Privacy Policy

The data controller is iRoly Studio. For any privacy request, contact us at hello@iroly.studio.

We collect the following categories of personal data:

• Account & authentication data — your name, email address, and either a hashed password or a Google sign-in identifier. Authentication is handled by Better Auth on the website and Firebase Authentication in the app; we never store plaintext passwords.
• Purchase & credit data — records of credit packs and book purchases, your credit balance, and order history. On the website, card payments are processed by Stripe; iRoly does not receive or store your full card number. In the iOS app, credit packs are purchased through Apple In-App Purchase; Apple, not iRoly, handles your payment method.
• User content — colorings you create or generate, community posts, comments, profile information, and any media you upload.
• Usage, analytics & device data — app and site interactions, features used, device model, operating system, language, approximate region (from IP), and diagnostic logs. In the iOS app we use PostHog for product analytics, which includes session replay that records how you interact with app screens.

We do not knowingly collect precise location, contacts, health, or biometric data.

• Create and secure your account and authenticate you.
• Provide the Services: deliver books, credits, colorings, and community features.
• Process purchases and refunds and prevent fraud.
• Provide customer support and respond to your requests.
• Improve and debug the Services through analytics and diagnostics.
• Send service messages and, with your consent, marketing (you can opt out anytime).
• Comply with legal obligations and enforce our Terms.

Where GDPR applies, we rely on: contract (to provide the Services and process purchases), legitimate interests (security, analytics, service improvement), consent (marketing and non-essential analytics), and legal obligation (tax, accounting, responding to lawful requests).

We share personal data only with service providers acting on our behalf, including:

• Apple — App Store distribution and In-App Purchase billing.
• Stripe — website payment processing.
• Google Firebase / Firestore — backend data storage, authentication, and hosting.
• Google — optional Google sign-in.
• PostHog — product analytics and session replay (iOS app).

We do not sell your personal data. We may disclose data if required by law or to protect the rights, safety, and security of our users and Services.

Our providers may process data in Japan, the EU, and the United States. Where data leaves the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We keep personal data for as long as your account is active and as needed to provide the Services. Purchase and tax records are retained as required by law. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to meet legal obligations.

Depending on where you live (including under GDPR and the California CCPA/CPRA), you may have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email hello@iroly.studio. You may also lodge a complaint with your local data protection authority.

You can request deletion of your account and associated personal data at any time from within the app (Account → Settings) or by emailing hello@iroly.studio. In-app account deletion is provided in accordance with App Store Review Guideline 5.1.1(v).

The Services are intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

We do not use your data for cross-app or cross-site behavioral advertising, and we do not use the device advertising identifier. Our analytics (including session replay) are used only to operate and improve iRoly.

We use administrative, technical, and organizational measures — including encryption in transit, hashed credentials, and access controls — to protect personal data. No method of transmission or storage is perfectly secure, but we work to protect your information.

We may update this Privacy Policy from time to time. Material changes will be announced in the app or on the website, and the “Effective” date above will be updated.

Questions about this policy or your data? Email hello@iroly.studio.