DoodiaryPrivacy
This policy describes the version we are preparing. The app is not publicly available yet.
Responsible person and contact
Yeray Lage, Spain, is responsible for Doodiary. Contact ylagef.dev@gmail.com for support, privacy questions or requests to exercise your data rights. Policy version 1.0, 1 October 2026.
What Doodiary stores
After you confirm “Draw my day”, Doodiary stores your account identifier, your entry text, any pending redraw text, processing status, the selected scene description, and the current drawing. Earlier texts and drawings are kept when you redraw. Unconfirmed text is kept in memory only on your device.
Original image retention
Doodiary temporarily keeps the original PNG returned by the image provider, including an original whose conversion or drawing request later failed. These diagnostic sources are private and are scheduled for deletion after 30 days.
Who processes your entries
Supabase stores your account and diary data. Your confirmed text is sent to OpenAI to select a scene. So that the drawing is recognisably your day, the scene description keeps public, well-known things the entry mentions, such as a city, a landmark, a stadium, a sports team, an event or a dish. The model is instructed to replace the names of private people with their role (“a friend”) and to drop quotes and places that identify you personally, such as your home, street, workplace or school, but this is an instruction to a model rather than a guarantee of anonymization. The resulting scene description and a drawing reference are then sent to OpenAI to generate the image.
Sharing and export
Shared cards contain the drawing, optional entry date, Doodiary branding, and the configured public website address; they do not contain account data. Diary text is excluded by default and is included only if you explicitly enable it for that share. You can preview the card and choose its format before sharing. Format and date preferences are saved only on this device. Your export contains every confirmed entry, including failed or pending entries, scenes, statuses, earlier versions, final drawings, and every retained original PNG. If any stored asset cannot be retrieved, the export fails instead of silently omitting it.
Your control
Signing out removes local preferences and cached drawings from this device; it does not delete cloud data. Account deletion first blocks further account work, then removes entries, generated drawings, retained sources, and the authentication account. Doodiary clears the local session and caches only after the server confirms deletion.
Purpose and choices
Account data and diary content are used to provide the diary, sync, drawing generation, sharing, export and deletion you request. Before drawing, the app asks for explicit permission to send the entry text to OpenAI. You can decline and keep writing. Unsent text is held in memory and may be lost when you close the writing screen.
Drawing reports
If you report a drawing, Doodiary stores its reference, the selected reason, your account identifier and the report time. Diary text is not copied into the report. Reports are private, included in your export and deleted with your account. An authorized operator can inspect the referenced drawing to review your report.
Hosting and retention
The public website is hosted by Cloudflare. Infrastructure providers process technical connection data to deliver and protect their services and may use necessary security cookies. Doodiary does not add advertising trackers to this website. Confirmed diary entries, drawings and reports are kept until account deletion. Diagnostic PNGs and deletion receipts expire after 30 days; a completed receipt no longer identifies the deleted account.
Your rights and international processing
You may request access, correction, export or deletion of your data, restriction of processing, or object where applicable. You may withdraw consent for future AI processing by declining drawing. Contact us for requests that are not available in the app. You may complain to the Spanish Data Protection Agency (aepd.es). Supabase stores the production project in Frankfurt, Germany. OpenAI and Cloudflare may process data outside the European Economic Area; applicable processing agreements and transfer safeguards must be verified before the public app launches. This service is not intended for children under 18.