Privacy Policy

Last updated: 2026-04-12

This Privacy Policy describes how Paper Arcade Studio ("we," "us," or "our") collects, uses, and shares information when you use the Service. We are committed to collecting the minimum data necessary to operate the Service.

1. Information We Collect

1.1 Information You Provide

Account information: Email address and, if you choose to set one, a display name.
Generation inputs: Themes, prompts, solution phrases, uploaded images, and other content you submit to generate worksheets and word searches.
Billing information: Handled by our third-party merchant of record. We receive only a transaction reference and a confirmation that tokens may be credited. We do not store your payment card details.

1.2 Information Collected Automatically

Session data: Flask session cookies used to keep you logged in.
Operational metadata: IP address, request timestamps, rate-limit counters, render-concurrency lock state, and server logs for security, abuse prevention, and debugging.
Token and render ledger: Records of token balance changes and generation attempts, used for accounting and to resolve support tickets.

1.3 What We Do Not Collect

We do not sell personal information.
We do not use third-party advertising trackers.
We do not profile users for behavioral advertising.

2. How We Use Information

We use collected information to:

Operate, maintain, and improve the Service;
Authenticate you and secure your account;
Generate, render, and deliver worksheets, word searches, and AI-assisted artwork;
Meter free usage, enforce rate limits, and prevent abuse;
Process token purchases and maintain the token ledger;
Send transactional email (magic links, account notices);
Comply with legal obligations and respond to lawful requests.

3. Third-Party Processors

To operate the Service we share limited information with carefully scoped third parties:

AI model providers (e.g., Google Gemini): your generation inputs are sent to the provider so it can return generated text and images. Do not submit sensitive personal information in generation inputs.
Cloud storage (e.g., Cloudflare R2 / AWS S3): stores generated renders and database backups.
Merchant of record (e.g., Paddle or Lemon Squeezy): handles checkout, tax, and payment processing.
Email provider (e.g., Resend or Postmark): delivers transactional email including magic links.
Edge / CDN (e.g., Cloudflare): provides DDoS protection, WAF, and caching.

These providers have their own privacy policies. We do not sell or rent your personal information to advertisers or data brokers.

4. Generated Content

Generated Content (worksheets, artwork, reward images) may be stored in our systems and in our cloud storage provider so you can download and re-download it. Generation inputs may be transmitted to AI providers as described above. AI-assisted generation is probabilistic and, as noted in our Terms of Use, may incidentally produce material resembling copyrighted or trademarked third-party works; we do not pre-screen generated outputs.

5. Cookies

We use strictly necessary cookies to authenticate sessions and protect against CSRF. We do not use advertising or cross-site tracking cookies. Your browser may be configured to reject cookies, but parts of the Service may then fail to function.

6. Data Retention

We retain account, billing, and ledger data for as long as your account is active and for a reasonable period afterward to meet legal and operational requirements. Generated renders are retained until you delete them or terminate your account. Server logs are rotated and retained for a limited period for security and diagnostic purposes.

7. Security

We apply technical and organizational safeguards, including encrypted transport (TLS), email verification, restricted database permissions, container hardening, and scoped secret management. However, no service can guarantee absolute security, and you use the Service at your own risk.

8. Children's Privacy

The Service is intended for educators, parents, and learners age 13 and above. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

9. International Users

By using the Service you understand that your information may be processed in countries other than your own, including where our cloud and AI providers operate. Where required, we rely on lawful transfer mechanisms.

10. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To exercise these rights, contact us using the address published on the Service. We will respond within the time period required by applicable law.

11. Data Deletion and Account Closure

You may delete your account at any time. Upon deletion, we will remove personally identifying information from active systems, subject to retention required for legal, accounting, or security purposes (e.g., payment records, abuse logs).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance.

13. Contact

Privacy questions may be directed to the contact address published on the Service.