Privacy policy

Who we are

My Doodle World (mydoodleworld.com) is run by Marcio Santos, a sole trader in the United Kingdom trading as Santos Media Labs. He is the controller of the personal data described here.
Contact: [email protected]. Postal address: available on request by email.
This policy is written for grown-ups. Children don't give us their details: a parent, carer or other grown-up fills in every form.

We collect what you type into the form: the child's first name, their age or the level you pick, what they love, any idea you type in, whether you want the Storybook and the format. At checkout we collect your email address so we can send the book.
We use these details only to make the book, deliver it and help if something goes wrong. Our lawful basis is that we need them to do what you asked (a contract).
Before a book is made, the child's name and any idea you typed in are checked so the book can't carry swear words or anything unkind. That check runs on our own word lists and then through Anthropic's service. Anthropic sees only that word or phrase, not your email or anything else about you, and under its commercial terms it doesn't use what we send to train its models.
If you choose the Storybook, the story text is written through Anthropic's service from the interests, level and age. The child's name is never sent: the story comes back with a placeholder, and we put the name in on our own server.

Payments are handled by Stripe. For digital books, Stripe's Link acts as the seller of record and handles tax. You type your card details into Stripe's page, not ours, and we never see them.
Stripe tells us the payment worked, the amount and your email address. Stripe keeps payment records under its own privacy policy and the law.

Download links for PDF books last 72 hours.
Thirty days after a book is delivered we delete the book files and remove the child's name, age, interests, the story and your email address from the order. What stays is an anonymous record (format, level, price and the payment reference) that we need for our accounts.
Books that were started but never paid for are deleted the same way after 7 days.
These deletions run automatically every day.

The free colouring pages save your colouring in this browser only (on your device). Nothing about you or your child is sent to us. Clearing your browser data removes it.
Doodle World (the map) remembers which places you visited and which stickers you earned in the same way, on your device only.
If you install the site as an app, it keeps a copy of the free pages on your device so they work offline.

The account belongs to the parent or carer: we keep your email address and your subscription status. You sign in with a link we email you, or with Apple or Google, which tell us only your email address. We don't use passwords.
For each child (up to four) we keep only a first name and a colour you pick. We never ask for a child's email address, date of birth or photo.
We keep each child's colouring (a picture of the colours they added) and which pages they finished, so they can carry on and see their gallery. Nothing in the Club is public or shared with other families.
Payments and the subscription are handled by Stripe, through Link, which acts as the seller for our digital products. We don't see your card details.
Pictures are kept while you're a member and deleted 30 days after your membership ends. "Delete my account" on the account page deletes your account, your children's profiles, their pictures and any requests you sent us, and cancels the subscription.

We keep the child's first name, what you told us they love, the level and format you chose, and your email address, so a person can reply to you. Requests are deleted after 90 days, or straight away if you delete your account.

We count visits with Plausible Analytics and Cloudflare Web Analytics. Neither uses cookies or tracks you across other websites, and we never send them a name, an email address or an order number. Plausible sees the page (with order links shortened, for example /o/_/status), the site you came from, your country and the kind of device and browser; it doesn't keep your IP address.
We also count, on our own server, how many people reach each step of making a book, with the date only: no IP address, no account and nothing about the child.
If you arrive from an advert or a link with a campaign tag (utm_source and similar), your browser keeps that tag until the tab is closed and sends it with your order, so we can tell which adverts work. It describes the advert, not you.
If your browser sends Do Not Track or Global Privacy Control, none of this runs.

On the preview page you can tick "Email me a reminder if I don't finish". If you do and haven't paid, we send one email 2 to 24 hours later with a link back to your preview, and never another. We record when you ticked the box. Every reminder has an unsubscribe link that works without signing in.

We use only the cookies the site needs to work: one that keeps forms secure and, if you join Doodle Club, one that keeps you signed in (and a short-lived one while you sign in with Apple or Google). We don't use advertising or tracking cookies, so there's no cookie banner to click.

Render hosts the site and its data in Frankfurt, Germany.
Cloudflare protects the site and delivers pages quickly.
Stripe and Link take payments.
Resend sends our emails (download links, sign-in links and the one reminder you can ask for).
Anthropic provides the name check and writes Storybook text, as described above.
Plausible Analytics and Cloudflare Web Analytics count visits without cookies.
Apple and Google, only if you choose to sign in to Doodle Club with them.
Each of them handles data only to provide its service to us. Some are based in the United States; where data leaves the UK or EU, it's protected by the safeguards the law requires, such as standard contractual clauses or the UK and EU data bridges with the US.
We don't sell or rent personal data, we don't share it for advertising, and we don't show adverts on the site.

We collect as little as we can about children: a first name, an age or level, and what they love. We never ask for a child's surname, photo, email address, date of birth or location, and nothing a child makes on the site is public.
Children's details are used only to make what the grown-up ordered, never for marketing or profiling, and they're deleted on the timetable above.
If you think we have a child's details we shouldn't, email us and we'll delete them.

You can ask us for a copy of your data, to correct it, to delete it, to stop or limit how we use it, or to send it to you in a common format. Email [email protected] and we'll reply within one month. We may ask you to confirm it's you, for example by replying from the email address on the order.
Where we rely on your consent (the reminder email), you can withdraw it at any time with the unsubscribe link.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to the data protection authority where you live in the EU.
If you live in a US state with a privacy law, you have similar rights to know, correct and delete. We don't sell or share personal information as those laws define it.

If we change how we use personal data, we'll update this page and the date below. If a change is significant, we'll say so on the site, and Doodle Club members will get an email.
Last updated: 24 October 2026.