Strangely Drawn — Privacy Policy

Effective date: August 19, 2026

Strangely Drawn (“the app,” “we,” “us,” or “our”) is an anonymous drawing app operated by Grain Studios. This Privacy Policy explains what we collect, why, how we use and share it, and the choices you have. It applies to the Strangely Drawn iOS app and the website at https://strangelydrawn.grainlabs.io.

Please read this together with our Terms of Service and Community Guidelines.

The short version

No account, no name, no email. You use the app under an anonymous ID. We never ask who you are.
Your selfie and your drawings are public. The whole point of the app is that a stranger draws you, and you see how you were drawn. Content you share goes into a public pool after it passes moderation.
No analytics, no ads, no tracking, no selling your data. We don’t build advertising profiles, we don’t track you across other apps or websites, and we never sell or rent your information.
You can delete your account and server-side data. One tap in the app removes your anonymous account and your content from our servers. Drawings you saved to the local gallery on your device stay on your device, under your control — you can delete those yourself in the app anytime.

The rest of this policy is the detailed version.

1. Who we are

Grain Studios is the controller responsible for your information under this policy. For privacy questions or requests, contact us at support@grainlabs.io. For app help, use support@grainlabs.io or https://strangelydrawn.grainlabs.io/support.

2. What we collect

We collect only what the app needs to work. There is no signup form and no profile.

What	What it is	Where it comes from
Selfie photo (face image)	A photo of your face that you take or import to share to the public pool, or to trace when you draw.	You, from your camera or photo library.
Drawings	The artwork you create: vector stroke data plus a rendered PNG image.	You, when you draw.
Optional timelapse	An optional recording of a drawing being made.	You, when you choose to record one.
Anonymous user ID	A random identifier that stands in for an account. It is not your name, email, or phone number.	Generated at first use via our authentication provider.
App Attest attestation	A hardware-backed signal from Apple’s App Attest confirming the request comes from a genuine, untampered app on a real device. It contains no personal data and does not identify you.	Your device, at sign-in.
Minimal technical and log data	Basic operational data our backend records to run the service and keep it secure — for example, timestamps, request and error logs, and coarse technical metadata.	Automatically, through our backend provider (Supabase).

A note on your face

A selfie is a photo of your face, so it is sensitive to you and we treat it that way. We use it only to let you participate in the app — to share yourself to the public pool so a stranger can draw you, or to trace while you draw. We do not run facial recognition, we do not identify you, and we do not create biometric templates or identifiers from your selfie.

3. What we do NOT collect

No email address, name, phone number, username, or password. There is no signup and no profile.
No advertising or analytics SDKs. We do not use third-party analytics or advertising tools.
No cross-app or cross-site tracking. We do not follow you around the internet or link you to activity in other apps.
No data brokering. We do not sell, rent, or share your information for anyone else’s advertising.
No contacts, location tracking, or device address book access for advertising or profiling purposes.

4. Camera and photo library

The app requests access to your camera for one purpose: to let you take a selfie that you choose to share or trace. To use an existing photo instead, the app opens your system photo picker, which runs outside the app and hands back only the single image you select — it does not require photo-library access and issues no library-access prompt. Either way, access happens only when you actively take or pick a photo. We do not scan your photo library in the background, and we do not import anything you don’t select.

5. Why we use your information and our legal bases

We use the information above for the following purposes. Where the EU/UK General Data Protection Regulation (“GDPR”) applies, the relevant legal basis is listed.

Purpose	Why	Legal basis (GDPR)
Show your selfie in the public pool and deliver drawings of you	This is the core service you asked for	Performance of a contract with you; your consent to share content publicly
Let you draw others and save drawings to your local gallery	Core service	Performance of a contract
Moderate content before it is shown publicly (automated NSFW classifier) and handle reports	Keep the public experience safe and lawful (App Store Guideline 1.2)	Legitimate interests in a safe service; legal obligation where applicable
Support report and block so users can manage what they see	Safety and user control	Legitimate interests; performance of a contract
Verify app and device integrity with Apple App Attest	Deter bots, fraud, and automated abuse	Legitimate interests in security
Keep basic technical and log data	Operate, debug, and secure the service	Legitimate interests in a reliable, secure service

Because we don’t collect names or emails, we cannot and do not use your information for marketing, profiling, or advertising.

6. Your content is public

Strangely Drawn is built around public sharing:

A selfie you submit to the pool can be seen by other users, who may draw the person shown.
Drawings (and any timelapse) are delivered to the subject and shown in a “how you were drawn” feed.
Content is shown publicly only after it passes automated moderation, but once public it may be viewed, screenshotted, or saved by others outside our control.

Please don’t share a selfie or create a drawing you wouldn’t want to be public. Do not include private information, other people who haven’t consented, or anything that violates our Community Guidelines.

Moderation, reporting, and blocking

An automated NSFW classifier screens content before it appears publicly.
You can report content and block the author of content you don’t want to see.
Reports are triaged by a human operator, who may remove content or restrict an anonymous account.

We keep sharing to the minimum needed to run the app.

Public users. Content you submit is shown publicly within the app, as described above.
Supabase (our backend processor). We use Supabase to store content and provide anonymous authentication. Supabase processes data on our behalf under its agreement with us and does not use your content for its own purposes. Learn more at Supabase’s own privacy documentation.
Apple. App Attest relies on Apple device and platform services; the attestation is exchanged to confirm app integrity.
Legal and safety. We may disclose information if required by law, or where necessary to investigate abuse, protect users, enforce our Terms, or protect our rights and safety.

We do not sell your information and do not share it for third-party advertising.

8. Retention

Public content (selfies, drawings, timelapses): kept while it is live in the service so the app can function, and until you delete your account or the content is removed through moderation.
Anonymous user ID and app-integrity signals: kept while your anonymous account is active.
Technical and log data: kept for a limited period for security and debugging, then deleted or de-identified.
On-device gallery: stored locally on your device and controlled by you until you delete it or the app.

When you delete your account (Section 9), we remove the associated content and account from our servers, subject to short operational or legal retention where required (for example, logs needed for security). Copies others may have already saved from the public feed are outside our control.

9. Your choices and rights

Delete your account and data (available to everyone)

In the app, use “Delete my account & data.” This:

deletes your anonymous account, and
removes your server-side content.

Drawings saved to the local gallery on your device are not deleted by this action — they stay on your device under your control, and you can delete them yourself in the app anytime. This action is permanent for your account and server-side content. If you need help, contact support@grainlabs.io.

Report and block

Use in-app report and block to manage safety and control what you see, as described in Section 6.

Depending on where you live, you may have some or all of these rights:

Access — a copy of the personal information we hold about you.
Correction — fix inaccurate information.
Deletion / erasure — delete your information (also available directly via the in-app delete feature).
Restriction / objection — limit or object to certain processing.
Portability — receive certain information in a portable format.
Withdraw consent — where we rely on consent, withdraw it at any time (for example, by removing content or deleting your account).
Non-discrimination — for California residents, we will not discriminate against you for exercising your rights.

California (CCPA/CPRA) note: In the past 12 months we have not sold or shared personal information as those terms are defined under California law, and we do not use sensitive personal information to infer characteristics about you. We do not knowingly process the personal information of anyone we know to be under 16 for sale or sharing.

How to exercise your rights. The fastest way is the in-app “Delete my account & data” control. For other requests, email support@grainlabs.io. Because the app is anonymous, we may not hold information that identifies you, and we may be unable to locate data associated with you without the anonymous identifier tied to your content or device. We will not use any information you give us to verify a request for any other purpose. You may be entitled to appoint an authorized agent, and to lodge a complaint with your local data protection authority.

The controller for these purposes is Grain Studios, based in the State of Florida, USA.

10. Children

Strangely Drawn is not directed to children and is intended for users 13 and older. We do not knowingly collect information from children under 13 (or the minimum age required in your country). If you believe a child has used the app or shared content, contact support@grainlabs.io and we will remove it. The final App Store age rating is set by Grain Studios.

11. International data transfers

We operate the app using Supabase, and your information may be stored and processed in countries other than where you live, including the United States, whose data-protection laws may differ from yours. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with additional protective measures. For more detail, contact support@grainlabs.io.

12. Security

We use technical and organizational measures designed to protect your information, including transport encryption, access controls, and Apple App Attest to deter automated abuse. No system is perfectly secure, and content you make public is, by design, visible to others.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Effective date” above and post the new version at https://strangelydrawn.grainlabs.io/privacy. Material changes will be made clear in the app or on the site. Continuing to use the app after an update means you accept the revised policy.

14. Contact us

Privacy questions and requests: support@grainlabs.io
App support: support@grainlabs.io or https://strangelydrawn.grainlabs.io/support
Controller: Grain Studios, the State of Florida, USA