Privacy Policy

1. In short

• No accounts. We do not ask for a name, date of birth, email address or phone number.
• While you are simply using the app, the projects you make and your settings stay on your device and are not sent to us.
• Information is sent to our server only when a grown-up presses “Send to the exhibit”. Even then it is a nickname and the project file — never a real name.
• A submitted project is published only after a person has looked at it, and you can ask for it to be taken down at any time.

2. What we collect, and when

a. While you use the app (not sent to us)

The following is kept on your device only, in the browser's storage (IndexedDB and local storage). The operator cannot read it. Clearing your browser's site data deletes it.

• The projects you make (drawings, blocks, pages) and their preview images
• Your language setting and whether you have already seen a hint
• The nickname you used when sending a project, the reference and removal codes for anything you sent, and which projects you have hearted
• App files downloaded so the app works offline (the service worker cache)

b. When you send a project to the exhibit (after the grown-up check)

Once the grown-up check (a multiplication question) is passed and a project is sent, the following is stored on our server.

• Nickname — the name shown in the exhibit. We ask you not to use a real name.
• Project title and project file — drawings, blocks, and the backgrounds, characters and sounds used. Anything the child typed inside the project (speech bubbles, words placed on the stage, object names) is part of that file.
• Language used, page count, object count, file size
• A one-way transformation of the network address (IP) — we do not store the address itself. It is used only to stop one source sending far more than can be reviewed.
• A random string that distinguishes one browser — generated by the browser itself. It does not identify a device or a person. It is used so that re-sending the same project replaces the earlier one, and so a heart is not counted twice.
• A removal code — used to confirm it is you when you later ask for the project to be taken down.

What we never collect: real names, date of birth, age, gender, email addresses, phone numbers, postal addresses, school names, contact details, precise location, photographs, or voice recordings.

c. Records created automatically when you connect

• Hosting provider (Cloudflare) access logs — network address, time, the address requested, and browser type
• Usage statistics through Cloudflare Web Analytics. It uses no cookies, does not identify anyone, and does not follow you across sites. What it reports is page views, visits, where visitors arrived from, browser, operating system and device type, the country of the connection, and how quickly pages appear. What you press inside the app is not collected.

3. Why we use it

• To save your projects and open them again (on your device)
• So that a person can check whether a submitted project is suitable for children before it appears in the exhibit
• To stop one source sending so much that reviewing becomes impossible
• To confirm and act on a takedown request from a parent or guardian
• To find faults in the service and to count how it is used

4. Sharing and processors (including transfers outside Korea)

We do not sell personal information and do not share it for advertising. We use the following processors to run the service. All of them process data outside the Republic of Korea.

Recipient	Country	What is sent	Purpose	Kept for
Cloudflare, Inc.	United States and others	Everything listed in 2(b) and 2(c)	Web hosting, database and file storage	As in section 5
Google LLC (Gemini API)	United States	Only the words inside the project — title, nickname, object and background names, speech bubbles, words on the stage. Drawings, sounds and the project file are not sent.	A first automatic check for unsuitable wording. A person makes the final decision.	Per that provider's policy
Cloudflare, Inc. (Web Analytics)	United States and others	Page address, referrer, browser, operating system and device type, country	Usage statistics (no cookies, no identification)	Per that provider's policy
Resend, Inc.	United States	Project title, nickname, the text being reviewed	Emailing the operator that a new project has arrived	Per that provider's policy

Processors are bound by contract and by their own privacy policies not to use the information for any other purpose.

5. How long we keep it

• Projects in the exhibit — for as long as the exhibit runs. Publication stops when a takedown is requested or the operator removes it.
• Projects that were rejected or taken down — the record is kept so the same project cannot be re-submitted and quietly pass. The project file is deleted after one year.
• The transformed address value and the browser string — one year from the last submission.
• Access logs — per the hosting provider's own retention period.
• Projects and settings on your device — until you delete them. The operator cannot delete them for you.

6. Children

This app is made for children of roughly five to seven years old. Under the Korean Personal Information Protection Act, personal information of a child under 14 may only be processed with the consent of a legal guardian. Similar rules apply elsewhere, including COPPA in the United States and the GDPR in the EEA and the UK.

• No personal information is needed to use the app.
• The screen that sends a project to the exhibit sits behind a grown-up check (a multiplication question). A child cannot send a project alone, and passing that check and sending the project is how a guardian gives consent.
• We ask that nicknames are not real names, and a reviewer will not publish a project that appears to contain a real name, a school, or contact details.

7. Your rights, and a guardian's

You may ask at any time to see, correct, delete, or stop the processing of the information described here.

• To take a submitted project down — send us the reference code and removal code that were shown when the project was sent, and we will take it down after checking. The app's project information screen also shows the status of anything you sent.
• If you have lost the codes, send anything that identifies the project (its title, the nickname, roughly when it was sent) and we will find it.
• There is no account, so everything else is deleted along with your browser's site data.

8. Deletion

Information is deleted without delay once its retention period has passed or its purpose has been met. Electronic files are deleted in a way that cannot be recovered.

9. How we protect it

• Network addresses are never stored as-is — they are kept only as a value that cannot be turned back into an address.
• Nothing is published without a person reviewing it — the automatic check is advisory; a person decides.
• Uploaded drawings are made safe — anything executable is stripped out of them and they are served in a way that stops a browser from running them.
• Access is restricted — the review page is for the operator only and is not indexed by search engines.
• Exhibit projects are excluded from search engine indexing.

10. Cookies

This app sets no advertising or analytics cookies. Usage statistics come from Cloudflare Web Analytics, which does not use cookies. The only cookie is the one used to sign in to the review page, which concerns the operator only.

11. Contact

Please write to the address above with any privacy question, takedown request or complaint. We will reply without delay.

If you live in the Republic of Korea

You may also contact these bodies about a privacy complaint:

• Korea Internet & Security Agency, Privacy Report Centre (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
• Supreme Prosecutors' Office, Cybercrime Division (spo.go.kr / 1301)
• National Police Agency, Cyber Bureau (ecrm.police.go.kr / 182)

If you live elsewhere

Those bodies serve users in Korea. If you live in another country, please write to the email address above first; you may also contact the data protection authority for the country you live in.

12. Changes

If this policy changes, we will say so on this page seven days before the change takes effect.

Effective: 31 July 2026