Privacy Policy

TryPaintByNumbers ("the site", "we") turns your photos into paint-by-numbers canvases. This policy explains exactly what data the site touches, what it stores, where it goes, and what control you have over it. It applies to www.trypaintbynumbers.com and every page on it.

The short version

• Your photo is used only to make your canvas. It is sent over an encrypted connection to our processing server, handled in memory, and discarded as soon as the canvas is ready. We never save it.
• Your saved canvases stay in your browser, in local storage on your own device.
• We don't sell, rent, or trade personal data. Ever.
• You sign in with Google to create a canvas. Google handles your password; we never see it.
• Our server keeps almost nothing: a daily usage count and short technical logs, described below.
• We use privacy-respecting analytics to understand aggregate usage, and nothing more.

Your photos and canvases

When you create a canvas, your browser sends the photo over an encrypted (HTTPS) connection to our processing server, which is hosted by DigitalOcean in Bangalore, India, behind Cloudflare. The server turns the photo into the numbered canvas in memory and sends the result back to your browser. It does not save your photo or the result, and it does not share them with anyone. You must be signed in to do this, and a Cloudflare Turnstile check confirms that you are a person.

Canvases you create and your painting progress are stored locally in your browser using IndexedDB and localStorage. That data stays on your device. You can remove it at any time by deleting your canvases inside the app, or by clearing your browser's site data for this domain. Clearing site data permanently deletes those canvases — we hold no backup and cannot restore them.

What our processing server keeps

To apply a fair daily limit and to fix problems, the server keeps two small things:

• A daily usage count — your account identifier (a random ID created by Supabase), the date, and how many canvases you made that day. It contains no photo, email address, or name.
• Short technical logs — the first characters of your account identifier, the file size, the number of colours, and how long processing took. Logs rotate automatically and are kept only for a short rolling period.

Your IP address is used to apply rate limits and to block abuse. It is held in memory and is not written to our usage records.

Accounts and sign-in

To create a canvas you sign in. Authentication is handled through Supabase using Google Sign-In. We receive and store the basic profile information Google provides — your email address and account identifier — solely to identify your account and keep you signed in.

We do not receive your Google password. We do not access your Gmail, Google Drive, contacts, or any other Google service. To delete your account and the data associated with it, email us at the address below and we will remove it.

Analytics

We use two analytics tools to understand how the site is used in aggregate:

• Google Analytics 4 — page views, approximate location at country/city level, device and browser type, and anonymous interaction events such as "a canvas was created".
• Microsoft Clarity — aggregate usage patterns and heatmaps that show which parts of a page people interact with.

These tools set cookies or similar identifiers in your browser. They collect usage data, never your photos or canvases. You can opt out with the Google Analytics Opt-out Browser Add-on, or by blocking these scripts with a browser setting or extension — the tool works normally either way.

Google Ads API

This website owner uses a personal tool that accesses the Google Ads API for keyword research purposes. This tool does not collect, store, or share any personal user data. It only retrieves keyword search volume data for internal research. No Google Ads campaigns are created or modified.

Cookies and local storage

The site uses browser storage for three purposes only:

• Essential — keeping you signed in, and the Cloudflare Turnstile check that confirms you are a person.
• Functional — saving your canvases, painting progress, and preferences on your device.
• Analytics — the Google Analytics and Microsoft Clarity identifiers described above.

We do not use advertising cookies and we do not run ad retargeting on this site.

Third-party services

The site relies on a small number of external services:

• Vercel — hosting and content delivery. Standard server logs, including IP addresses, are processed for security and reliability.
• Supabase — account sign-in (Google Sign-In).
• Cloudflare — network protection, bot detection (Turnstile) and rate limiting in front of our processing server. Cloudflare sits between your browser and our server and handles requests in transit, including the uploaded photo, as it passes them on. It does not keep the photo for us.
• DigitalOcean — hosts the processing server (Bangalore, India).
• Google Analytics and Microsoft Clarity — analytics, as described above.
• Google Fonts and public CDNs — delivery of fonts and libraries.

Each of these handles data under its own privacy policy.

Children's privacy

This site is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict its processing. Because almost everything the tool creates lives on your own device, you can exercise most of these rights yourself by clearing your browser's site data. For anything tied to a signed-in account, email us and we will action your request.

Data retention

Canvases and progress stay on your device until you delete them. The photo you upload is not kept on our server after your canvas is made. The daily usage count and technical logs are kept for a short rolling period. Account data is retained for as long as your account exists, and is deleted when you ask us to delete the account. Analytics data is retained according to the default retention settings of the respective providers.

Changes to this policy

If this policy changes, we will update the page and revise the "Last updated" date at the top. Material changes will be made clear on the site.

Contact

Questions, requests, or concerns about privacy — email rohanrashinkar7246@gmail.com.