wrong.
Google, whose image model does the drawing. What is sent is the words describing the picture, the photograph’s bytes if there is one, and the size and shape of page wanted. Your account is not part of that request — no email address, no name, no identifier of yours goes with it. The request is made by Inklingly, not by you.
All three keep their own service logs of the requests made to them, in the ordinary way any hosted service does; those logs include technical details such as an IP address. None of the three is sent anything for advertising, and nothing about you is sold.
The mail the app sends you — confirming your address, resetting a password — goes out through Supabase, who are sent your address and the message for that purpose alone. There is no marketing mail and nothing to unsubscribe from.
Publishing, and what becomes public
Nothing you make is public unless you publish it. Every page starts private and stays in your library. Publishing is an explicit act rather than a setting that could be wrong by accident, and the app shows you exactly what will be shared, on a screen, before anything happens.
What becomes public is the watermarked drawing, the title you gave it, the category you filed it under, and whatever display name and handle you chose. That is the whole list. The words you typed to get the drawing are not part of it — they stay in your library, readable only by you — and neither is your email address nor any photograph.
A page derived from a photograph asks you one more question first: whether everybody who can be recognised in it is content for it to be published. It is a question rather than a checkbox buried in a settings screen because it is about somebody who is not the one tapping the button.
Published pages are moderated, and can be reported. A page is checked before it appears and can be removed afterwards; anybody who sees one can report it, and the report records which account sent it and why. Reports are read by us and are not shown to the person who published the page.
Liking and saving are private to you. There are no follower counts, no public like lists and no way to see who liked or saved anything. A creator is told how many times a page was unlocked, and never by whom.
Terms is where the rights you grant by publishing are written down, because hosting a page and showing it to other people is something we need your permission to do.
A page somebody publishes outlives their account: if they close it, the page stays and stops being attributed to anybody — the display name and the handle come off it. That is a deliberate decision rather than an oversight, because other people may have liked and saved it, and it is on the deletion page as well as here.
Money
Nothing can be bought yet, so today there is no payment information of any kind, anywhere. No card, no billing address, no purchase history — not held badly, not held at all.
Pages do move between accounts, though. Unlocking somebody else’s published page spends one of your Pages and returns a tenth of one to whoever drew it. Both sides of that are recorded, because a credit that moved and cannot be traced is a credit nobody can put right. The creator is told that a page was unlocked and how much they earned; they are not told who unlocked it.
When packs of Pages and the Inklingly+ subscription arrive, the seller is the app store and not us. We never see your card and no payment detail is stored by us. What we hold is a record that a purchase happened and what it granted, which is what lets a refund or a double charge be put right.
Whether a subscription is currently paid up is decided from the store’s own record, never from anything your phone claims. That is a security rule first, and it also means a lapsed subscription cannot be caused by us mislaying something.
What is not collected, and what is counted
The app on your phone measures nothing. There is no analytics SDK in it, no advertising, no advertising identifier, no third-party tracking and no crash reporting. There is no ad network, so there is nobody to share anything with. It does not read your contacts, your location or anything else on the phone beyond the photograph you choose to hand it.
Our own server does count things, and it is worth saying exactly what, because “no analytics” on its own would be too flattering. Ten kinds of event are written to our service log: a page was requested, a page finished and whether it worked, a page was published, unlocked, reported or unpublished, an account was deleted, a request was rate limited, the nightly tidy-up ran.
None of them carries your account, a page, or anything you typed. They carry shapes and counts — which style, how long it took, whether it succeeded, how many files — and that is not a description of our intentions. A value that is not a number, a yes-or-no or a short known word is rejected as the event is written, and the whole event is thrown away rather than recorded partially. A description, a title, an email address or an account identifier cannot satisfy that shape, which is the point of choosing it.
How long things are kept
Deliberately different for each thing, because they are different kinds of thing.
| What | How long |
|---|---|
| A photograph you uploaded | Deleted as soon as the drawing finishes, and expired within a day whatever happens |
| The clean copy of a drawing | Deleted when you make the printable, and after fourteen days if you never do |
| A page in your library, and its files | As long as you keep it |
| A page you deleted | Gone from the app at once; its files are removed thirty days later |
| A page you published | Until you unpublish it, or it is removed. It outlives your account, with your name off it |
| Your account and your credit record | Until the account is deleted |
| Rate-limit counters | A number per limit per window, never read again once its window has passed, and deleted with the account |
| Service logs at Supabase, Cloudflare and Google | Their own retention, and they are not a copy of your library |
Deleting things
Deleting a page removes it from the app at once. It leaves your library immediately and stops being reachable; the image files behind it are deleted thirty days later, which is the window that lets a mistake be undone rather than a reason to keep anything.
Deleting your account happens when you tap the button. It is not a request somebody processes later: your files go, then your account, and you are signed out. There is no waiting period and no way to undo it. The deletion page says exactly what goes, the one thing that stays, and what to do if you cannot get into the app.
Anybody who unlocked a page of yours is refunded as part of it. Their unlock bought the right to print your drawing, and your drawing is going, so the Page they spent goes back to them before your account row is removed.
Children
Inklingly makes pictures children colour in, and it is not made for children to use on their own. An account is meant to belong to an adult, and it is the adult who describes a picture, chooses a photograph and decides whether anything is ever published.
Nothing in it is aimed at children, and we do not knowingly collect anything from one. If you think a child has created an account, email support@tinylantern.app and it will be removed.
Asking for a copy, or a correction
Everything the app holds about you is visible inside it: your profile, your library, and what each page cost. If you want a copy in another form, something corrected, or everything deleted, email support@tinylantern.app from the address you signed up with, and a person will answer.
Last updated 5 September 2026. This is a plain-English description of what the app does rather than legal advice; the wording is reviewed by somebody qualified before release, and this page is kept in step with the app rather than written once.