1. The short version
Your doodles are shared only with the one person you connect with. We don't sell your personal data, we don't show ads, and we don't use your drawings to train AI models. You can delete everything at any time.
This Privacy Policy explains how Tuyo Labs (“Tuyo”, “we”, “us”) handles personal information when you use the Tuyo mobile apps, widgets and the website at tuyo.space (together, the “Services”).
2. Information we collect
Information you give us
- Account details — name or nickname, email address, and the sign-in provider you choose (Apple, Google or email). If you use “Hide My Email”, we only receive the relay address.
- Content — doodles (stroke data), photos you choose to draw on, stickers, text notes and reactions you send to your connected partner.
- Connection data — your invite code and the account you connect with.
- Support messages — anything you send us via email or our contact form.
Information collected automatically
- Device data — device model, OS version, app version, language, time zone and push notification tokens (needed to deliver doodles to widgets).
- Usage data — feature interactions, streak counts, crash logs and performance diagnostics.
- Purchase data — subscription status and transaction IDs from Apple, Google or, for web purchases, Dodo Payments (our merchant of record), plus the email you enter at checkout so we can unlock Tuyo+ on your account. We never receive your full card details.
We do not collect precise location, contacts, or your photo library beyond the images you select.
3. How we use information
- To provide the Services — deliver doodles, update widgets and Live Activities, keep Memories and streaks.
- To manage your account and Tuyo+ subscription.
- To keep Tuyo safe — prevent spam, abuse and fraud, and enforce our Terms.
- To improve the app using aggregated, de-identified analytics.
- To communicate with you — service messages and, only if you opt in, product news.
- To comply with legal obligations.
4. Legal bases (EEA & UK)
If you are in the European Economic Area or the UK, we rely on the following legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the Services and your account | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, product improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails, optional analytics cookies | Consent (Art. 6(1)(a)) — withdraw any time |
| Tax, accounting and legal requests | Legal obligation (Art. 6(1)(c)) |
5. How information is shared
With your partner. Content you send is visible to the person you're connected with. If you disconnect, new content stops flowing; content already delivered may remain on their device.
With service providers who process data on our behalf under contract — cloud hosting, push delivery (Apple Push Notification service, Firebase Cloud Messaging), crash reporting, customer support and email delivery.
With payment providers — Apple, Google and Dodo Payments (merchant of record for web purchases) to process payments, taxes, fraud checks and subscriptions.
For legal reasons — when required by law, or to protect the rights, safety and property of our users or others.
In a business transfer such as a merger or acquisition, subject to this Policy.
We do not sell or “share” personal information for cross-context behavioural advertising.
6. Data retention
- Account data: kept while your account is active.
- Doodles & Memories: 30 days on the free plan, indefinitely on Tuyo+ until you delete them.
- Diagnostics: up to 90 days.
- After account deletion, personal data is erased from active systems within 30 days and from backups within 90 days, except where we must keep it by law.
7. Security
Data is encrypted in transit (TLS 1.2+) and at rest. Access is limited to staff who need it, protected by multi-factor authentication and logged. No system is perfectly secure, but we work hard to protect your information and will notify you of a breach as required by law.
8. Your rights & choices
Depending on where you live, you may have the right to:
- Access and receive a copy (portability) of your personal data;
- Correct inaccurate data;
- Delete your data;
- Object to or restrict certain processing;
- Withdraw consent at any time;
- Opt out of the sale or sharing of personal information (we don't do either);
- Not be discriminated against for exercising your rights.
You can delete your account in the app (You → Settings → Delete account) or via our Delete Account page. For anything else, email privacy@tuyo.space. We respond within 30 days (45 days for California requests). You may also complain to your local data protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).
9. US state privacy notice
If you live in California, Colorado, Connecticut, Virginia, Utah, Texas or another US state with a consumer privacy law, the rights above apply to you. In the last 12 months we collected the categories described in Section 2 (identifiers, user content, internet activity, commercial information) for the purposes in Section 3. We do not sell or share personal information and do not use sensitive personal information for purposes other than providing the Services.
10. International transfers
We operate in the United States and the European Union. When data moves between regions we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.
11. Children
Tuyo is not intended for children under 13 (or under 14 in Spain, or the minimum age of digital consent in your country). We do not knowingly collect data from children. If you believe a child has given us data, contact privacy@tuyo.space and we will delete it.
12. Changes to this policy
We may update this Policy from time to time. We'll post the new version here with a new “Last updated” date and, for material changes, notify you in the app or by email before they take effect.
13. Contact us
Tuyo Labs
Privacy questions: privacy@tuyo.space
Or use our contact form.