Privacy Policy

Scribbletastic is a children's creative wellbeing application operated by Expressions Creative Studio.

Data Controller: Expressions Creative Studio
Contact: expressionscreativestudio@gmail.com

This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with the UK & EU General Data Protection Regulation (UK GDPR / GDPR).

Scribbletastic is designed for use by children (ages 3 and over), parents/guardians, and therapists/professionals.

Children under 13: In line with GDPR Article 8, children under 13 must only use this app with the knowledge and consent of a parent or guardian. By registering a child account, the parent or guardian confirms they have provided this consent.

Therapists & Professionals: Accounts with a therapist/admin role are subject to their own professional data-handling obligations. Scribbletastic provides the tools; therapists are responsible for ensuring compliance with their professional regulatory body.

We collect only the minimum data necessary:

• Account data: Email address, name (first name only), and selected role (child / parent / therapist)
• Drawing data: Artwork images, stroke recordings, drawing duration, and any associated prompt used
• Mood & emotion data: Mood check-ins and optional short notes submitted by the user
• Usage data: Basic analytics (e.g. features used, session frequency) — no advertising trackers

We do not collect: location data, device identifiers, biometric data, or any data not listed above.

We use collected data solely to:

• Provide the core app experience (saving drawings, mood tracking, rewards)
• Allow authorised therapists/admins to review a child's creative output for therapeutic purposes
• Improve the app's performance and user experience (aggregated, anonymised analytics only)
• Respond to support or data access requests

Legal basis (GDPR): Legitimate interest for app functionality; consent for optional emotional data.

All data is stored securely using the Base44 platform, which provides encrypted storage and access controls. Data is hosted on servers within the European Economic Area (EEA) or with appropriate safeguards.

Access controls: Row-level security ensures each user can only access their own data. Therapist notes are restricted to admin accounts only. No data is publicly accessible.

We implement appropriate technical and organisational measures to protect against unauthorised access, loss, or disclosure.

We do not sell, rent, or share personal data with third parties for marketing or advertising purposes.

Data may only be shared with:

• Authorised therapists/admins within the same Scribbletastic account, for therapeutic review
• Law enforcement if legally required to do so

We retain personal data for as long as an account is active. When an account is deleted:

• All drawings, mood data, and personal information are deleted within 30 days
• Anonymised, aggregated usage statistics may be retained indefinitely

Under UK/EU GDPR, you (or a parent/guardian acting on behalf of a child) have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of all your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, email: expressionscreativestudio@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk (UK) or your local supervisory authority (EU).

Scribbletastic uses only essential session cookies required for authentication. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top and, for significant changes, notify users by email or in-app notification. Continued use of the app after changes constitutes acceptance of the updated policy.

For any privacy-related questions, data requests, or concerns: