Data Use Policy
Every category of data we hold: why we have it, who processes it, where it lives, and how long it stays.
Last updated: · Effective:
Section 1. What this document is
The privacy policy explains our handling of personal information in prose. This page is the same facts in tables, one row per thing we actually hold, so you can look up a single item and see everything about it at once.
Where the two documents cover the same ground they say the same thing. If you ever find that they do not, tell us at [email protected] and we will fix it; until we do, the privacy policy governs.
Implicit Labs, Inc. is the controller of everything described here.
Section 2. How to read the tables
- Why is the job the data does. If the job stops, we stop holding the data.
- Lawful basis is the ground we rely on under Article 6 of the GDPR and the UK GDPR. It is there for readers in Europe and the United Kingdom; everybody else can read it as “why we are allowed to”.
- Who processes it names the service providers that touch that row. All of them act on our instructions, and none of them may use it for their own purposes.
- Kept for is the real answer, not an aspiration. Where the code has no timer, the row says so.
A table wider than your screen scrolls sideways on its own; the page does not.
Section 3. Your account
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| Email address | Signing in, account email, confirming a deletion | Contract | DigitalOcean, Resend | While the account exists |
| Password, stored only as a hash | Signing in | Contract | DigitalOcean | While the account exists |
| Display name, if you set one | Shown back to you in the app, and nowhere else | Contract | DigitalOcean | While the account exists |
| Account status, role, and whether the account is a guest | Running the account and enforcing a suspension | Contract, legitimate interest | DigitalOcean | While the account exists |
| Sessions: a session token, when it expires, the IP address and user agent it was created from | Keeping you signed in, and spotting a session that is not yours | Contract, legitimate interest | DigitalOcean | Until it expires or you sign out; an expired session stops working at once and is cleared away afterwards |
| Your confirmation at sign-up that you are a parent or guardian aged 18 or over, and when you gave it | Showing that the account is held by an adult | Contract, legal obligation | DigitalOcean | While the account exists |
| Sign-up, last sign-in and last change dates | Support, and finding dormant accounts | Legitimate interest | DigitalOcean | While the account exists |
| One-time tokens for verifying an email, resetting a password or confirming a deletion | Making those links work once and then not again | Contract | DigitalOcean, Resend | Until they expire; an expired token stops working at once and is cleared away afterwards |
| App settings: trace opacity, screen-awake, haptics, left-handed controls, usage sharing, search history, the two notification switches and whether we have asked you about them once | Making the app behave the way you set it | Contract | DigitalOcean | While the account exists |
| Pro entitlement: whether it is active, where it came from, when it runs to, and the store’s transaction reference | Giving you what you paid for | Contract | DigitalOcean, Apple, Google | While the account exists |
A guest session carries no email address you gave us — only an anonymous identifier, an internal placeholder address that reaches nobody, and the settings on it.
Section 4. Your pictures
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| A saved picture: the image file and a thumbnail | So My Images works, and works offline | Contract | DigitalOcean | Until you delete it, or delete the account |
| Where it came from: source, licence, creator, the original page, and the search that found it | Crediting the maker and letting you open the original | Contract | DigitalOcean | With the picture |
| Whether you marked it a favourite, and when you last used it | Sorting your library | Contract | DigitalOcean | With the picture |
| How you placed a picture to draw or trace: position, scale, rotation, mirroring, opacity, lock | Picking up where you left off | Contract | DigitalOcean | With the picture |
| A collection, if you group pictures into one | Keeping your library tidy | Contract | DigitalOcean | Until you delete it, or delete the account |
Pictures from Unsplash are the exception: Unsplash asks that its photographs are shown from Unsplash, so saving one keeps a link to the original rather than a stored copy. That means a saved Unsplash picture is loaded from Unsplash’s servers every time you open it, for as long as you keep it, and saving one makes our server tell Unsplash that the picture was downloaded — which its API terms require. Everything else you save is fetched once by our server, converted, and stored with its attribution.
Section 5. Searching
This is what happens to a search, in order.
- The app sends the words you typed to our server.
- Our server checks them against a blocked-word list. A blocked search is refused there and then — no source is asked, and nothing leaves our server.
- Otherwise the words are sent to each image source that is switched on and that you have selected in the Sources picker. Safe Search is enforced on every source that offers it — Pixabay, Openverse, Unsplash and Google Images. The rest are curated collections — museum, nature and space archives, an icon set, and a moderated stock-photo library — chosen because their catalogues are suitable to begin with.
- The results are merged, cached for about a day, and sent back to you.
- Your phone then loads the pictures themselves.
Our server sends the source the search term and nothing else — no email address, no display name and no account identifier. The keys for the sources never leave our server, so a source does not learn which of our users asked.
The pictures themselves are loaded by your phone directly from the source, so its servers see your device’s IP address and browser details, as any website you open does. A saved Unsplash picture is shown from Unsplash every time, so that continues for as long as you keep it.
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| Your search history: the words, and how many results came back | Making the app behave the way you set it — showing what you searched for recently | Contract | DigitalOcean | While search history is on; switching it off clears it, and deleting the account removes it |
| Cached results for a search term | Not asking a source the same question all day | Legitimate interest | DigitalOcean | About a day, then it expires |
| A service log of each request our server made to a source: which source, the search term, whether it answered, how long it took, and the account it was for | Finding a source that has broken, and investigating abuse | Legitimate interest | DigitalOcean | Kept as statistics; deleting the account blanks the account identifier and the search text on the row |
The sources themselves are listed on the image sources page, which also explains Safe Search and the Sources picker. Each source is a separate company with its own privacy policy — not a processor acting for us — and each is contacted only while it is switched on.
Section 6. Create with AI
Create with AI sends work to an image-generation provider — OpenAI or Google — and shows you what comes back. This is the part of Sketch Anything where data leaves our systems on purpose, so here is exactly what goes.
From a description. Your words are put into a fixed template for the style you picked, which asks for something plain, friendly and suitable for young children. The provider receives that finished sentence. It does not receive your email address, your name, your account identifier or anything about your device.
From a photo. The photo is read on our server, turned to face the right way up, resized to fit within 1024 pixels and re-encoded as a JPEG. Re-encoding drops the whole EXIF block, so the GPS tag a camera-roll photo may carry does not travel with it. The provider receives that JPEG and a fixed instruction for the style — the photo carries the subject, so this path sends none of your words at all.
The photo is never stored by us. It exists in memory for the length of the request. It is not written to our database, not written to our file storage, and not written to a log — not even the error log, which describes the failure rather than the photo.
What the providers do with it. OpenAI and Google process what we send under their own API terms, on their own systems, in the United States. We do not control those systems and we will not paraphrase somebody else’s policy here: treat anything you send to Create with AI as leaving our service. We do not give either provider permission to use your content on our behalf, and we do not train any model ourselves.
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| The photo you sent | Making the picture you asked for | Contract | OpenAI or Google | Not stored by us at all |
| The picture that came back, plus a thumbnail | Showing it to you, and keeping it if you save it | Contract | DigitalOcean | Removed after 7 days if you do not save it; otherwise until you delete it or delete the account |
| The prompt and style behind it, and which provider and model made it | Showing the picture’s history, and diagnosing a bad result | Contract, legitimate interest | DigitalOcean | With the picture |
| How many pictures you made today | Enforcing the daily allowance | Contract | DigitalOcean | With the pictures |
The seven-day clean-up runs as new pictures are made. If an account stops using Create with AI, the last few unsaved files on it can outlive the seven days until the clean-up next runs, and you can ask us to remove them sooner.
Create with AI needs an account and an active Pro entitlement, so it is never used by a guest.
Section 7. How the app is used, and crashes
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| Usage events: an event from a fixed list of names, with the app version, the platform, a session identifier and the account | Knowing which features are used and which fail | Consent, given by the usage-sharing switch | DigitalOcean | No fixed period; deleted with the account |
| Crash reports: the error, the app version, the device model and operating system, and a trail of the recent steps and requests before the crash | Finding and fixing crashes | Consent, given by the usage-sharing switch | Sentry | Under Sentry’s retention for our project |
The event names are a fixed allowlist in our code — screens opened, a search submitted, a picture saved, a mode entered, a generation started or failed, a crash. A search term is never sent with a usage event. Turn usage sharing off in Profile and no usage event is recorded for your account: the app stops sending them and our server stops keeping them.
A crash report’s trail can include the address of the screen you were on, and the address of the search screen carries the words you searched for.
Crash reports and the usage switch. Crash reports follow the same switch: with usage sharing off, the app sends none.
Section 8. Notifications
Sketch Anything can send push notifications to your phone, and it sends none until you turn them on. Profile carries two switches and both start off:
- Account messages — about your account, your purchases and the pictures you make.
- Tips and news — ideas to draw and occasional news about the app.
The phone’s own permission prompt is asked only after you have chosen. Nothing is sent to a device whose operating system has not granted that permission, and nothing is sent in a category whose switch is off — that check runs on our servers, not only in the app.
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| A device’s notification token, the platform, the app version, and the language and time zone the device reports | Sending a notification to that device, in its language | Consent, given by the notification switches | DigitalOcean, Google (Firebase Cloud Messaging) | While the device is registered; a token Firebase reports as dead is deleted 30 days later, and every token goes with the account |
| Whether the device’s operating system has granted permission to show notifications | Never sending to a device that would not show it | Consent, given by the notification switches | DigitalOcean | With the token |
| A delivery record: which notification we sent you and when, whether it was accepted for delivery, and whether you opened it | Knowing a message went out, and holding us to the daily limit per person | Consent, given by the notification switches | DigitalOcean | 180 days; deleting the account unlinks the record from you and leaves the counts |
Nothing you search for is ever in a notification. A notification carries a title, a line of text and a link to a screen in the app — never your email address, never your searches, and never a picture other than one we chose to put in it.
What is sent automatically. Three things, and nothing else sends by itself:
| Message | When it goes | What it carries |
|---|---|---|
| Your picture is done | A Create with AI picture finished while the app was not on screen — never while you are watching it | “Your picture is ready” and a link to the Create screen |
| Subscription events | Pro is activated, a renewal fails, or it is about to end or has ended | The plan name, how many days are left where that applies, and a link to Profile or the subscription screen |
| Tips and news | An occasional idea, and a nudge if you have not opened the app for about two weeks | The words we wrote and a link to a screen in the app |
The nudge is the only message we send for no reason but to invite you back. It goes to nobody whose Tips and news switch is off, and to the same person at most once a month.
Who it goes through. Google’s Firebase Cloud Messaging delivers our notifications, and hands each one to Apple’s or Google’s notification service on your device — the only route a phone has for receiving one. Firebase is given the device token and the message, and nothing else about you.
Deleting your account deletes its device tokens, so nothing can be sent to them again, and leaves the delivery records with no link to you.
Section 9. Writing to us, and the waitlist
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| Contact form: your name, email address, topic and message | Answering you | Contract, legitimate interest | DigitalOcean, Resend | While we need it to answer you and to keep a record of abuse; no fixed period |
| Contact form: the IP address and browser user agent of the request | The form needs no sign-in, so this is the only trace of who sent a message | Legitimate interest | DigitalOcean | With the message |
| Waitlist: your email address, which phone you have, and the page you signed up from | Telling you when the app opens | Consent | DigitalOcean | Until the app opens, or until you ask us to remove yours |
| A content report: what you reported, why, and the account that sent it | Reviewing a picture that should not be there | Legitimate interest | DigitalOcean | No fixed period; the link to your account is removed when the account is deleted |
Both forms carry a hidden field that only an automated script would fill in. A submission that fills it is dropped and never stored.
Section 10. Service and security records
| What we hold | Why | Lawful basis | Who processes it | Kept for |
|---|---|---|---|---|
| Provider request logs — the row described in Section 5 | Diagnosing failures and investigating abuse | Legitimate interest | DigitalOcean | Kept as statistics, with the account identifier and the search text blanked when the account is deleted |
| Admin audit log: which administrator did what, when, from which IP address and browser | Accountability for anything an administrator changes | Legitimate interest | DigitalOcean | No fixed period |
| Server logs kept by our host while the service runs | Keeping the service up | Legitimate interest | DigitalOcean | Under DigitalOcean’s platform retention |
The audit log records our administrators’ actions, not yours.
Section 11. Who processes your data, and where
| Provider | What it gets | Where | On what footing |
|---|---|---|---|
| DigitalOcean | Hosting, the database and the file storage — so, everything in the tables above | United States | Processor for us, on the transfer mechanism described below |
| Cloudflare | DNS for our domains, and delivery of this website | Global network | Processor for us, on the same basis |
| Resend | Account email and contact-form notifications: the recipient address and the message | United States | Processor for us, on the same basis |
| Sentry | Crash reports from the app | United States | Processor for us, on the same basis |
| Google (Firebase Cloud Messaging) | A device token and the notification to deliver, once you have switched notifications on | United States | Processor for us, on the same basis |
| Apple, Google — device notifications | Each notification, through the notification service built into your phone — the only route a device has | Varies | Independent providers under their own terms |
| OpenAI, Google | A prompt, or a photo, for Create with AI | United States | Independent providers under their own API terms |
| Image sources | The search term from our server; and, when your phone loads a picture, its IP address and browser details | Varies | Independent providers under their own terms |
| Unsplash | All of the above, plus a notice from our server that a picture was downloaded when you save one | Varies | Independent provider; the notice is required by its API terms |
| Apple, Google | The store purchase, once Pro is on sale — they tell us an account is entitled, and never show us your card | Varies | Independent providers under their own terms |
Our database and our file storage sit in DigitalOcean’s New York region. Traffic between the app and our servers travels over HTTPS. DigitalOcean states that its managed databases and its object storage are encrypted at rest.
Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on the transfer mechanisms the law provides: an adequacy decision where one applies, and otherwise the safeguards our providers offer — typically the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum and the Swiss amendments where those apply.
Section 12. What we never do
- No advertising. There are no ads in the app, none on this website, and no advertising technology anywhere in either.
- No sale of personal information, for money or for anything else of value.
- No sharing for cross-context behavioural advertising. Nothing you do in Sketch Anything is used to target you anywhere else.
- No profiling. We do not build a profile of anybody, and we do not profile children at all.
- No automated decisions that have a legal effect on you, or anything similarly significant.
- No training of AI models by us on your content — not your pictures, not your photos, not your prompts, not your searches.
- No selling or disclosing a child’s information, and nothing in the app lets a child make information about themselves public.
- No tracking on this website. No cookies, no analytics, no third-party scripts, and the typeface is served from this site rather than from a font service.
- No notification you did not ask for. Both switches start off, nothing goes to a device that has not granted permission, and no notification carries an advertisement.
- No special-category data. We do not ask for it and we have nowhere to put it.
Section 13. Deleting it
Tap Delete Account in Profile. We email a confirmation link and nothing is removed until somebody opens it — until then the account is still yours. Opening it deletes your profile, your settings, your saved pictures and the files behind them, the pictures Create with AI made for you and their files, your search history, your drawing preferences, your collections, your devices’ notification tokens and your usage events, and it unlinks any content report you sent, and every notification we sent you, from your account.
A guest session has no confirmable email address, so Delete Guest Data removes it straight away, on the same terms.
The provider request logs in Sections 5 and 10 stay, as statistics: deleting the account blanks the account identifier and the search text on them, leaving only which source was asked, whether it answered and how long it took. The admin audit log in Section 10 also stays — it records our administrators’ actions, not yours.
You can also ask us to delete something without deleting the account. Write to the privacy address in Section 14; Section 16 of the privacy policy explains how a request is handled and how we check it is really you.
Section 14. Questions
Implicit Labs, Inc.[email protected]The privacy policy has the rights you can exercise and who to complain to. The terms and conditions are the agreement this policy sits inside. The kids safety page is written for the adult who set the app up.