IPHONE & IPAD

ScribbleJelly iOS Privacy Policy

Free sticker-making stays on the device. Optional AI stickers require a grown-up account and explicit consent before a drawing is sent for processing. ScribbleJelly has no advertising, tracking, public gallery, or child account.

Who operates ScribbleJelly

ScribbleJelly is operated by Anthony Fasano. Privacy or deletion questions can be sent to awfasano@gmail.com.

Free on-device stickers

Drawing strokes, placed stickers, colors, styles, magic words, and free local previews remain in the current app session. They are not uploaded for the free mode. A failed grown-up-challenge count and five-minute cooldown are stored locally to operate the safety gate. ScribbleJelly does not use the camera, microphone, location, contacts, photo-library reader, advertising identifiers, third-party analytics, or behavioral tracking.

Optional AI stickers

After the local grown-up gate, the adult sees a separate disclosure and uses Sign in with Apple. Only after the adult self-attests that they are the parent or guardian and explicitly consents does ScribbleJelly render the current drawing as a PNG and send it, plus the selected closed-list recipe, to ScribbleJelly's first-party service deployed on OpenAI Sites. The service sends the drawing to OpenAI's API for safety moderation and image editing, and separately moderates the returned images. The consent version and time are stored with the pseudonymous grown-up account, so the same notice is not shown for every sticker. A changed notice or consent revocation requires consent again. One server-owned credit is used only for a delivered set of three.

ScribbleJelly does not persist the uploaded drawing or generated image bytes in its application database or object storage. OpenAI may retain API inputs and outputs for up to 30 days in abuse-monitoring logs, and may retain them longer when required by law or necessary to prevent harm. OpenAI does not use API data to train its models by default unless the ScribbleJelly organization opts in. Images flagged for potential child sexual abuse material may be retained for manual review. Because the AI content may be retained beyond the real-time request, it is disclosed as Other User Content collected for App Functionality, linked to the pseudonymous grown-up account that authorized the request, and not used for tracking. A drawing can still contain personal information. Do not submit a child's name, face, school, address, phone number, or similar details.

Adult account, consent, and security records

Sign in with Apple supplies a stable account assertion. ScribbleJelly does not request the adult's name or email. The identity token is verified and not retained. The service stores a keyed pseudonymous account identifier, a random App Account Token, the consent version and time, hashed ScribbleJelly access and refresh credentials, and an encrypted Apple OAuth refresh token used only to validate or revoke the grown-up's Apple authorization. It also stores a credit balance and immutable credit ledger, generation request status, and bounded abuse-prevention state. Keyed hashes used to reject replayed Apple identity tokens and signed account events are stored only for their bounded replay windows. The app keeps its rotating ScribbleJelly refresh credential and Apple's opaque user ID in the iOS Keychain so authorization can be rechecked; short-lived access credentials remain in memory.

Free credits and Apple purchases

An adult account receives three starter AI credits and one free credit on each later eligible server day. Optional credit packs use Apple In-App Purchase. Apple handles payment details. ScribbleJelly receives Apple-signed transaction data, verifies it with Apple's certificate chain, and stores pseudonymous product, transaction, credit, and refund state so a purchase is granted exactly once. Refunds can remove previously granted credits; a reversed refund restores only the amount removed. ScribbleJelly never receives a card number.

Saving, sharing, and printing

After the grown-up check, an adult can save through Apple's Files picker, share to an installed app, or open AirPrint. ScribbleJelly creates a protected temporary export copy and removes it when the system action closes, with interrupted leftovers removed on the next launch. The chosen file provider, app, or printer may process the image under its own privacy policy. ScribbleJelly does not learn the chosen export destination.

Service providers and disclosure

Apple provides adult sign-in, In-App Purchase, Files, sharing, and AirPrint. OpenAI provides OpenAI Sites hosting and the moderation and image-editing APIs used only for an adult-approved AI request. For that request, OpenAI receives the submitted drawing and recipe and processes the generated images, and may retain those inputs and outputs for the periods described above. OpenAI and its infrastructure subprocessors may also process security and reliability metadata under OpenAI's agreements. Before enabling online AI, ScribbleJelly requires every service provider that receives user data to provide the same or equivalent protection described in this policy and required by applicable law. ScribbleJelly does not sell data, show ads, or share data for cross-app tracking.

Retention, access, and deletion

Access credentials are valid for no more than 15 minutes and rotating refresh credentials for no more than 30 days; expired credential hashes are pruned during routine service activity. Abuse-prevention state becomes eligible for deletion after 30 days. An Apple identity-token replay hash remains only until that token expires, for at most one hour; an Apple account-event replay hash remains for up to eight days; and pseudonymous StoreKit notification-deduplication records remain for up to 90 days. Those bounded records are pruned during later service activity. Consent, wallet, and purchase records remain while the adult account exists. A grown-up can sign out, revoke AI consent, or delete the adult account inside the app. Revoking AI consent immediately invalidates sessions and blocks AI and new purchases, but does not itself delete the account, wallet, or purchase records; those remain so refunds and reversals can settle. After signing out or revoking consent, deletion remains available through a fresh Sign in with Apple check that does not turn AI back on or renew AI consent. Account deletion removes the account, encrypted Apple token, sessions, wallet, ledger, generation state, account-linked abuse state, and identifying purchase linkage. A keyed Apple-subject event-time fence may remain for up to eight days so a session exchange already in flight before deletion cannot recreate the account. A genuinely later Apple authorization can create a new empty account with a new App Account Token; deleted credits and purchases cannot be restored. The bounded replay and StoreKit notification-deduplication records described above may remain until their stated expiry, but cannot recreate account or wallet state. ScribbleJelly attempts to revoke its Apple authorization after local deletion. Local deletion still completes if Apple's revocation service is unavailable; in that case the app tells the grown-up how to choose Stop Using Apple ID for ScribbleJelly in Apple Account settings. Apple's own purchase history remains subject to Apple's policy. Deleting the grown-up account removes ScribbleJelly's own account-linked records; it does not delete OpenAI abuse-monitoring logs before their normal expiry, which remains governed by OpenAI's retention policy and legal and safety exceptions.

Children's privacy

Children do not create accounts, enter an online text prompt, publish work, or message other users. Free creation remains on-device. The grown-up gate is a child-safety boundary; the separate adult account and explicit AI disclosure record the adult's authorization for the optional online feature and the applicable notice version. The person passing the local gate self-attests that they are the parent or guardian. Sign in with Apple authenticates an Apple account but does not independently prove age or parental relationship. A drawing may contain personal details even when it is not intended to. A supervising adult should review the drawing and control AI, purchases, exports, consent, and account settings.

Changes

Material changes will be posted here and reflected in the App Store privacy disclosure before an affected update is released.

Effective August 27, 2026