This page is a reference translation of the Korean original. If the two differ, the Korean version prevails.

Little Canvas (the "App") values your personal information and collects, uses, and keeps it as described below.

1. Information We Collect and Why

• Account information (when signing in, required): The unique ID and email address of your Google or Apple account, your user name (nickname), and your profile photo (if added). Used to confirm your identity and tell accounts apart. If you use Apple's "Hide My Email", the hidden address is shared.

• Information you add: Your child's name (nickname), date of birth, gender, character or photo, drawing photos, titles, descriptions, drawing dates, recorded feelings, how each drawing was added, and AI analysis results. Used to keep and show drawings.

• Gallery sharing: The names and permissions of members, and invitation records. Used to provide sharing.

• Payment information (when using paid services): Subscription status, purchased products, App Store transaction ID, purchase and expiration dates, whether a free trial, auto-renewal, or payment problem applies, and refund date. Used to provide paid services and confirm payment. Payment method details such as card numbers are handled by Apple, and the operator does not receive them.

• Service operation records: AI analysis usage records (date, success, amount used), request counts to prevent excessive requests, failed invite code attempts, and consent records. Used to run the service reliably.

2. Where It Is Stored

• This device: Information you add is first stored on this device.

• Server: If you sign in and use server sync or gallery sharing, the original drawings and previews, copies for AI analysis, the information you added, and AI analysis results (the latest one per drawing) are stored on the server. The server is run through Supabase in the Seoul region (Republic of Korea), and Supabase's support and log processing may take place outside Korea (Article 6).

• Backup files: Files exported with "Data Backup" are saved where you choose (the device, or a Google Drive you connected), and you manage them from then on.

3. Sharing with Third Parties

The operator does not provide or sell your personal information to third parties. However, people you invite through gallery sharing can see the gallery's drawings and information within the scope set by the master, and cases required by law are an exception.

4. Outsourcing of Processing

• Supabase Pte. Ltd. (Singapore) · Supabase, Inc. (USA)

  • Task: Server operation, data and file storage, sign-in processing

• Google LLC

  • Task: Processing of the operator's AI analysis (drawing analysis and summary analysis)

• RevenueCat, Inc.

  • Task: Checking and managing subscription and purchase status

5. Information Sent to Outside Services

• Google · Apple: Their authentication services are used when you sign in.

• Operator's AI analysis: Only when AI analysis is run in a Curator gallery (including the free trial), the information below is sent to the AI provider (Google). Your child's name and guardian information are not sent.

  • Drawing analysis: The drawing photo (a reduced copy for analysis), the child's age in full years, recorded feelings, and the drawing's title and description

  • Summary by period: Each drawing's AI analysis result (text), drawing titles and descriptions, drawing dates, recorded feelings, and statistics calculated by the App. Drawing photos are not sent.

  • Results are stored on the server and shown to gallery members who have permission. The operator's AI account is set not to store request logs, and the provider does not use this information to train AI. Under the provider's terms, it may be kept for a certain period to prevent abuse.

• Analysis with your own API Key (Curator users only): This device sends the same kind of information as the drawing analysis and summary analysis directly to the AI provider you chose (Google Gemini or OpenAI), and that provider's terms and fees apply to you. If you use server sync, only the results are stored on the server.

• RevenueCat: When you sign in, a random account ID (not your name or email) is linked, and purchase records and basic device information (OS and app version, country, language) are processed at purchase, restore, and renewal.

• If an AI provider's policies change without notice, the way information is sent or kept may change, and updates to this Policy may come later than that change.

• Google Drive: Backup files are uploaded to your Drive only if you connect it yourself. The App can access only files it created.

6. Transfer Outside Korea

Under Article 28-8(1)(iii)(a) of the Korean Personal Information Protection Act, personal information is transferred outside Korea as below for outsourcing and storage needed to perform the service contract, and the details are disclosed in this Policy.

• Supabase Pte. Ltd. · Supabase, Inc. (privacy@supabase.io)

  • Information transferred: All information stored on the server (Article 1) and server usage logs

  • Country: Stored in Korea (Seoul). Access for support and security response from Singapore, the USA, and other countries; usage log processing in the European Union (EU)

  • When and how: As needed when using sign-in, sync, or sharing, over encrypted connections

  • Purpose and retention: Server operation / until you delete it or delete your account (usage logs: 7 days)

• Google LLC (https://policies.google.com/privacy)

  • Information transferred: The operator's AI analysis information in Article 5

  • Country: The USA and other countries with Google data centers

  • When and how: When AI analysis is run, over encrypted connections

  • Purpose and retention: Creating AI analysis results / request logs not stored; abuse-prevention period under the provider's terms

• RevenueCat, Inc. (1032 E Brandon Blvd #3003, Brandon, FL 33511, USA · https://www.revenuecat.com)

  • Information transferred: Random account ID, purchase and subscription records, basic device information

  • Country: USA

  • When and how: At sign-in, purchase, restore, and renewal, over encrypted connections

  • Purpose and retention: Checking and managing subscriptions / for the period needed for service and legal obligations under RevenueCat's policy

• If you do not want your information transferred outside Korea, you can use the App on this device only without signing in. If you have already signed in, please delete your account. In that case you cannot use server sync, gallery sharing, AI analysis, or paid services.

• If you do not run AI analysis, no information is sent to the AI provider.

7. Retention Period

• Information on this device is kept until you delete it or delete the App.

• Information on the server is kept until you delete a drawing or child or delete your account.

• When a subscription (including the free trial) ends and 1 month passes, your gallery information on the server is deleted (Terms of Service Article 11).

• If a member deletes their account, the drawings and information they added to a gallery remain in the gallery; only their name as the person who added them is removed. If you do not want this, please delete those drawings before deleting your account.

• Payment information: When you delete your account, it is disconnected from your account, and under the Korean Act on the Consumer Protection in Electronic Commerce, only transaction records (App Store transaction ID, product, purchase date, expiration date, refund date) are kept separately for 5 years and then deleted.

• AI analysis usage records: Automatically deleted after 6 months. When you delete your account, they are disconnected from your account.

• Server usage logs: Automatically deleted after 7 days.

• Deleted information remains in backups kept in case of server failure for up to 7 days and is then erased.

• Other information that the law requires to be kept for a certain period is kept separately for that period.

8. How Information Is Destroyed

• When you delete a drawing, child, or account, or when a retention period ends, the related information and files on the server are deleted automatically without delay and cannot be recovered.

• The operator does not move or keep your information outside the server (such as on personal computers or paper documents).

• Information stored on this device is erased from the device when you delete it in the App or delete the App.

• Backup files you exported must be deleted by you.

9. Children's Information and Legal Guardians

• The App does not collect information directly from children (including those under 14), and only people aged 14 or older can create an account.

• A child's information is processed only when the child's legal guardian (such as a parent) adds it directly, or when a user who has the legal guardian's consent adds it, and "Consent to Collection and Use of Child Information" is obtained when adding it.

• A legal guardian can access, correct, delete, or suspend processing of the child's information directly in the App or request it through "Contact Us".

• The App has no ads and does not use children's information for advertising or marketing.

10. Viewing AI Analysis Results

If you set a passcode or biometric authentication, AI analysis results can be viewed only after verification. Shared users can see AI results only if the master allows it.

11. Your Rights

• You can view and correct the information you added in Settings.

• You can delete drawings, children, and your account directly in the App.

• You can see what you agreed to under "Consent Management" in Settings. To withdraw consent, please delete your account under Account in Settings.

• For requests you cannot make directly in the App (access, correction, deletion, suspension of processing), please let us know through "Contact Us". A child's legal guardian can make requests in the same way.

12. Information Collected Automatically

• The App does not use cookies or advertising identifiers and does not show targeted ads.

• For subscription management, RevenueCat's in-app component processes basic device information (OS and app version, country, language) (Article 5).

13. How We Keep It Safe

• Access to information on the server is limited to users who belong to that gallery, and permissions are checked on the server.

• Drawing photos are kept in private storage and shown only to users in the same gallery through addresses valid for a short time.

• Stored information and communication between the App and the server are encrypted.

• Secret keys for server administration are kept only on the server, and administrator accounts use two-step verification.

• Excessive requests and repeated invite code attempts are limited.

• AI API Keys you enter are kept only in this device's secure storage and are not sent to the server.

• Information meant only for you can be hidden with a passcode or biometric authentication.

14. Privacy Officer

• Officer: Jinhong Park

• Contact: littlecanvas.app@gmail.com

• Please send questions, complaints, and requests for remedies related to personal information to the contact above.

15. Remedies for Infringement

If you need advice or dispute resolution regarding infringement of personal information, you can contact the Korean organizations below.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)

• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

• Korean National Police Agency: 182 (ecrm.police.go.kr)

16. Changes to This Policy

If this Policy changes, you will be notified in the App before the change takes effect. If you need a previous version, please request it through "Contact Us".

Operator: Jinhong Park

Effective date: (to be determined)