Privacy Policy

Color It Up is operated by Helix Media LLC, San Antonio, Texas, United States. In this policy, “we,” “us,” and “our” mean Helix Media LLC. We are the only company that collects personal information from children through Color It Up. The service providers in section 7 handle information for us, under our instructions. When you pay, Stripe collects your card details on its own checkout page, under its own privacy policy.

• Privacy questions, requests about a child’s information, and deletion requests: privacy@color-it-up.com
• Help with the app, billing, or your account: support@color-it-up.com

This policy covers the Color It Up website and app at color-it-up.com.

• Accounts are for adults. Everyone who creates an account confirms they are at least 18. The adult who owns the account is responsible for everything done in it, including a child’s use.
• Children don’t get their own accounts, email addresses, or profiles. A child uses Color It Up through a parent’s account, in Kids Studio.
• If we learn that someone under 18 created an account, we will close it and delete its information.

• Account details: your email address, display name, and password (stored by our sign-in provider as a one-way hash that we can’t read), or the details Google or Apple send when you sign in with them. With Apple you can hide your email, and we then receive a private relay address that forwards our messages to you.
• Your choices and records: that you confirmed you are 18 or older; which versions of our Terms and this policy you accepted, and when; whether the account is mainly for you or your family; the family notices you reviewed; each child feature you turned on or off and each single creation you allowed; and how and when we confirmed you are a parent (the date and the method, and, while that confirmation lasts, a reference to the Stripe payment; never your card number).
• Family settings: your parent PIN, stored only as a salted cryptographic hash we can’t read; daily and monthly point limits for Kids Only Mode; and a record of each device locked to Kids Studio, the sign-in sessions it was used in (so the lock holds even if its cookie is deleted), and when it was unlocked.
• Purchases and points: your plan, membership status and renewal date, points balance and history, and the Stripe identifiers for your customer record, payments, refunds, and chargebacks. Stripe collects card details directly; we never receive full card numbers.
• What you create: ideas and words you type, sketches, photos you upload, images you give Quick Create in Adult Studio, the pages and colored and 3D versions we make, your coloring and paintings, titles, and changes you ask for.
• Community submissions: artwork, titles, and captions you choose to submit for public sharing (Adult Studio only).
• Messages to us: what you send when you email us.
• Technical information: IP address, browser and device type, the cookies in section 10, security and error logs, and anonymous studio performance reports (browser family, whether the screen is touch, and how long saves and brush strokes take, with no account or artwork attached).

When a child uses Kids Studio on a parent’s account, we collect only what the feature in use needs:

• Coloring: the pages a child colors, with their paintings and layers, saved to the parent’s account so they appear on the family’s devices.
• Photo uploads (only if a parent turns them on): a photo chosen on the device or taken with its camera.
• AI sketches (only if a parent turns them on): a drawing and an optional description the child types.
• Magic Words (only if a parent turns them on): the words a child types to describe a page.
• Changes to a new page: words a child types to ask for a change before keeping a page made from a photo or drawing (only when that feature is on).
• 3D Magic (only if a parent turns it on): the colored page the child wants to turn into a 3D-style picture.
• What we make from it: the coloring page, its colored and 3D versions, and a title, which can include some of the words the child typed. (Some older pages have a title taken from a photo’s file name.)
• Device information: the parent account’s sign-in session, the IP address, and the Kids Only Mode cookies in section 10.

We use that device information only to support the internal operations of the service: to keep the parent’s account signed in, apply the device lock and point limits, limit how often requests can be made, and keep the service secure and working. We never use it for advertising, to build a profile of the child, or to contact the child.

We don’t ask a child for a name, email address, phone number, home address, school, location, or payment details, and Color It Up doesn’t use the microphone or location. There is no chat, messaging, public profile, or community for children, and Kids Studio pages can’t be posted to the Color It Up community. A photo can still show a face or other details that identify a person, and a drawing or typed words can include a name, so please help your child choose what to share. A child never has to give more information than a feature needs to work.

• to run and secure your account and keep you signed in;
• to make, save, sync, show, download, and restore your pages and paintings;
• to apply Family Controls, Kids Only Mode, point limits, and child-feature permissions;
• to confirm that the account holder is a parent before child AI features are turned on;
• to process purchases, memberships, points, refunds, and chargebacks;
• to review community submissions and prevent abuse, fraud, and unlawful content;
• to answer support and privacy requests and send account, security, and billing messages; and
• to fix problems, keep the service reliable, and comply with the law.

We use a child’s information only to provide the feature the child is using and to keep the service working and safe. We never use it for advertising, to build a profile of the child, or to train AI models, and we don’t sell or rent it.

We send only service emails, such as sign-in links, password resets, and Kids Only Mode unlock requests. If we ever send marketing email, we will ask first or give you a way to unsubscribe, as the law requires.

Color It Up uses OpenAI’s API to make pages. Depending on the feature, we send OpenAI the photo, drawing, description, typed words, or change request, or the page being colored or turned into 3D (for 3D, with the page’s title, which can include some of the child’s words). Photos and drawings are sent under a generic file name, never the name the file had on your device. To suggest a title, we may also send the finished page with the words typed for it (or just “an uploaded picture” or “a drawing”) and part of the instructions we wrote from them. In Adult Studio, Quick Create sends your idea and a small copy of your image to suggest settings.

OpenAI handles this as our service provider. Under OpenAI’s API terms it does not use what we send, or what it returns, to train its models, and we have not opted in to sharing data for training. OpenAI may keep API requests and results for up to 30 days to detect and investigate abuse, then deletes them unless the law requires it to keep them longer. Title suggestions and Quick Create requests are sent with OpenAI’s optional request storage turned off.

The page OpenAI returns is traced into clean vector lines by our own vectorization service, which runs on Fly.io. The app sends it only the finished line-art image, under a generic file name. It never sends the original photo or drawing, or any title or words.

Only upload photos you have the right to share. Don’t upload a photo of someone else’s child unless you are that child’s parent or guardian or have their permission.

Each provider may use the information only to provide its service to us and must protect it under its terms with us. Children’s information goes only to the providers that run the features a parent turned on (OpenAI and our vectorization service on Fly.io) and the ones that host and store the service (Supabase, Vercel, and Cloudflare). We don’t give children’s information to anyone else for their own purposes, so a parent can agree to a feature without agreeing to any other sharing.

We may also disclose information if the law requires it, to protect someone’s safety, to investigate fraud or abuse, to enforce our Terms, or as part of a merger, acquisition, or sale of the business, in which case this policy keeps applying to information already collected unless you are told of a change and, where the law requires, agree to it. We report apparent child sexual abuse material to the authorities as the law requires.

A small number of authorized Helix Media LLC staff can see account details and saved projects through a protected admin console, with multi-factor sign-in, to give support, review community submissions, and investigate abuse.

This section is our notice to parents under the Children’s Online Privacy Protection Act (COPPA) about information collected from children under 13. It applies to older children too.

Kids Studio and Kids Only Mode

Kids Studio is the simpler studio made for children, and adults can use it themselves. Before handing a device to a child, a parent turns on Family Controls, which sets a parent PIN, and locks that device to Kids Studio. That lock is Kids Only Mode.

• Kids Only Mode applies to one device at a time, and each browser or app on a device counts separately: locking the Color It Up app on a tablet doesn’t lock a web browser on the same tablet. Lock every browser or app a child can open, or sign out of the others. Locking or unlocking a phone doesn’t change a tablet. While any device is locked, a new sign-in to the account (a private window, another browser or app, or signing in again after clearing site data) also starts in Kids Only Mode. It stays locked even after that device is unlocked, until a parent unlocks it there, with the PIN or an emailed unlock, or turns Kids Only Mode off on every device; browsers and apps that were already signed in aren’t affected. Account & Family → Studios & family shows how many devices are locked, and can turn Kids Only Mode off on every device at once with the PIN.
• On a locked device, Adult Studio, purchases, sharing, account settings, and leaving Kids Studio need the parent PIN.
• A locked device can also ask to be unlocked by email. We send a link to the account’s email address, and the device unlocks only after the parent opens the link and confirms. Opening the link alone changes nothing.
• Accounts locked under the earlier account-wide setting stay locked on every device until a parent unlocks each one or turns Kids Only Mode off on every device.
• On a device that isn’t locked, Kids Studio counts as the adult’s own use, and the child protections below don’t apply. Lock the device before a child uses it.

Features that send a child’s content to AI, and parental consent

In Kids Only Mode, photo uploads, AI sketches, Magic Words, and 3D Magic start turned off. Each one sends what the child provides to OpenAI (section 6). A parent turns each one on separately in Account & Family → Studios & family after reading what it collects and shares, or can allow a single creation with the PIN.

Before any of these can be turned on, or a single creation allowed, we confirm that the account holder is a parent with a card transaction, one of the methods COPPA allows:

• a points pack or paid membership payment already made by card on the account, as long as it hasn’t been refunded or charged back; or
• a $0.50 card check through Stripe that we refund right away. It adds no points and starts no membership, and Stripe emails a receipt for it to the account’s email address.

We keep the date and the method as the record of consent, and a reference to the Stripe payment while the verification lasts. If the payment that verified you is later charged back, or, for a points pack or membership payment, refunded (even in part), the verification ends: every child feature is turned off on every device until a parent verifies again, and a chargeback later decided in our favor doesn’t restore it. Our own refund of the $0.50 card check never ends it. On accounts we had not yet verified, child features that were on have been turned off until a parent completes the check. A parent’s consent to a feature covers our collection and use described here and sharing with the service providers that run it.

A parent’s rights, and how to use them

The parent who owns the account can, at any time:

• Review what we hold about their child. A child’s pages and paintings are in My Book. Email privacy@color-it-up.com for a copy of everything we keep for the account, including permission and consent records. Once a page is kept, we normally hold only a fingerprint of the original photo or drawing, not the picture itself, so we can’t return it. Some pages saved before October 5, 2026 can still include the original picture, and so can their backups (section 11); if so, we include it in your copy and delete it when you ask.
• Delete it. Delete pages in the app (a page still waiting on Home must be kept first, then deleted from My Book). A deleted page is removed for good after 30 days, but a deleted painting’s stored files and backups stay until the account is deleted unless you email us. You can also delete the whole account in Account & Family → Profile & security (this happens immediately), or email privacy@color-it-up.com and we will delete what you ask, including those painting files, within 30 days.
• Stop further collection and use. Turn off each child feature in Account & Family → Studios & family and keep the child’s device locked, so the child can still color but can’t send new photos, drawings, or words to our AI provider. You can also delete pages or the account, or email us. Turning a feature off doesn’t delete what was already made; delete pages or the account for that.

Don’t turn off Family Controls to stop collection: that removes the parent PIN and ends Kids Only Mode on every device, so a child’s device would no longer be locked to Kids Studio.

Before acting on an emailed request, we confirm it comes from the account holder, for example by replying to the account’s email address. We never make a child’s use of a feature depend on giving more information than the feature needs.

Projects are private by default. When an adult intentionally submits an Adult Studio project, its artwork, title, and caption may become public after moderation, where others can view, copy, or reshare it. Kids Studio projects can’t be submitted, even by an adult.

We may reject, hide, or remove submissions for safety, privacy, legal, or community reasons. Email privacy@color-it-up.com to have a submission removed. We stop showing it once the request is processed, though cached copies can take a little longer to clear.

We use only the cookies and device storage Color It Up needs to work. There are no advertising cookies, analytics cookies, or third-party trackers.

The Kids Only Mode cookie names start with __Host-, a browser setting that ties each one to color-it-up.com over a secure connection.

The app also keeps things in your browser’s storage on the device: your pages, drafts (which can include a photo or drawing you’re working on), offline copies, studio preferences, whether Kids Only Mode was last on for this account, and a small log of recent saves that stays on the device unless you choose to download it. Clearing this site’s data in your browser removes them.

We keep personal information only as long as we need it for the reason we collected it. Saved pages are your family’s library, so they stay until you delete them. Things we need only to make a page, such as the original photo or drawing, are deleted much sooner.

Deleting your account. Account & Family → Profile & security → Delete account works immediately: we cancel any membership right away, delete the account’s pages, paintings, files, and backups, and then delete the account and the records linked to it in our database, except the records the table above says are kept after deletion. If you ask us by email instead, we will do the same within 30 days of confirming the request is yours.

We protect information with encrypted connections, private storage that only the account can reach, database rules that keep each account’s records separate, salted one-way hashes for parent PINs, signed device cookies, multi-factor sign-in for staff, and access limited to the staff who need it. We send each service provider only what its job needs. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Every account holder can ask to see, get a copy of, correct, or delete their personal information, and can withdraw a consent they gave. Much of this works in the app: edit your profile, manage pages, turn child features off, cancel a membership, or delete the account. For anything else, email privacy@color-it-up.com.

Some US states, including California, Colorado, Connecticut, Texas, and Virginia, give residents these rights by law. We don’t sell personal information, share it for targeted advertising, or use it for profiling that has legal or similarly significant effects, so there is nothing to opt out of. You may use an authorized agent; we will ask the agent for proof of authority and may confirm the request with you. If we turn down a request, you can appeal by replying to our answer, and we will explain the outcome. We will not treat you differently for using these rights.

Color It Up is offered in the United States and its information is handled in the United States. If you use it from elsewhere, such as the European Economic Area or the United Kingdom, you have similar rights under your local law, including to object and to complain to your data protection authority. We process information to provide the service you asked for, with your consent (which you can withdraw), for our legitimate interests in keeping the service secure and working, and to meet legal duties.

We answer requests within 30 days. If the law allows more time and we need it, we will tell you why.

When we change this policy in a way that matters, we update the effective date above and ask every account holder to review and accept the new version in the app before continuing. If a change affects how we collect or share children’s information, we will ask parents for consent again before applying it.

Questions? Email privacy@color-it-up.com.