Privacy Policy

This Privacy Policy describes how 402labs (“we,” “us,” or “our”) collects, uses, and shares information about you when you use ColorMe (available at colorme.app and as a mobile app). By using ColorMe, you agree to the collection and use of information as described in this policy.

1. Information We Collect

Account Information

When you sign in with Google or Apple, we receive your email address, display name, and profile photo from your identity provider. We store these to identify your account and personalize your experience. We do not receive or store your Google or Apple password.

Content You Provide

ColorMe processes two types of content you provide:

• Photos you upload: Images you submit to be converted into coloring pages. These are transmitted to Google's AI services for processing and are not permanently stored on our servers after processing is complete.
• Text prompts: Descriptions you type to generate coloring pages from text. These prompts are transmitted to Google's AI services and may be stored in association with your account to maintain your generation history.
• Generated images: The coloring pages we create for you are stored in association with your account so you can access your history.

Payment Information

Payments are handled entirely by Stripe. We do not store your full credit card number, CVV, or billing details on our servers. We retain a Stripe customer ID to associate your one-time page-pack purchases with your account.

Usage Information

We collect information about how you use ColorMe, including the features you access, generation counts, and error logs. This information helps us improve the service and diagnose technical issues.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the ColorMe service
• Process your photos and text prompts to generate coloring pages
• Process your page-pack payments
• Save and display your generation history
• Provide payment receipts (issued directly by our payment processor, Stripe)
• Respond to your support requests
• Improve and debug the service
• Comply with legal obligations

We do not sell your personal information or use it for advertising purposes.

3. Third-Party Services

ColorMe relies on the following third-party services, each with their own privacy practices:

Google's privacy policy applies to data processed by Google Gemini. Supabase's privacy policy applies to your account data. Stripe's privacy policy applies to payment data.

4. Photo and Image Handling

When you upload a photo to be converted into a coloring page, that photo is transmitted directly to Google's Gemini API over an encrypted connection. We do not permanently store the original photo you upload on our servers. The resulting coloring page (the output image) is stored in your account history.

Please do not upload photos containing sensitive personal information, government-issued ID, medical imagery, or images of individuals who have not consented to processing.

5. Children's Privacy

ColorMe is a family-friendly app, but accounts may only be created and held by an adult who is 18 years of age or older. At sign-up you confirm that you are 18+ (or a parent/legal guardian setting up the account for your family). The app is not directed to children for independent sign-up or use; any coloring pages made from a child's photo are created by the supervising adult account holder, who is responsible for that content.

We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information directly from children under 13. If a parent or guardian believes their child under 13 has provided us with personal information without consent, please contact us at hardy@402labs.app and we will delete the information promptly.

6. Data Retention and Deletion

We retain your account information and generation history for as long as your account is active. Your account data remains available until you request deletion.

To delete your account and all associated data: visit our account deletion page, or email us at hardy@402labs.app with the subject line “Delete My Account.” We will process your request within 30 days. Deletion includes your profile, all generated images, and your generation history. Your billing details are removed from Stripe and no further charges will occur.

Certain data (such as transactional records) may be retained as required by law or for legitimate business purposes such as fraud prevention.

7. Local Storage and Session Data

To keep you signed in, ColorMe stores your authentication session in your browser's local storage (via our authentication provider, Supabase). For convenience, recently generated and colored pages are also cached in your browser's local storage on your device so they load instantly. This on-device data is cleared when you sign out or delete your account.

We do not use third-party advertising cookies or tracking pixels, and we do not run any analytics scripts. Clearing your browser's site data will sign you out and remove these local copies.

8. Data Security

We use industry-standard security measures including HTTPS/TLS encryption for data in transit, and rely on Supabase and Stripe's security infrastructure for data at rest. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. We will notify you of any data breach as required by applicable law.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Opt-Out: We do not sell personal information, so there is no opt-out needed. We will not discriminate against you for exercising your rights.
• Right to Correct: You may request that we correct inaccurate personal information.

To exercise these rights, contact us at hardy@402labs.app.

10. Your Rights in the EEA and UK (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent UK law give you the rights described below. The data controller is 402labs (contact details in the “Contact Us” section).

Legal Bases for Processing

• Performance of a contract (Art. 6(1)(b)) — to create your account, convert your photos and prompts into coloring pages, store your history, and provide support.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, enforce usage limits, and debug, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — to retain certain transactional records and respond to lawful requests.
• Consent (Art. 6(1)(a)) — where we ask for it; you may withdraw it at any time.

International Data Transfers

ColorMe is operated from, and all data is processed and stored in, the United States (our sub-processors include Supabase/AWS in us-east-1, Vercel, Google, and Stripe). If you use ColorMe from the EEA or UK, your information is transferred to the U.S. Where required, these transfers rely on the EU-U.S. / UK Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Your Rights

You have the right to access a copy of your data, rectify inaccurate data, erase your data, restrict or object to processing, port your data, and withdraw consent. To exercise these, use the account deletion page (erasure), the “Download my data” option in Settings (access & portability), or email us at hardy@402labs.app. Your name and avatar come from your Google or Apple sign-in — update them with your provider, or email us to correct them. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

Retention Periods

• Account data and generated images: kept while your account is active and deleted when you delete your account.
• Operational usage logs: retained for up to 24 months, then automatically purged.
• Payment and transactional records: retained as required by law (and held by Stripe).

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you by email. Your continued use of ColorMe after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or your personal data, please contact us: