Privacy Policy
Effective 26 August 2026
In short. Kidsia is a coloring app for children aged 0–9. We show no ads, use no third-party analytics, never ask for the child's name or birthdate on our server, give children no way to chat with strangers, and sell nothing to anyone. Everything we keep exists so the app works and an unfinished picture is not lost.
1. Who we are
E-com solutions OÜ ("we")
Reg. no. 16662128 · Ida-Viru maakond, Lüganuse vald, Oandu küla, Allika, 42314, Estonia
Data questions: privacy@artia.club
This policy covers the web app at kidsia.artia.club and the Kidsia apps for iOS and Android, which talk to the same server.
2. What we collect and why
| Data | Why | When it appears |
|---|---|---|
| Guest account — a number issued by our server, plus session tokens | So an unfinished picture is found again next time, and on another device | On first launch. No name, age or email is requested |
| Coloring progress — the picture's number in our catalogue, the region number, the colour number and the time it was filled | To save the work, show the percentage and replay "how it was drawn" | On every touch of the canvas |
| Shared room — an invitation link, a temporary participant name (assigned by the server; nobody types it) and the shared colour marks | So two people can color one picture at the same time | Only if an adult created an invitation or opened one |
| Points, badges, day streak, daily records | In-app rewards | As the game is played |
| Parent's email and password | To move progress to another device and to restore it | Only if an adult typed them in after passing the parental gate. Otherwise the account stays a guest account forever |
| Leaderboard name | The label in the weekly table | Only if an adult typed it. By default other people see "Artist #…" — an account number, not a person |
| Device notification token (Apple APNs / Google FCM), plus the language and time zone from the notification settings | To deliver a notification and not to deliver it at night | Only in the store apps, and only after an adult allowed notifications at the operating system level. The web version sends no notifications and collects no token |
| The text of a "Write to us" message | To answer a complaint and fix what is broken | Only if an adult sent it |
| Web server technical log — IP address, time, page address, browser string | Abuse protection and incident analysis | On every request, as on any website |
3. What we do not collect
- The child's name, surname, age or date of birth. The age chosen on the first screen is a setting for region size; it is stored on the device only and never sent to our server.
- The child's photos or drawings. Kidsia has no photo import at all — only pictures from our own catalogue can be colored.
- Location, contacts, microphone, camera.
- Advertising identifiers (IDFA, AAID), IMEI, MAC address, device serial numbers.
- Third-party analytics or advertising SDKs — the app contains none.
- Messages: Kidsia has no chat whatsoever; a shared room carries colours only.
- Payment card data: Kidsia has no purchases for real money.
We do not build a profile of the child, do not serve behavioural advertising, do not pass data to ad networks or data brokers, and do not use it to train models.
4. Children: the basis for what we keep
Kidsia is made for children, so we keep collection within "support for internal operations" — what the app cannot work without: knowing whose progress this is, saving it, showing a reward, and answering an adult's message.
We do not rely on a child's consent. Everything beyond the game itself — linking an email, a leaderboard name, notification settings, links out of the app, feedback — sits behind a parental gate: a multiplication problem a preschooler cannot solve and that cannot be passed by an accidental tap.
A parental gate protects against accidental actions. It is not identity verification and not verifiable parental consent in the sense of COPPA or Article 8 of the GDPR. We say so plainly because Apple says so plainly in its review guidelines (section 5.1.4).
If you are a parent and believe your child left something with us, write to privacy@artia.club — we will delete everything tied to that account and confirm the deletion.
5. Notifications
Notifications are off by default and are turned on only by an adult, behind the parental gate and with the operating system's permission. There are exactly four reasons, all of them calm:
- the picture of the day has changed;
- someone close to you finished your shared picture;
- a started picture is waiting;
- someone called you into a shared picture — a person in your room does this, not the app.
We do not send "your streak is about to break", "you haven't been here for a while", and we do not advertise a shop through notifications. Quiet hours are supported. The device token is used to deliver these notifications and for nothing else.
6. Who receives data
- No advertising or analytics company. Our analytics is our own, written to our own database, and in the Kidsia web app it is switched off entirely.
- Apple and Google — only as notification transport (APNs and FCM) in the store apps: the device token and the notification text are passed to them. Apple's policy · Google's policy.
- Our hosting provider — the server that runs the app and its database.
- Public authorities — only where the law directly requires it.
We do not sell data and do not pass it to data brokers.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and progress | While the account exists |
| Session tokens | Short-lived: 15 minutes; renewable: 30 days |
| Shared rooms and the marks in them | While the participants' accounts exist |
| Notification tokens | While the app is installed and notifications are allowed |
| "Write to us" messages | While the sender's account exists |
| Web server technical log | 14 days, then deleted automatically |
| After account deletion | Nothing remains except anonymous counters of the form "this many marks were deleted" — they hold neither an account number nor a picture |
8. How to delete everything
In the browser: More → Parent account → Delete account. In the phone app: More → Delete account. The “More” tab is behind the parental gate. Deletion happens immediately, with no grace period. Deleted together with the account:
- email, password, leaderboard name and sign-in tokens;
- all coloring progress and the points history;
- participation in shared rooms and the colours left there;
- badges, day streak, daily records, settings and notification tokens;
- "Write to us" messages that were sent.
A guest account is deleted the same way as one linked to an email. After deletion, opening the app creates a new empty account. If you have no access to the app, write to privacy@artia.club; we reply within 10 working days.
9. Your rights
- Find out what data we hold and receive a copy of it.
- Correct inaccurate data.
- Delete the account and everything tied to it.
- Withdraw permission for notifications.
- Complain to the data protection authority in your country.
10. What stays on the device itself
The browser or app keeps: the chosen age, coloring settings (theme, palette, haptics), the session token, colour marks not yet sent, and a temporary room participant key. There are no advertising or tracking cookies. All of it is erased together with the app's or the site's data.
11. Security
- Data travels over HTTPS and WSS only.
- Passwords are stored hashed; tokens are stored hashed.
- Database access is restricted and not exposed to the internet.
- The server is backed up.
12. Changes
The current version always lives at https://artia.club/kidsia/privacy/. The same policy is also available at kidsia.artia.club/privacy. We announce material changes in the app.