Privacy Policy

SayDraw (the “Service”) is a creative app for children. A child does not create a separate account. The guardian (legal representative) manages the account and child profiles and consents to the processing of personal information. This Policy explains how GREATEARTH CO., LTD. (“we,” “us,” or the “Company”) collects, uses, discloses, retains, and deletes information.

• Effective date: November 9, 2026
• Version: 2026-11-09

1. Controller and Contact

• Controller: GREATEARTH CO., LTD.
• Privacy inquiries and rights requests: dev@g-e.biz
• Company information: greatearth.studio.site

We provide the Company’s address and representative’s name without delay upon a request to dev@g-e.biz, as required by applicable law.

This Policy applies to the Service’s apps, API, and guardian support features. Where Apple or another third party independently processes information for its own account or payment service, that third party’s policy also applies.

2. Core Principles

• The guardian owns the account and gives consent. A child uses the Service only through a profile under that account.
• A voice recording is sent through our server to OpenAI, an AI service provider in the United States, for speech-to-text conversion. It is not stored in our database or artwork storage.
• OpenAI receives the voice recording, recognized text, safety-preserving drawing interpretation, fixed safety/style guardrails, and generated image only as needed at each processing stage. Recognized text that passes identifying-information and safety screening is also sent at the image-generation stage with the interpretation and guardrails. A coloring artwork a guardian chooses to post to the artwork board, feedback-board posts and comments, and the profile photos and guardian nickname a guardian sets are sent only to OpenAI Moderations for safety screening. Guardian and child account or profile identifiers are not included.
• Guardians are instructed not to let a child say a real name, school, address, contact detail, or other identifying information in a creative request. If such information is detected in the recognized text, or safety is uncertain, generation stops without further processing or storage.
• We do not use children’s data for advertising, behavioral tracking, or data sales. Only coloring artworks the guardian chooses may be shown to other families in the app, without the child’s name, once they pass automated safety screening.
• A child’s profile photo is shown only in that guardian’s account and is never shown to other families or to our operators.
• Feedback-board posts and comments, along with the author guardian’s nickname and profile photo, are visible to the other guardians who take part in the feedback board.
• We notify guardians and obtain renewed consent before making a material change to processing.

3. Information Processed, Collection Method, Purpose, and Retention

In this Policy, account “deletion” means final deletion after a 30-day grace period, not the time the request is made. A deletion request immediately signs the account out and suspends Service use, but account data and remaining credits are retained for 30 days so an accidental request can be reversed. If the guardian completes a new sign-in during that period and a new authentication session is issued, the request is automatically cancelled and the account returns to normal. If no new sign-in session is issued, final deletion occurs in the next daily deletion job after the deadline.

Guardian email, authentication-provider identifier, and authentication/session information
How collected and why used: Received from the authentication service when the guardian signs in with Apple or email. Used for account identity, sign-in, security, support, and linking payment status
Retention: Retained during the 30-day grace period, then deleted at final account deletion with the SayDraw authentication account and sessions managed by Supabase. The guardian’s Apple ID itself is not deleted. Transaction records subject to a legal retention duty follow the period below

Consent timestamp and Privacy Policy/Terms versions
How collected and why used: Recorded when the guardian presses the consent button. Used to verify valid consent and manage renewed consent
Retention: For the life of the account and the 30-day deletion grace period. Deleted at final account deletion, except a record strictly necessary for a legal dispute may be segregated for the period permitted by applicable law

Child-profile nickname, preset avatar, and birth year
How collected and why used: Entered or selected by the guardian. Used to display the profile and apply age-appropriate safety settings
Retention: Deleted when the profile or account is deleted

Child profile photo (optional)
How collected and why used: Chosen from the device’s photos by the guardian in the guardian area. Our server crops it to a square, removes metadata such as location, and stores it only if it passes OpenAI Moderations safety screening. Used only to display the profile within that guardian’s account
Retention: Not stored if it fails screening. The private storage object is deleted when the guardian changes or removes the photo, or when the profile or account is deleted

Guardian nickname and profile photo (optional)
How collected and why used: Set or uploaded by the guardian in the guardian area. The nickname and the photo are each stored only if they pass OpenAI Moderations safety screening, and the photo’s metadata is removed. Used in the guardian area and to show the author on the feedback board
Retention: Not stored if it fails screening. Deleted when the guardian changes it or removes the photo, when an operator removes it as inappropriate, or at final account deletion

Voice recording
How collected and why used: The app records the creative request in its private temporary area and sends it over an encrypted connection to our server. Our server sends the audio, without account or profile identifiers, to OpenAI Audio Transcriptions to convert it to text
Retention: Our server processes it only for the request and does not persist it in a database, application log, or artwork store. A server request-scoped temporary upload file is discarded after processing. A device temporary file is deleted or overwritten according to the app implementation and operating-system temporary-storage policy and may remain in the app-private area until the next recording or OS cleanup. OpenAI’s currently published endpoint table states: no model training, no abuse-monitoring retention, and no application-state retention. It is not used for speaker identification or a voiceprint

Recognized text
How collected and why used: Returned by OpenAI transcription to our server and app and shown on the confirmation screen. After identifying-information and safety screening, used for OpenAI Moderations safety review, OpenAI Chat Completions child-appropriate interpretation, OpenAI Images artwork generation, and guardian-facing creation history. The screened original text is sent for image generation with the safety-preserving interpretation and fixed guardrails
Retention: We do not store it if generation is blocked. If generation succeeds, it is kept with the creation and deleted when the creation, profile, or account is deleted. OpenAI currently states no retention for Moderations; Chat Completions and Images Generations inputs may be kept in abuse-monitoring logs for up to 30 days

Safety-preserving generation interpretation and fixed guardrails
How collected and why used: Our server creates a child-appropriate interpretation that preserves named characters and the core action while correcting only obvious speech-recognition errors, then adds fixed safety/style guardrails. Sent to OpenAI Images with the screened original recognized text for image generation and safety checks
Retention: We keep the safety interpretation with the creation and delete it with the creation, profile, or account. Fixed guardrails are source configuration and are not stored per user. The OpenAI request may be kept in abuse-monitoring logs for up to 30 days

Generated images and line art, coloring results, album and favorite records
How collected and why used: Created when generation, coloring, and save features are used. Used to display, store, download, and delete the child’s work
Retention: Database records and private-storage objects are deleted when the guardian deletes the creation, profile, or account

Artwork-board post copy and post status (pending, published, rejected, or hidden; rejection reason; line-art match result; publication time)
How collected and why used: Created when the guardian chooses a coloring artwork in the guardian area and posts it to the artwork board. Matched against the original line art to confirm it was colored in the app, then screened by OpenAI Moderations, and used to show it to other families in the app
Retention: Not stored if the match or safety screening fails. The database record and private-storage copy are deleted when the guardian withdraws the post, deletes the original creation or the child profile, or an operator deletes the post. From the time account deletion is requested it is no longer shown to other families, and it is deleted at final account deletion

Automatic nickname for each child profile (a color-and-animal combination)
How collected and why used: Chosen at random by our server when the profile’s first artwork is posted. Shown as the artist on the artwork board instead of the child’s name
Retention: Deleted when the profile or account is deleted

Artwork reactions (heart, star, clap)
How collected and why used: Recorded per child profile when a child reacts to an artwork on the artwork board. Used to display reaction counts
Retention: Deleted when the post, the reacting profile, or the account is deleted

Artwork- and feedback-board reports (reported post or comment and reason)
How collected and why used: Recorded when a guardian files a report. Used for operator review and to hide the reported guardian’s posts from the reporting guardian
Retention: Deleted when the reported post or comment is deleted, or at final deletion of the reporting guardian’s account. Which guardian account’s posts are hidden is kept so the posts stay hidden, and is deleted at final deletion of either the reporting or the hidden guardian’s account

Feedback-board participation, feedback posts (title and body) and comments, creation and edit times, and author number
How collected and why used: Collected when a guardian we invited writes or edits a feedback-board post or comment. The author number is assigned at the first post or comment. Used to collect and answer suggestions for improving the app and to show them to other participants
Retention: Not stored if safety screening fails at creation or edit. Deleted immediately when the guardian deletes it; deleting a post also deletes its comments and reports. If an operator hides it or the guardian is removed as a participant, posts and comments already written remain. From the time account deletion is requested they are no longer shown to other guardians, and they are deleted with the author number at final account deletion

Credit ledger, product and transaction identifiers, and receipt-verification results
How collected and why used: Collected when an Apple App Store purchase is verified. Used to grant credits, prevent duplicate grants, and handle refunds and accounting
Retention: Remaining credits and the ledger are retained during the deletion grace period. At final account deletion, the right to use all remaining credits expires and links to the account and child content are removed from ledger and transaction records. Those records are kept for refunds, accounting, and duplicate-grant prevention, generally for seven years from the day after the filing deadline for the relevant fiscal year and up to ten years where tax law requires, and are then deleted

Guardian support messages and replies, inquiry category/language, and app version, OS, and device model shown to the guardian before submission
How collected and why used: Collected when the guardian sends a 1:1 support inquiry. Used to answer the inquiry and investigate errors
Retention: Deleted with the support thread when the account is deleted

APNs push token and notification metadata
How collected and why used: Collected only when the guardian enables notifications in the guardian area. Used only for support-reply and credit-grant notifications
Retention: Deleted when notifications are withdrawn, the token expires or is rejected, or the account is deleted

Operational and security logs
How collected and why used: Automatically generated during API use: request ID, processing stage/status, latency, retry count, and error type. Used for reliability, security, and safety auditing
Retention: We do not log voice, recognized text, prompts, images, or email. Logs are ordinarily deleted within 30 days. Minimal records may be kept longer only as necessary for a security incident or legal duty

Safety-decision records
How collected and why used: Only the stage, outcome, and reason code of the generation pipeline, of board posting and writing, and of setting a profile photo or guardian nickname are recorded. Used to audit safety and verify blocks
Retention: Kept while the account or creation exists. On deletion, the account link is removed and the record is anonymized; source content is not retained

Do not enter or say a real name, school, address, contact detail, or other identifying information in a nickname or creative voice request. Because OpenAI transcribes the audio before text screening can occur, if personal information is detected after transcription we stop later OpenAI moderation, interpretation, and image-generation calls and do not store the request, but cannot reverse transcription that has already occurred. Whether voice or generated content is personal information under applicable law depends on its content and whether it can be linked with other information, so we treat it as protected user data regardless.

Artwork Board and Feedback Board

• Only an artwork that was made from app-generated line art, colored in the app, and saved, and that the guardian chooses in the guardian area, can be posted to the artwork board. A child cannot post, and there is no way to choose a device photo, screenshot, or picture from another app. A post is the picture as it was when posted; later coloring is not reflected.
• A posted picture is shown to other families in the app as soon as it passes the line-art match and OpenAI Moderations safety screening, and an operator may review published pictures and hide or delete them. Other families see only the picture, the automatic nickname, reaction counts, and the publication time; the child’s name, age, avatar, profile photo, and guardian information are not shown. The artwork board cannot be viewed on the web or outside the app.
• Only guardians we invite use the feedback board. Posts and comments are visible to the other guardians taking part in the feedback board and to our operators, and the author is shown by the nickname and profile photo the guardian chose instead of an email address or name; posts written before a nickname is set show an author number such as “Guardian 12.” Do not use a photo that shows your child’s face as your guardian profile photo. Do not write information about your child or contact details in a feedback post or comment. If content that appears to be personal information is detected, it is not stored.
• A guardian may withdraw an artwork post and delete their own feedback posts and comments at any time in the guardian area of the app.
• A guardian may turn off “Show Everyone’s Art” in the guardian area to hide the button that opens the artwork board from every child’s home screen on that account.
• A guardian may report a post that is inappropriate or exposes personal information. After a report, all posts by the reported guardian account are hidden from the reporting guardian’s screen, and an operator may review and hide or delete them.
• Retention for each item follows the table above.

4. AI Processing and What OpenAI Receives

Artwork generation follows these steps:

1. The app sends the voice recording to our server. Our server sends the audio file, without account or profile identifiers, to OpenAI Audio Transcriptions to convert it to text. Our server does not persist the original audio in a database, application log, or artwork store. The app uses an app-private temporary file for recording and upload, and that file may remain until the next recording or operating-system cleanup.
2. Our server first screens the recognized text for identifying information. If it is detected or the result is uncertain, generation stops without another OpenAI call or storage by us.
3. Text that passes that screen is sent to OpenAI Moderations for harmful-content screening and to OpenAI Chat Completions to produce a child-appropriate safety interpretation that preserves named characters and the core action while correcting only obvious speech-recognition errors, or to refuse generation.
4. The original recognized text that passed all screening, the safety interpretation, and fixed safety/style guardrails are sent together to OpenAI Images to generate an image. The original is treated only as scene content and cannot override the safety or style rules.
5. The generated image is sent to OpenAI Moderations for output safety review. Only a safe result is stored in our private storage.

On the artwork board, the feedback board, and profiles, we send the following to OpenAI Moderations only to screen for inappropriate content. If screening fails, the result is uncertain, or the check errors, the content is not stored.

• the coloring artwork a guardian is posting to the artwork board (after it passes the line-art match); and
• feedback-board posts (title and body) and comments (each time they are written or edited).
• child and guardian profile photos a guardian uploads (after metadata is removed).
• the guardian nickname (each time it is set or changed).

OpenAI receives the voice recording, recognized text (including the screened original sent at image generation), safety-preserving generation interpretation and fixed guardrails, generated image, coloring artwork being posted, feedback posts and comments, profile photos, and guardian nickname. We do not send OpenAI:

• guardian email or authentication identifier;
• child nickname, birth year, avatar, or profile ID; or
• support messages, push tokens, or payment and transaction information.

We do not enable OpenAI settings that share API data for model training. Under OpenAI’s published policy, API inputs and outputs are not used for model training unless the customer explicitly opts in. Zero Data Retention (ZDR) is not enabled. OpenAI’s currently published endpoint-specific terms state:

• Audio Transcriptions and Moderations: no abuse-monitoring retention and no application-state retention.
• Chat Completions and Images Generations: no application-state retention; inputs and outputs may be retained in abuse-monitoring logs for up to 30 days.

OpenAI may retain data longer where required by law or reasonably necessary to protect its services or a third party. We exclude guardian and child account or profile identifiers from OpenAI requests, instruct guardians not to let a child say identifying information in a creative request, and stop further AI processing and storage if such information is detected after transcription.

Safety screening is automated and fails closed: if a result is uncertain, no artwork is generated. It does not make a decision that produces legal or similarly significant effects for a child.

5. Service Providers and Disclosures

We entrust or transmit only the minimum information necessary to the following providers.

Supabase
Role: Guardian authentication
Information and location: Guardian authentication data (email, authentication-provider identifier, and authentication/session information). Tokyo region

Google Cloud
Role: API hosting, app database, private artwork storage, generation queue, operational logs, and database backup copies (up to 30 days)
Information and location: Information processed by the server; child profile, consent record, recognized text, safety-preserving generation interpretation, artwork metadata, board posts, feedback posts, comments, reactions, and reports, guardian nickname, credits, and support data; generated images, line art, coloring results, the board copy of coloring artworks posted to the artwork board, and child and guardian profile photos; generation jobs containing a creation ID and recognized text; minimal operational logs; database backup copies for disaster recovery. Server, database, storage, queue, and backups in the Tokyo region. Voice is never stored

OpenAI
Role: Speech transcription, text and image safety screening, child-appropriate interpretation, and image generation
Information and location: Voice recording, recognized text (including the screened original sent at image generation), safety-preserving generation interpretation and fixed guardrails, and generated image. Coloring artworks being posted, feedback posts and comments, profile photos, and the guardian nickname are sent only for Moderations safety screening. No account or profile identifier is sent. The recipient is in the United States; processing may occur in the United States or other permitted locations. Audio Transcriptions and Moderations currently have no retention; Chat Completions and Images Generations may be kept for abuse monitoring for up to 30 days

Apple
Role: Sign in with Apple, App Store purchase verification, and APNs notifications
Information and location: Guardian authentication and transaction identifiers, receipt-verification information, device push token, and content-free notification metadata

We do not permit providers to use data outside the stated purposes, sell it, use it for advertising, or use it for unauthorized model training. Through contracts and technical controls, we require confidentiality, security, deletion assistance, and protection equal to or greater than this Policy, and we supervise providers on an ongoing basis. We do not send personal information to a provider if we cannot verify those protections. Before a new provider processes personal information or a provider’s scope materially changes, we update this Policy and the consent screen and obtain renewed consent where required.

We do not send personal information or a support-inquiry identifier linkable to a person to any unlisted third-party webhook or notification service. We will give prior notice and obtain any required consent before introducing one.

6. International Processing and Transfers

Some providers are headquartered outside Japan or may process information outside Japan. Before consenting, a guardian can review the provider, information transferred, purpose, country or region, and safeguards on the consent screen and in this Policy.

• United States: OpenAI, Supabase, Cloudflare, Google, and Apple entities may be located or involved in processing there. The United States is not designated by Japan as a jurisdiction with a protection level equivalent to the APPI. Federal, state, and sector-specific privacy laws apply, and lawful government access may occur.
• EU/EEA and United Kingdom: Where processing occurs there, the region’s data-protection laws and the provider’s contractual safeguards apply.

Where required by the APPI or another applicable law, we obtain prior guardian consent or use a contractual and supervisory framework that requires the foreign provider to continuously implement measures equivalent to those under the APPI. A guardian may request current information about providers and safeguards at dev@g-e.biz.

7. Guardian Consent and Withdrawal

• After signing in, the guardian must review the information sent, recipient, purpose, retention conditions, this Policy, and the Terms on an adult-facing consent screen and actively press [Agree and continue].
• The server records the consent time and each document version. Before consent to the current versions, the Service does not allow child-profile creation, artwork generation, AI transfer, or payment.
• A material change increments the version, blocks the Service again, and requires renewed consent.
• A guardian may withdraw consent at any time by requesting account deletion in the guardian area or contacting dev@g-e.biz. The request immediately signs the account out and stops Service use and future creative processing. Account and child data and remaining credits are retained in deletion-grace status for 30 days. A new authentication session issued after a completed sign-in during that period automatically cancels the request and restores the account to normal Service. If 30 days pass without a new sign-in, the next daily deletion job performs final deletion and the right to use all remaining credits expires at that time. Transaction records that must be retained by law are disconnected from the account and child content and kept only as long as needed for refunds, accounting, and duplicate-grant prevention.

8. Guardian Rights and Deletion

A guardian may request notice of purpose, access or a copy, correction, suspension of use, suspension of third-party disclosure, or deletion of information concerning the guardian and child. Where applicable law grants additional rights, such as portability, restriction, or objection, those rights may also be exercised.

• Delete a child profile or creation: guardian area in the app
• Withdraw an artwork post or delete feedback posts and comments: guardian area in the app
• Change or remove a profile photo, or change the guardian nickname: guardian area in the app
• Delete the whole account and withdraw consent: guardian area in the app or dev@g-e.biz
• Other rights requests and complaints: dev@g-e.biz

We request only information reasonably necessary to verify the requester’s identity and guardian authority. A deletion request signs the account out and blocks account use immediately, but app data, child profiles, recognized text, generation instructions, support threads, private-storage artwork, the authentication account, and remaining credits are retained for 30 days. The session that existed when deletion was requested, or a mere token refresh for that session, does not cancel the request. Only a new authentication session issued after the guardian completes a new sign-in during the grace period automatically cancels the request and restores the account to normal. If 30 days pass without a new sign-in, the next daily deletion job removes the retained app data and artwork and deletes or revokes the SayDraw authentication account and active sessions managed by Supabase. At that final deletion, the right to use all remaining credits expires; only ledger and transaction records needed for refunds, accounting, and duplicate-grant prevention are disconnected from the account and retained for the stated period. It does not delete the guardian’s Apple ID itself. If a step fails, the deletion request remains recorded and is retried until completion. Completed final deletion cannot be undone. Data deleted from artwork, profiles, or accounts remains in database backup copies kept for disaster recovery and disappears automatically within 30 days. A provider log that we cannot delete individually at once, such as OpenAI’s abuse-monitoring log, expires under that provider’s published retention period.

We ordinarily charge no fee for a rights request. If applicable law permits recovery of a reasonable actual cost in an exceptional case, we give advance notice of the amount and basis.

9. Security

We use encryption in transit, private storage, least-privilege access, server-only API keys, short-lived signed URLs, guardian-account access controls, log filtering, retryable deletion, and fail-closed generation. If a personal-data incident occurs, we make any report or notice required by applicable law to Japan’s Personal Information Protection Commission (PPC), affected guardians, and other relevant authorities.

No system can guarantee absolute security, but we continuously review safeguards appropriate to the sensitivity of children’s data.

10. No Advertising, Tracking, or Sale

The Service does not use third-party advertising SDKs, IDFA-based advertising, behavioral targeting of children, data-broker sales, or public profiles. Only coloring artworks the guardian chooses may be shown to other families in the app, without the child’s name, once they pass automated safety screening, and we have no route that publishes children’s artwork on the web (such as public links or public profiles). In the guardian area of the app, the guardian may choose an artwork (a coloring page or a colored picture), one at a time, and send it directly through the device’s share feature (such as messaging or social media apps). This feature is not available on the child’s screens, no other information, such as the child’s name, is sent with the picture, the picture does not pass through our servers, and we do not collect or store any additional information for it. Any forwarding or posting after sending is the guardian’s own action, and we cannot control or reverse it. We do not use children’s data outside the account, creation, board, safety, payment, and support functions necessary to operate the Service.

11. Availability and Children’s Protection

Initial distribution is limited to the countries and regions we enable in the app stores. We do not offer the child-directed Service in the United States until controls required by U.S. law, including verifiable parental consent where applicable, are implemented. When offering the Service in another jurisdiction, mandatory local law prevails over this Policy and we implement any required guardian-consent and rights process before collection begins.

12. Changes and Contact

We announce changes and their effective date in the app or on the website. If there is a material change to the categories collected, purposes, third parties, international transfers, retention, or processing of children’s data, we stop the affected processing until the guardian consents to the new version.

Privacy inquiries and rights requests: dev@g-e.biz

Japan Personal Information Protection Commission: www.ppc.go.jp