Privacy policy

Who we are

My Doodle World (mydoodleworld.com) is run by Marcio Santos, a sole trader in the United Kingdom trading as Santos Media Labs. He is the controller of the personal data described here.
Contact: [email protected]. Postal address: available on request by email.
This policy is written for grown-ups. Children don't give us their details: a parent, carer or other grown-up fills in every form.

Making a book

We collect what you type into the form: the child's first name, their age or the level you pick, what they love (from our list of themes), whether they are a boy or a girl (so the pictures and the story get them right), whether you want the Storybook and the format. At checkout we collect your email address so we can send the book.
We use these details only to make the book, deliver it and help if something goes wrong. Our lawful basis is that we need them to do what you asked (a contract).
Before a book is made, the child's name, any gift message and any theme you suggest are checked so the book can't carry swear words or anything unkind. That check runs on our own word lists and then through Anthropic's service. Anthropic sees only that word or phrase, not your email or anything else about you, and under its commercial terms it doesn't use what we send to train its models.
If you choose the Storybook, the story text is written through Anthropic's service from the interests, level and age. The child's name is never sent: the story comes back with a placeholder, and we put the name in on our own server.

Payments

Payments are handled by Stripe. For PDF books, Doodle Club and gifts, Stripe, through Link, is the seller of record (the "merchant of record") and handles tax. Stripe calls this Managed Payments. You type your card details into Stripe's page, not ours, and we never see them.
Stripe tells us the payment worked, the amount and your email address. Stripe keeps payment records under its own privacy policy and the law.

Printed books

For a printed book we also keep the delivery address you give at checkout (with the phone number the courier may need) and your email address, so we can make the book, post it and tell you how it's going.
We send the book files and the delivery address to Lulu Press, Inc. in the United States, our printer, which prints the book and posts it to you. Lulu uses them only for that, with the same safeguards as the other services in "Who helps us run the site".
We keep the delivery address until 90 days after the book is posted, so we can send a new copy if the parcel arrives damaged or goes missing, and answer any question about the card payment. If an order is cancelled before it goes to the printer, we delete the address straight away. The rest of a printed order follows the timetable under "How long we keep it".
Card payments for printed books are taken by Stripe, as described under "Payments". We never see your card details.

Gifts

When you send a book as a gift we keep your message, the name it's from and the name of the person you're sending it to. For a printed gift we also keep their delivery address; for a PDF gift, their email address and the day you chose. We use these only to make and deliver the gift.
A printed gift goes to Lulu, our printer, with their name and address, as described under "Printed books". We keep and delete their address on the same timetable as any printed order. Every email about the order goes to you, not to them, and the parcel has no prices in it.
For a PDF gift we use their email address once, to send the gift on the day you chose. We never add it to any mailing list, never send it reminders or offers, and never email it again.
The message and their details are deleted with the rest of the order: 90 days after posting for a printed gift, and 30 days after it's sent for a PDF gift, so we still have the book on the day it's due.

Gift memberships

When you buy a Doodle Club gift we keep your email address to send you the code and to handle any refund, and delete it 90 days after the gift is used or refunded. We don't ask for, or keep, the name of the person you're giving it to. Whoever uses the code does so with their own account.

Theme suggestions

Anyone can suggest a theme on the order page. We keep the words you typed and the date, and nothing else: no name, and no link to an order. Before we store a suggestion it goes through the same safety checks as the rest of the site, including the automatic language check described above.
Your email address is optional. If you give it, we use it only to tell you about that theme, never for marketing, and we delete it 90 days after you sent the suggestion.
We may keep the suggestion itself (without any email address) to help us choose new pages. Please don't put a child's name or other personal details in it.

How long we keep it

Download links for PDF books last 72 hours.
PDF books: 30 days after delivery (for a PDF gift, 30 days after it's sent) we delete the book files and remove the child's name, age, interests, the story, your email address and any gift message and recipient details from the order.
Printed books: we keep the same details, the book files and the delivery address for 90 days after the book is posted, so we can reprint a parcel that arrives damaged or goes missing and deal with any card dispute. Then we delete them in the same way. A printed order cancelled before it reaches the printer follows the 30-day PDF timetable, and its address is deleted straight away.
What stays after that is an anonymous record of the order: the date, format, level, price and the payment reference, with no name, email or address. We keep it for our accounts, as UK tax rules require: HMRC asks businesses to keep their records for at least 5 years after the 31 January Self Assessment deadline for the tax year the sale falls in.
Stripe and Lulu keep their own records of your payment and your print order under their own privacy policies and legal duties, which we don't control. That includes Lulu's copy of the print files and the delivery address.
Books that were started but never paid for are deleted the same way after 7 days.
Doodle World's daily play totals: 400 days.
These deletions run automatically every day.

Colouring in on this site

The free colouring pages save your colouring in this browser only (on your device). Nothing about you or your child is sent to us. Clearing your browser data removes it.
Doodle World, the world your child walks around, keeps everything on your device: the doodle your child makes (body, skin tone, hair, clothes, glasses, hearing aids, wheelchair, head covering), the colours they use, their stickers, passport stamps, crayons and game stars. None of it is sent to us, and there are no names, photos or free text in it. Separately, we count what is played each day, with nothing about who played it (see Play counts in Doodle World).
Doodle World has no chat, no other players and nothing shared between children. The characters' voices are our own recordings played on your device. We don't use advertising or tracking in it.
Grown-up settings and the usage summary are kept on your device only.
If you install the site as an app, it keeps a copy of the free pages on your device so they work offline.

Play counts in Doodle World

To see which games are too tricky and which stories children enjoy, Doodle World counts what is played each day: for example "Plum's Post Round finished, 2 stars" or "Moonbeam Heights visited". We count plays, never people.
Your device keeps the count in its memory while Doodle World is open and sends it to us when Doodle World is closed or put away. Nothing is saved on your device to do this, and the count carries no name, account, device id, cookie or time of day.
We add the counts straight into daily totals and keep only those totals, for 400 days. We never record who sent them. When we look at them, any number under 5 is hidden.
Your internet (IP) address reaches our server with the count, as with any web request. We use it only for a moment, to stop anyone flooding us with fake counts, and we don't store it. Under US children's privacy rules (COPPA) this is "support for internal operations".
To switch it off, open the Grown-ups corner in Doodle World and untick "Send anonymous play counts". If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

In the iPad and iPhone app

The My Doodle World app is built so that what your child makes stays with your child. There are no accounts, no sign-in, no adverts and no chat, and nothing a child makes can be shared with other people.

What stays on your device

These are stored by the app on the iPad or iPhone only, and are never sent to us:

each child's profile: their first name, the colour you picked for them and the story words (she/her or he/him)
everything your child colours: their pictures, drawings, stickers and gallery
game progress, stars and passport stamps in Doodle World
each child's grown-up settings (time limits, quiet hours, sensory and pace, celebrations, content, places, sound)
the usage summary in the Grown-ups corner, worked out on the device from the last 30 days
your personalised books, with the child's name added on the device

We never ask for a child's surname, photo, date of birth, email address or location, and the app doesn't use the camera, microphone, contacts or location.

The app doesn't back these up to us. If you back up your device with iCloud or a computer, Apple's backup can include them; that backup is Apple's service and yours, and we can't see it. If the device is lost and there's no backup, or the app is deleted, they're gone.

What reaches our server, and why

The app talks only to our own server (mydoodleworld.com) and to Apple. It asks our server for:

the colouring pages, game files, story videos, the Doodle World map and the word lists used to check a name on the device, so it has something to show
a personalised book: the app sends the themes chosen, the level, the number of pages, whether you'd like a story, and Apple's signed record of the purchase. It doesn't send the child's name, the story words or anything else about your child. Our server refuses any request that includes a name, email address or age.
Doodle Club: the app sends Apple's signed purchase records so our server can check the membership with Apple and unlock the Club pages and games.

Like any website, our server sees the internet address (IP address) of the device making a request. We use it, in memory only, to stop the service being overloaded, and we don't store it with anything. Our hosting and network providers keep short-lived request logs for security and to keep the service running; we don't use them to identify anyone.

What we keep:

For each book: a book number, Apple's transaction reference, the product, the themes, level and number of pages, whether it has a story, and the page list with the captions and story lines (with a placeholder where the name goes). Nothing about you or your child. We keep it for as long as you might want to restore the book on another device, because Restore purchases needs it. Ask us and we'll delete it (see Deleting data below).
For Doodle Club: what Apple tells us about the subscription (its reference, plan, status, expiry date and any refund). No name or email.

If you choose a story, our server has the story text written through Anthropic's service from the book's pages, themes and level. Nothing about your child is sent: not the name, the age or the story words. The story comes back with a placeholder where the name goes, and the app puts the name in on your device. Under Anthropic's commercial terms it doesn't use what we send to train its models.

Purchases

In the app, purchases and the Doodle Club subscription are handled by Apple. (Doodle Club can also be bought on our website, where Stripe takes the payment; the website section of this policy covers that.) You pay Apple, and Apple handles billing, cancellations and refunds. We never see your name, email address, card or Apple Account. Apple sends us a signed record of each purchase (which product, when, and a transaction reference), which we check with Apple to make your book or unlock Doodle Club.

No adverts, tracking or analytics

The app has no adverts and no third-party code at all: no analytics, advertising, attribution or crash-reporting kits. It uses only Apple's own frameworks. It doesn't use Apple's advertising identifier and doesn't track your child across other apps or websites. We don't count visits in the app the way we do on the website: Plausible and Cloudflare Web Analytics aren't in the app.

If you've chosen to share analytics with app developers in your device's settings, Apple may pass us its own anonymous crash reports and usage totals. These come from Apple, are switched off unless you opt in, and can't identify you or your child.

The games inside the app can't reach the internet: the app blocks every network request and every link from inside a game.

Children's privacy

My Doodle World is made for children from about 2 to 10, with pages at three levels. The app is listed in the App Store's Kids category, which asks us to choose a single age band for the listing; that doesn't change who the app is for. We follow the spirit of the UK's Age Appropriate Design Code and the US Children's Online Privacy Protection Act: we collect the least we can, nothing about a child leaves the device, profiling is off unless a grown-up switches it on, and there are no nudges to buy. Purchases, settings, sharing a picture and every link that leaves the app sit behind a grown-up check: a PIN the grown-up sets the first time, or Face ID or Touch ID if the grown-up switches it on, and a child who taps something locked never sees a price.

Deleting data

To remove one child: Grown-ups area, tap the child, Delete this child. This removes their pictures, drawings and game progress on the device.
To remove everything on the device: Grown-ups area, Privacy, Delete everything on this device, or delete the app.
To delete a book's record on our server, email [email protected]. Tell us roughly when you bought it; we may ask for the order ID from your Apple receipt so we delete the right one, since we hold nothing else that links it to you.
Subscriptions are cancelled with Apple, in Settings, your name, Subscriptions.

We reply to every privacy question within 2 working days. We act on a request to see or delete your data within one month, as UK data protection law requires, and usually much sooner; if a request is unusually complicated we'll tell you within that month if we need longer. Your rights, and how to complain to the Information Commissioner's Office, are as described under "Your rights" below.

Doodle Club accounts

The account belongs to the parent or carer: we keep your email address and your subscription status. You sign in with a link or a 6-digit code we email you, or with Apple or Google, which tell us only your email address. We don't use passwords.
For each child (up to four) we keep only a first name and a colour you pick. We never ask for a child's email address, date of birth or photo.
We keep each child's colouring (a picture of the colours they added) and which pages they finished, so they can carry on and see their gallery. Nothing in the Club is public or shared with other families.
Payments and the subscription are handled by Stripe, which, through Link, is the seller of record (the "merchant of record") for Doodle Club, as for PDF books. We don't see your card details.
Pictures are kept while you're a member and deleted 30 days after your membership ends. "Delete my account" on the account page deletes your account, your children's profiles, their pictures, your joined devices and anything they synced, and any requests you sent us, and cancels the subscription.

Family devices and sync

Grown-ups can sign in in the app, behind its grown-up check, with Apple or with a 6-digit code we email them. Children never sign in.
To add a child's iPad or iPhone to your family, you make a short code on the Devices and sync page in your family's pages (or in the app's grown-ups' area) and type it on that device. The code is random letters that work once, for 10 minutes. The device gets its own key, which can't see your account. We keep which child it's for, whether it's an iPad, iPhone or browser, and when it joined. You can remove it at any time.
Sync is off unless you switch it on. When it's on (it's part of Doodle Club), we keep a copy of each child's grown-up settings and the usage summary (time, and what they coloured, played and watched, for the last 30 days), so they're the same on your family's devices. Nothing else, and no drawings.
Drawings stay on the device unless you switch on "Share drawings" for that one device on the Devices and sync page in your family's pages. Then the pictures your child finishes there are shown to you in "What your child made" in your family's pages, and nowhere else. We keep only the picture (made smaller, with nothing else in the file), the day it was made and which device it came from, for 35 days, and you can delete any of them at any time. Switching sharing or sync off, removing the device or deleting your account deletes them straight away.
Switching sync off deletes the copies straight away. They're also deleted 30 days after your membership ends, and when you remove the device or the child, or delete your account.

"Make it extra personal" requests

We keep the child's first name, what you told us they love, the level and format you chose, and your email address, so a person can reply to you. Requests are deleted after 90 days, or straight away if you delete your account.

Visitor statistics (no cookies)

We count visits with Plausible Analytics and Cloudflare Web Analytics. Neither uses cookies or tracks you across other websites, and we never send them a name, an email address or an order number. Plausible sees the page (with order links shortened, for example /o/_/status), the site you came from, your country and the kind of device and browser; it doesn't keep your IP address.
We also count, on our own server, how many people reach each step of making a book, with the date only: no IP address, no account and nothing about the child.
If you arrive from an advert or a link with a campaign tag (utm_source and similar), your browser keeps that tag until the tab is closed and sends it with your order, so we can tell which adverts work. It describes the advert, not you.
If your browser sends Do Not Track or Global Privacy Control, none of this runs.
Doodle World's play counts are described above, in Play counts in Doodle World.

Reminder email

On the preview page you can tick "Email me a reminder if I don't finish". If you do and haven't paid, we send one email 2 to 24 hours later with a link back to your preview, and never another. We record when you ticked the box. Every reminder has an unsubscribe link that works without signing in.

Cookies

We use only the cookies the site needs to work: one that keeps forms secure and, if you join Doodle Club, one that keeps you signed in (and a short-lived one while you sign in with Apple or Google). We don't use advertising or tracking cookies, so there's no cookie banner to click.

Who helps us run the site

Render hosts the site and its data in Frankfurt, Germany.
Cloudflare protects the site and delivers pages quickly.
Stripe and Link take payments.
Lulu Press, Inc. (United States) prints and posts printed books.
Resend sends our emails (download links, sign-in links and the one reminder you can ask for).
Anthropic provides the name check and writes Storybook text, as described above.
Plausible Analytics and Cloudflare Web Analytics count visits without cookies.
Apple and Google, only if you choose to sign in to Doodle Club with them.
Each of them handles data only to provide its service to us. Some are based in the United States; where data leaves the UK or EU, it's protected by the safeguards the law requires, such as standard contractual clauses or the UK and EU data bridges with the US.
We don't sell or rent personal data, we don't share it for advertising, and we don't show adverts on the site.

Children's privacy

We collect as little as we can about children: a first name, an age or level, and what they love. We never ask for a child's surname, photo, email address, date of birth or location, and nothing a child makes on the site is public.
Children's details are used only to make what the grown-up ordered, never for marketing or profiling, and they're deleted on the timetable above.
If you think we have a child's details we shouldn't, email us and we'll delete them.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to stop or limit how we use it, or to send it to you in a common format. Email [email protected] and we'll reply within one month. We may ask you to confirm it's you, for example by replying from the email address on the order.
Where we rely on your consent (the reminder email), you can withdraw it at any time with the unsubscribe link.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to the data protection authority where you live in the EU.
If you live in a US state with a privacy law, you have similar rights to know, correct and delete. We don't sell or share personal information as those laws define it.

Changes

If we change how we use personal data, we'll update this page and the date below. If a change is significant, we'll say so on the site, and Doodle Club members will get an email.
Last updated: 26 October 2026.