Privacy Policy

Section 1. Who we are

Implicit Labs, Inc. makes Sketch Anything and decides what happens to the personal information described here. In European and United Kingdom terms, we are the controller of that information.

Write to us about anything on this page:

Implicit Labs, Inc.[email protected]

We have not appointed a data protection officer, and we have not appointed a representative in the European Union or the United Kingdom. The address above reaches the people who handle these requests.

Section 2. What this policy covers

This policy covers the Sketch Anything mobile app, this website, and the servers behind them. The data use policy is its companion: same facts, laid out category by category, with retention and processors in one table. The terms and conditions are the agreement this policy sits inside.

Two things are worth saying before the detail:

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising in Sketch Anything at all.
• We do not use your pictures, your photos, your prompts or your searches to train AI models.

Section 3. Accounts are held by adults

An account holder is a parent or guardian, 18 or older. Signing up asks for that confirmation, and we record it. Children use the app under that adult’s account or as a guest, and with their supervision. Section 14 sets out what that means for children’s information, and what a parent can ask us to do.

Section 4. What we collect

The categories below use the language of the California Consumer Privacy Act, so that one table answers a Californian’s question and everybody else’s. A guest session carries no email address you gave us — only an anonymous identifier and an internal placeholder address that reaches nobody.

We do not collect: precise location, contacts, health information, racial or ethnic origin, religious belief, political opinion, trade union membership, sex life or sexual orientation, genetic or biometric data, government identifiers, financial account numbers, or anything else the law treats as a special category. We do not build profiles of people, and we make no automated decision that has a legal effect on you or anything similar.

Payment card details never reach us. If you buy Pro, the App Store or Google Play takes the money and tells us only that an account is entitled to it.

Section 5. Why we use it

We never use personal information for advertising, and there is no purpose on this list that involves selling it.

Section 6. The camera

Trace Mode shows a live camera preview so you can line a picture up with your paper. The preview is processed on your device. Nothing from the Trace Mode camera view is recorded, stored or sent — there is no photograph of the room, the child or the page anywhere, including with us.

The camera is used one other way: if you choose to take a photo for Create with AI, that photo is handled as Section 7 describes.

Section 7. Photos you send to Create with AI

A photo you hand to Create with AI is resized on our server, sent once to the image-generation provider, and then dropped. We do not write it to our database, to our file storage, or to a log. Re-encoding it also strips the EXIF block, so the GPS tag a camera-roll photo may carry does not travel with it.

The picture that comes back is stored so the app can show it to you. If you do not save it, it is removed after seven days. That clean-up runs as new pictures are created, so an unsaved picture can stay somewhat longer if the account stops using Create with AI; ask us and we will remove it sooner.

What the providers do with a photo under their own API terms is set out in the data use policy.

Section 8. Searching

The app asks our server and our server asks the image sources. A search term that matches our blocked-word list is turned away before any source is asked.

Our server sends the source the search term and nothing else — no email address, no display name and no account identifier. The pictures themselves are loaded by your phone directly from the source, so its servers see your device’s IP address and browser details, as any website you open does. A saved Unsplash picture is shown from Unsplash every time, so that continues for as long as you keep it.

While search history is on, your searches are kept with your account so the app can show you what you searched for recently. Turn it off in Profile and the searches already recorded are cleared and no new ones are kept. Deleting your account removes them too.

Our server also keeps a service log of each request it made to a source — which source, whether it answered, how long it took — so we can find a source that has broken. Deleting your account blanks the account identifier and the search text on those rows, leaving only the counts.

Usage events do not carry search terms. The keys for the sources never leave our server, and results are cached for about a day so the same search does not keep hitting the sources.

Section 9. Usage data, crash reports and notifications

Usage events. While usage sharing is on, we record which screens and features are used — a fixed list of event names, with the app version, the platform and a session identifier. Search terms are never sent with them. Turn usage sharing off in Profile and nothing more is recorded for your account: the app stops sending events, and our server stops keeping them.

Crash reports. If the app crashes, it can send a report to Sentry, our crash-reporting provider. A crash report describes the error and the state of the app around it: the app version, the device model and operating system, and a trail of the recent steps and requests that led to the crash. That trail can include the address of the screen you were on, and the address of the search screen carries the words you searched for.

Crash reports and the usage switch. Crash reports follow the same switch: with usage sharing off, the app sends none.

Notifications are off until you turn them on. Profile has two switches — Account messages, about your account, your purchases and the pictures you make, and Tips and news, ideas to draw and occasional news about the app. Both start off. The phone’s own permission prompt is asked only after you have chosen, and we send nothing to a device whose operating system has not granted that permission. Turning a switch off stops that kind of message on our servers, not only in the app.

What we hold to send one. The notification token your device gets from Firebase, the platform, the app version, and the language and time zone the device reports; and a record of which notifications we sent you and whether you opened them. A notification carries the words we wrote and a link to a screen in the app. Nothing you search for is ever in a notification, and neither is your email address.

Who it goes through. Google’s Firebase Cloud Messaging delivers our notifications, and it hands each one to Apple’s or Google’s notification service on your device — that is how a phone receives a notification at all. Nobody else is involved, and a notification is never an advertisement for anyone.

A nudge if you have been away. If you have not opened the app for a while, we may send one “Tips and news” message inviting you back, and not often. It stops the moment that switch is off.

How long. A token that Firebase tells us is dead is deleted 30 days later. The record of a notification is deleted after 180 days. Deleting your account deletes its tokens, and the delivery records lose the link to you.

Children. Nothing is sent to a child’s device unless the adult who holds the account turned a switch on.

Section 10. This website

This site is a set of static pages. It carries no cookies, no analytics, no advertising and no third-party scripts. The typeface is served from this site, not from a font service, so loading a page tells nobody but our host that you were here.

Two forms send us something:

• The contact form sends your name, email address, topic and message. The IP address and browser user agent of the request are stored with it, because an unauthenticated form is the one place where they are the only trace of who sent a message, and we need that to deal with abuse.
• The waitlist form sends your email address, which phone you have, and which page you signed up from.

Both are used to answer you or to tell you when the app opens, and for nothing else. There is a hidden field on each form that only an automated script would fill in; a submission that fills it is dropped.

Section 11. Who else sees it

We do not sell personal information and we do not share it for advertising. A small number of service providers process parts of the job on our instructions, each seeing only what its job needs:

A source is contacted only while it is switched on in our settings, and only if you have it selected in the Sources picker.

Firebase is contacted only once you have turned a notification switch on, and it is given the device token and the message — never your email address, your name or anything you searched for. Apple and Google also receive each notification through the notification service built into your phone, which is the only way a device can be sent one; they act there under their own terms rather than as our processors.

The image sources are not our processors — each is an independent company handling data under its own privacy policy. Two things reach them. Our server sends the search term, with nothing about you attached. Your phone then loads the thumbnails and the full pictures straight from the source, so its servers see your device’s IP address and browser details, exactly as they would if you opened that website yourself. A saved Unsplash picture is shown from Unsplash every time, so that carries on for as long as you keep it, and saving one makes our server tell Unsplash that the picture was downloaded, which Unsplash’s API terms require.

We also disclose information where the law requires it, where we have to in order to establish or defend a legal claim, or to protect someone’s safety. If our business is ever sold or merged, the information moves with it and this policy continues to apply until we tell you otherwise.

Section 12. Where your information is held, and transfers

Our servers, our database and our file storage are in the United States. If you are in the European Economic Area, the United Kingdom, Switzerland or another country with transfer rules, using Sketch Anything means your information is transferred to the United States and to the providers listed above.

Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on the transfer mechanisms the law provides: an adequacy decision where one applies, and otherwise the safeguards our providers offer — typically the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum for the United Kingdom and the Swiss amendments recognised by the Federal Data Protection and Information Commissioner. Ask us at the privacy address in Section 1 and we will tell you which one applies to a particular provider.

Section 13. How long we keep things

The short version: your account data lives as long as your account does. The data use policy has the full table, category by category. In outline:

• Your profile, settings, saved pictures, search history and drawing preferences stay while your account exists, and go when you delete it — including the picture files behind them.
• A picture Create with AI made for you and that you did not save is removed after seven days, with the caveat in Section 7.
• A photo you sent to Create with AI is never stored at all.
• Contact messages are kept while we need them to answer you and to keep a record of abuse. Waitlist addresses are kept until the app opens or until you ask us to remove yours.
• Cached search results expire after about a day.
• A device’s notification token is kept while the device is registered; one Firebase reports as dead is deleted 30 days later. The record of a notification we sent you is deleted after 180 days. Deleting your account deletes its tokens and unlinks those records from it.
• Service logs of the requests our server made to the sources are kept as statistics. Deleting your account blanks the account identifier and the search text on them.

Where a category has no fixed period, we keep it until your account is deleted or you ask us to delete it.

Section 14. Children

Sketch Anything is a drawing app for families. The account holder is a parent or guardian, 18 or older. Children use the app under that adult’s account or as a guest.

We do not knowingly collect personal information from a child under 13 — or under 16, where that is the age a child can consent for themselves under European or United Kingdom rules. The app never asks a child for their name, their age, their address, their photograph or anything else about them. There are no public profiles, no usernames to find, no comments and no messaging, so there is nothing a child can publish and nobody in the app for a child to talk to. There is no advertising, and we build no profile of anybody, child or adult.

What a parent should know, in the terms the Children’s Online Privacy Protection Act expects:

• What is collected. Only what Section 4 lists, and it is collected from the account the parent set up: the email address the parent gave, the settings on that account, the searches run on it, the pictures saved to it, and usage events while usage sharing is on. If a child uses the app as a guest, the session carries no email address you gave us — only an anonymous identifier and an internal placeholder address that reaches nobody.
• How it is used. To run the app, as Section 5 sets out. Never for advertising, never for profiling, and never to train AI models.
• Notifications. Nothing is sent to a child’s device unless you, the account holder, turn a notification switch on in Profile. Both switches start off, the phone’s permission prompt is asked only after you have chosen, and turning a switch off stops those messages.
• Who it is disclosed to. Only the service providers in Section 11, each of which processes it on our instructions. We do not disclose it to anyone else, and we never let a child make information about themselves public through the app.
• A parent’s rights. As the account holder you can review what is held, have it corrected, delete any part of it or all of it, and refuse to let us collect any more — delete the account and collection stops. You can do all of it in the app, and you can ask us instead.
• How to reach us. Write to [email protected], or to the address in Section 1.

If we learn that we hold personal information from a child under 13 — or under 16 where that age applies — that a parent did not provide, we delete it. If you think that has happened, write to us at the privacy address in Section 1 and we will deal with it.

We do not claim any certification under a COPPA safe harbour programme, and we have not been audited by one. This section describes what the app does, which you can check against the kids safety page.

Section 15. What you can do in the app

• Delete individual pictures from My Images.
• Turn search history off in Profile. Switching it off clears the searches already recorded and stops new ones being kept.
• Turn usage sharing off in Profile. Nothing more is recorded for your account while it is off.
• Turn either notification switch off in Profile — they start off, and turning one off stops that kind of message being sent.
• Delete your whole account with Delete Account in Profile. We email you a confirmation link and nothing is removed until you open it. Opening it deletes your profile, your settings, your saved pictures and the files behind them, your search history, your drawing preferences, your device’s notification tokens and your usage events. A guest session has no confirmable email address, so Delete Guest Data removes it straight away.

Section 16. Your rights, and how to use them

Wherever you live, you can ask us to:

• tell you what we hold about you and give you a copy of it;
• correct anything that is wrong;
• delete it;
• stop using it for a particular purpose, or object to a use;
• hand it over in a portable form, or send it to another service where that is technically possible;
• withdraw consent you gave us, which does not undo what we did before you withdrew it.

Write to [email protected] from the address on the account, or use the contact form. We answer within 30 days, or sooner where the law requires it, and we will tell you if we need longer and why. We may need to check that the request really comes from you: usually by sending a confirmation to the account’s email address, and never by asking for more information than the check needs.

An authorised agent may make a request for you. Send us written permission signed by you, and we may still confirm the request with you directly.

Nothing changes for you because you asked. We do not deny service, change prices or degrade the app because somebody exercised a privacy right.

If we say no, we tell you why, and you may ask us to look again by replying to our answer. If you are still not satisfied, Sections 17 to 20 say who you can complain to.

Section 17. If you are in the United States

California. Under the California Consumer Privacy Act as amended, you have the right to know what we collect and why, to a copy of it, to have it corrected, to have it deleted, and not to be discriminated against for asking. Section 4 lists the categories we collect, Section 4 and Section 5 say where they come from and why, and Section 13 says how long we keep them. Section 11 says who receives them: our service providers, and the independent recipients — the image sources, whose servers your phone contacts directly when it loads a picture, the image-generation providers, and Apple’s and Google’s notification services, which carry a notification to your device.

• We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the past twelve months — and we do not do either of those things at all. There is nothing to opt out of, and no “Do Not Sell or Share My Personal Information” link, because there is no sale and no sharing.
• Sensitive personal information. The only category we hold is your account credentials — your email address with a hashed password — and we use it only to sign you in and keep the account secure. We do not use or disclose it to infer anything about you, so the right to limit its use does not arise. We never sell it.
• Minors. We do not sell or share the personal information of anyone under 16, because we do not sell or share anybody’s.
• Shine the Light. California Civil Code section 1798.83 lets California residents ask a business once a year for a list of the personal information it disclosed to third parties for their own direct marketing. We disclose nothing for that purpose, so the list is empty. Ask at [email protected] if you want that confirmed in writing.
• Do Not Track. California requires us to say how we respond to a browser’s Do Not Track signal. This website sets no cookies and runs no tracking of any kind, so there is nothing for the signal to switch off and we do not respond to it. We do not allow anybody else to track you across other websites from ours.

Other states. Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and the other states with a consumer privacy law give residents rights that are close to California’s: to confirm, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and profiling. We do not target advertising, sell personal information or profile anybody, so the opt-out rights have nothing to act on. The rest work exactly as Section 16 describes. Where a state gives you the right to appeal a refusal, reply to our answer and a different person will review it; if we still refuse, your state attorney general can hear a complaint.

Section 18. If you are in the European Union or the United Kingdom

Implicit Labs, Inc. is the controller. Section 5 gives the lawful basis for each purpose under Article 6 of the GDPR and the UK GDPR. We do not process special categories of personal data.

You have the rights in Section 16, and specifically: access, rectification, erasure, restriction of processing, portability, objection to processing based on our legitimate interests, and withdrawal of consent at any time. No decision is made about you by automated means that produces a legal effect or anything similarly significant.

Section 11 lists our processors, and the independent recipients alongside them: the image sources, whose servers your phone contacts directly when it loads a picture, the image-generation providers, and Apple’s and Google’s notification services, which carry a notification to your device. Section 12 explains the transfer mechanisms.

You can complain to a supervisory authority: in the European Union, the one where you live, work or where the problem happened; in the United Kingdom, the Information Commissioner’s Office at ico.org.uk. We would rather you told us first — [email protected] — but you do not have to.

Section 19. If you are in Canada

We handle personal information under the Personal Information Protection and Electronic Documents Act. We collect it with your knowledge and consent, for the purposes in Section 5 and no others, and we ask only for what those purposes need. You can withdraw consent, subject to what the law and the service require — withdrawing it may mean we can no longer keep your account.

You can ask for access to the personal information we hold about you and have it corrected, and you can challenge how we handle it by writing to [email protected]. If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Section 20. If you are in Australia

We handle personal information under the Australian Privacy Principles. You can ask for access to what we hold and ask us to correct it, as Section 16 describes.

Your personal information is disclosed to overseas recipients — the providers in Section 11, mainly in the United States — and we take reasonable steps to have them handle it consistently with the Australian Privacy Principles.

Complain to us first at [email protected]. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Section 21. How we protect it

Traffic between the app and our servers travels over HTTPS. Passwords are stored only as a hash, never as the password itself, and a password reset ends every existing session. The keys we hold for the image sources and the AI providers are encrypted with AES-256-GCM before they are written to the database, and the plaintext never leaves the one service that needs it. Our database and file storage are DigitalOcean managed services, which DigitalOcean states are encrypted at rest. Admin actions are recorded in an audit log.

No service is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you and the relevant authority as the law requires.

Section 22. Changes to this policy

We will update this page as the app changes, and the date at the top says when it last moved. If a change matters to you, we will say so in the app or by email rather than hope you notice here.

Section 23. Getting in touch

Implicit Labs, Inc.[email protected]

For anything that is not about privacy — support, a picture you want taken out of the app, a copyright notice — write to [email protected] or use the contact form.