Privacy Policy

1. Scope and operator

This Privacy Policy explains how Boring Stuff Club (“we,” “us,” or “our”) handles information when you use The Scribble Thing and related pages (the “Service”). Questions and privacy requests may be sent to inquiry@boringstuff.club.

2. Information we collect

Content and generation data

We collect artwork and optional narration you upload, optional drawing-order instructions, generation settings, intermediate processing files, AI analysis and animation plans, generated preview and final videos, and technical information about the uploads such as file type, dimensions, duration, and size.

Session and security data

We create a random anonymous visitor identifier and session identifier. We use signed cookies to recognize your browser and authorize access to a session. Agent API sessions use a per-session bearer capability instead of an account. We also create a rotating, pseudonymous hash of an IP address for rate limiting, abuse prevention, and aggregate measurement. We do not use that hash to recover your original IP address.

Usage and device data

We collect events such as page views, uploads, generation stages and timing, feature choices, preview activity, downloads, unlock activity, feedback, browser/device information, and errors. For Agent API requests, we also record a sanitized client name, optional client version and marketplace label, and a one-way hash of an optional installation identifier. We do not retain the raw installation identifier or idempotency key. We also record first-touch campaign labels supplied in links, such as source, medium, campaign, and content labels, plus the referring website's hostname. We do not retain the referring page's path or query string. Google Analytics may also collect a client identifier, session statistics, approximate location, and browser or device information through first-party cookies on the public homepage. When a browser-started animation is accepted or completed, we may send those outcome events to Google Analytics with the associated Analytics client and session identifiers. We do not send the artwork, instructions, private session URL, written feedback, project description, or email address to Google Analytics.

Contact and purchase data

If you contact us, we collect your name, email address, message, and related feature or session identifier. On a completed animation session, you may also optionally provide written feedback, tell us the animation’s intended use, and provide a short project description. We collect an email address through that project-interest form only when you explicitly allow us to contact you. Written survey answers and email addresses are stored separately from the ordinary animation session and are not sent to Google Analytics; related measurement records only privacy-safe categories and whether contact was permitted. When you buy an unlock through Buy Me a Coffee, we receive purchase details needed to validate the transaction and issue a code. We retain pseudonymous hashes of the transaction reference and buyer email, purchase item, amount, currency, delivery status, refund status, and code record. To deliver contact notifications, Resend receives your name, email address, message, and related feature or session reference. For unlock emails, Resend receives the buyer email address and unlock code.

Share to Improve data

If you request a Share to Improve offer, we collect your name, email address, confirmation status, campaign and consent versions, the displayed offer type, price and currency, benefit status, timestamps, a pseudonymous IP hash, and evidence of the permissions you accepted. We also create a campaign-scoped keyed hash from a normalized form of the email address to enforce offer eligibility without placing the address itself in the eligibility ledger. After you complete the Service Improvement Opt-In’s required confirmation steps, including any displayed payment, we separately retain the covered “Session Materials”: copies of that session’s artwork, instructions, optional narration, generated clean video, generation settings and metadata, and cryptographic hashes that bind the permission to those exact files.

3. How we use information

We use information to:

• receive, analyze, and transform submitted content into animations;
• provide and secure session links, downloads, and unlocks;
• send purchased unlock codes, Service Improvement Opt-In confirmations, and responses to contact messages;
• prevent abuse, enforce limits, troubleshoot failures, and protect the Service;
• measure reliability, performance, conversion, and feature usefulness; and
• understand early users’ animation projects and, only with their express permission, contact them about possible assistance;
• comply with legal obligations and resolve disputes.

We do not use ordinary session content to train our own models. We use Session Materials for model evaluation, improvement, development, or training only after the person sharing them separately accepts the Service Improvement Opt-In and completes the offer’s required confirmation steps, including any displayed payment. That use is limited to models for The Scribble Thing’s animation service. Authorized personnel may also review limited session material when reasonably necessary to investigate a support request, security issue, abuse report, or generation failure during the 24-hour session window.

4. AI processing

To generate an animation, we send the uploaded image and your drawing-order instructions to OpenRouter and the selected model provider. Those providers process the content to return an analysis or drawing plan. Narrated Animation Beta audio is currently normalized and combined with the animation by our application processing and is not sent to the selected image-analysis model provider. Session Materials retained through Share to Improve are not provided to another company to train its unrelated or general-purpose models; processors may handle them only on our behalf. Provider handling, location, and retention may otherwise vary according to the service selected at the time. Do not submit sensitive personal information.

5. Service providers and disclosures

We disclose information only as needed to operate the Service, complete a transaction, comply with law, protect rights and safety, or complete a business transfer. Current provider categories include:

• Google Cloud and Firebase for application hosting, storage, databases, task processing, logging, and delivery;
• OpenRouter and downstream AI model providers for image and instruction analysis;
• Google Analytics for public-site usage measurement;
• Buy Me a Coffee for checkout and purchase webhooks; and
• Resend for transactional email delivery, including Service Improvement Opt-In confirmation links.

We do not sell personal information. We do not use Service information for targeted advertising, and we have disabled Google Signals and advertising-personalization signals in our Google Analytics configuration.

6. Cookies and similar technology

We use a signed scribe_visitor cookie to maintain a pseudonymous visitor identifier, a signed scribe_first_touch cookie for first-touch campaign attribution for up to 90 days, and a signed __session cookie scoped to a specific animation or private Share to Improve management page to authorize access. These are used for functionality, security, abuse prevention, and aggregate product measurement.

On the public homepage, Google Analytics may set first-party cookies such as _ga to distinguish visitors and sessions. We may associate browser-started generation outcomes with that Analytics client and session for aggregate conversion measurement. You can block or delete cookies through your browser. Blocking functional cookies may prevent a private session link from continuing to work in that browser.

7. Retention

• Ordinary animation sessions: uploaded artwork and narration, instructions, intermediate files, AI plans, generated videos, and session metadata are kept for up to 24 hours, unless deletion is required sooner. Using “Delete my session” removes them from our active Service earlier.
• Feedback and optional survey responses: ratings, selected feedback reasons, written answers, intended-use information, and contact details provided with permission may be retained separately for up to 24 months. Deleting the ordinary animation session does not delete a response that was already submitted, but you may contact us to request its deletion.
• Share to Improve Session Materials: the separately retained artwork, instructions, optional narration, generated clean video, settings, and associated metadata are kept for up to 24 months unless the person who opted in withdraws earlier. Deleting the ordinary session does not delete this separate copy.
• Service Improvement Opt-In records: limited evidence of the permission, confirmation, file hashes, campaign eligibility claim, and any withdrawal may be kept for up to seven years after the opt-in ends where reasonably needed to document rights, prevent repeated campaign benefits, resolve disputes, and comply with legal obligations.
• Trained models: models developed before a withdrawal may remain in use. The Session Materials’ individual influence may not be technically identifiable or removable from an already trained model, but withdrawn source files are excluded from future training.
• Pseudonymous product telemetry: retained for up to 24 months.
• Contact submissions: retained for up to 24 months.
• Purchase, refund, code-delivery, and related accounting records: generally retained for up to seven years where needed for tax, accounting, fraud prevention, dispute resolution, or legal compliance.
• Operational logs and provider-held data: retained under our security configuration and the applicable provider’s retention practices, and may remain for a limited period after deletion from the active Service.

Deletion may be delayed where we must preserve information for security investigations, disputes, legal holds, or other legal obligations.

8. Security and session links

We use measures intended to protect information, including private storage, signed access tokens, restricted service identities, encrypted network transport, upload validation, and access limits. No system is completely secure.

A personal session URL or Agent API bearer capability acts like a password: anyone with it may be able to access the session. Do not share it with anyone you do not intend to give access.

9. Your choices and requests

You can delete an active session from its session page and can block or delete browser cookies. A person who completed the Service Improvement Opt-In may withdraw through the private management link sent by email or contact us. Withdrawal deletes the separately retained Session Materials and excludes them from future training; it does not undo completed model training or revoke or change a clean-video benefit already granted for that exact session. You may also contact us to ask to access, correct, or delete personal information associated with you, or to appeal a request decision. We may need information to verify the request and may retain limited records where an exception or legal obligation applies.

Residents of California and other jurisdictions may have additional rights, such as rights to know, access, correct, delete, limit certain uses, opt out of sale or sharing, and receive non-discriminatory treatment. Because we do not sell personal information or use it for targeted advertising, we do not provide a sale or targeted-advertising opt-out.

10. Children

The Service is general-audience and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. Share to Improve and the Service Improvement Opt-In are limited to people who confirm they are at least 18. If you believe a child has submitted personal information, contact us so we can investigate and delete it as appropriate.

11. International processing

We and our providers may process information in the United States and other countries whose data-protection laws may differ from those where you live. Where required, providers use contractual and other safeguards for international transfers.

12. Changes and contact

We may update this Policy as the Service and our practices change. The effective date and version above identify the current Policy. Material changes will be posted here and apply prospectively.

For questions or privacy requests, email inquiry@boringstuff.club.