Launching Summer 2026 on the App Store & Google Play
Privacy Policy · Effective

Your privacy at SpinCreatePlay

We built SpinCreatePlay for families to enjoy together, and we treat your data the way we'd want our own kids' data treated.

Video features are coming soon and are not yet available in the app. This policy also describes how we will handle video-related data when that feature launches.

1. Who we are

SpinCreatePlay ("the app", "we", "us") is a mobile application that lets users create AI illustrations and colour them in, with short videos planned (coming soon). This Privacy Policy describes what data the app collects, why, and what choices you have. If you have a question about anything below, email us at support@spincreateplay.com.

2. Information we collect

We collect only what's needed to make the app work. The full list:

  • Email address — used to sign in and to send password / PIN reset codes. If you sign in with Apple using "Hide my email", we only see Apple's private relay address.
  • Account password — stored as a one-way bcrypt hash. We never see your plain password.
  • Settings PIN — stored as a one-way bcrypt hash so the account holder can lock Settings and credit top-ups.
  • Firebase user ID — an opaque identifier that lets us link an authenticated session to your account.
  • Pictures, line-art colouring pages and videos you create (when video features are available) — stored on Cloudflare R2 (UK / EU region) and accessible only to your account.
  • Credit balance and purchase history — so we know how many AI generations you have left.
  • Device push notification token — issued by Firebase Cloud Messaging, used to let you know when a video is ready (when video generation is available).
  • Diagnostic information — crash logs and basic error reports (no personal content), used to fix bugs.

3. What we do not collect

  • We do not use third-party advertising or analytics SDKs in the mobile app.
  • We do not track you across other apps or websites and we do not request the App Tracking Transparency permission.
  • We do not use your generated pictures or colouring sessions to train AI models.
  • We do not read your existing photo library or device gallery. Saving a creation uses write-only access: on iPhone / iPad your device asks for "Add to Photos" permission the first time, and on Android we use the system's scoped storage so the picture is filed in your Gallery / Photos app without requesting broad storage access.

Our marketing website (spincreateplay.com) is separate from the app. Those pages use Plausible Analytics to measure traffic in aggregate. Plausible is cookieless, does not track you across other websites, and does not collect personal information — we only see anonymous stats such as page views and broad location.

4. How we use your data

  • Authentication. Email, password hash, PIN hash and Firebase UID let you sign in securely and recover access if you forget a password or PIN.
  • Generating content. The text prompt you build (icons + theme) is sent to Google's Gemini API to produce an image. When video generation launches, an image you choose may be sent to Google's Veo API to produce a short video. These prompts and pictures are not used to train Google's models when sent via the paid API.
  • Storing and showing your gallery. Generated pictures, line-art colouring pages, painted sessions, and videos (when available) are stored in Cloudflare R2 so you can come back to them across devices.
  • Purchasing credits. Purchases on iOS and Android go through Apple's and Google's in-app purchase systems respectively. We receive a transaction identifier from the store, verify it with the store's API, and add the matching credits to your account. We never see your card details. (On the web, payments go through Stripe; the same rule applies.)
  • Push notifications. Used only for events you triggered, e.g. "your video is ready" (when videos are available). You can turn them off in your device settings at any time.
  • Content moderation. If you tap "Report this picture" or "Report this video" (when available), we record the report so our moderation team can review and act on it within 24 hours.

5. Who we share data with

SpinCreatePlay only shares the minimum data needed to run these services. We do not sell, rent, or trade your information.

  • Google (Firebase Authentication, Cloud Messaging, Gemini API, Veo API) — to authenticate users, send push notifications, and generate images and, when video features launch, videos.
  • Cloudflare (R2 object storage) — to store your generated content.
  • Apple — Sign in with Apple, App Store In-App Purchase processing and receipt validation.
  • Google Play — Play Billing processing and purchase validation on Android.
  • Stripe (web only) — to process card payments when the app is used in a web browser.
  • Resend — to send verification and reset emails.
  • Railway — the cloud provider hosting our backend.
  • Plausible (website only) — cookieless analytics on our marketing site; no personal data is shared.

Each of these services has its own privacy policy. We choose providers that offer enterprise-grade data protection and don't mine the data they process on our behalf.

6. Children's privacy

SpinCreatePlay is suitable for general audiences (4+ rating) and designed with families in mind, but the app is not directed to children under 13. Account creation requires an email address; the account holder should be an adult who sets the Settings PIN and supervises use. We do not knowingly collect personal information from children under 13. If you believe your child has created an account without your consent, email support@spincreateplay.com and we will delete the account.

7. How long we keep your data

  • Account data, generated pictures, line-art pages, painted sessions and any videos (when present) are kept until you delete them or delete your account.
  • One-time email verification codes are kept for up to 24 hours.
  • Anonymous diagnostic logs are kept for up to 30 days.
  • Records of fraud or abuse, including content reports and the content they reference, may be retained longer where required by law.

8. Deleting your data

You can permanently delete your account and everything in it from inside the app: Settings → Delete account. Deletion removes your account row, gallery pictures, line-art pages, painted sessions, any video files (when present), push notification tokens and IAP records. The store keeps its own purchase record per Apple's and Google's policies; we cannot delete those.

If you can't sign in, email support@spincreateplay.com from the address linked to the account and we will verify and delete it within 30 days.

9. Security

Connections between the app and our servers use HTTPS. Passwords and PINs are hashed with bcrypt. Pictures and videos (when available) are served from R2 with non-guessable URLs. Backend services run behind firewalls and require service-account authentication. No system is perfect; if you believe you've found a security issue, please email security@spincreateplay.com.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, or to object to certain processing. To exercise any of these rights, contact support@spincreateplay.com. We will respond within 30 days and will not charge a fee unless your request is repetitive.

11. Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Effective" date at the top of this page and, for material changes, post a notice inside the app the next time you open it.

12. Contact

SpinCreatePlay
support@spincreateplay.com