Privacy Policy

Effective date: 7 November 2026

This policy explains what happens to your information when you use Squiggle, the Android app and its website squiggle.tandevs.com ("Squiggle", "we", "us"). Squiggle is run by Raj Aryan (tandevs), who is responsible for your data. Contact: rajaryan.space@gmail.com.

The short version: there is no sign-up, we keep only what is needed to deliver your doodles to the people you choose, we don't sell data or show ads, doodles are deleted after one year, and you can delete everything at any time in the app.

What we collect and why

Your account. When you open the app for the first time it creates an anonymous account: a random account id and a secret token that keeps the app signed in. We store only a one-way hash of the token. There is no email, phone number or password.

Your profile. The display name and colour you pick, and your time-zone offset (so that streaks and daily limits follow your local day). Your name and colour are shown to the people in your circles, and to people who open an invite link you shared.

Your doodles. Each doodle you send is stored as a picture (PNG, or JPEG for a doodle on a photo) and as the strokes, text and stickers you added (so it can be replayed). We also store the reactions you add. A doodle is visible only to the members of the circle you sent it to (and, for the first doodle of an invite, to anyone who has that invite link).

Circles and invites. Which circles you are in, your role, when you joined, streaks and the "together since" date if you set one, and the invite codes you create.

Photos you doodle on. If you choose to doodle on a photo, the app sends only that one photo: square-cropped and resized (720 × 720) on your phone, with the doodle drawn on top and the photo on its own for the replay. The app never looks through your gallery: you pick a single photo with Android's photo picker, or take one with the camera app; the app has no access to your other photos. A photo doodle is treated exactly like any other doodle: only your circle can see it, and it is deleted with it.

Videos you share. "Share video" turns a doodle of your circle into a short video on your phone: nothing is uploaded to us to make it. The video shows our logo and a generic line such as "for my person"; names appear only if you switch "Show the name" on. It goes only where you send it (the app you pick in the share sheet) or into your gallery when you tap "Save to gallery". We count, without any content or names, that a video was made or shared and to which kind of app (for example "TikTok"), and how many people install the app from a shared video's link.

Drawing together live. When you open "Draw together", your strokes go through our server to the members of that circle who have the canvas open, as you draw. The server keeps the strokes only while the canvas is open; when someone taps Done they are saved as a normal doodle of your circle (with who drew it), otherwise they are deleted when the canvas closes. We keep, without any content, when a live canvas started and ended, how many people joined and how many strokes it had (for the free weekly limit and to improve the feature), for 90 days.

Web replies. If someone answers your invite on the website without installing the app, we store the name they type and their doodle in that circle. The website remembers that name only in their own browser.

Notifications. A push token from Google Firebase Cloud Messaging, so new doodles can appear on your home-screen widget. It is replaced when you reinstall the app and removed when you delete your account.

Age confirmation. The time you confirmed that you are 13 or older. We don't ask for or store your birth date or age.

Google backup (optional). If you choose "Back up with Google", we store your Google account's unique id (not your email or profile) so you can restore your account on a new phone. We verify it with Google when you link it.

Purchases. If you buy Squiggle Plus or a streak freeze, Google Play handles the payment and RevenueCat tells our server what you bought and until when it is active. We never see your card or payment details.

Reports and blocks. When you report a doodle we store the reason, your optional note, and who reported whom. When you block someone we store that block.

IP addresses. We use your IP address to stop abuse (for example, too many sign-ups or replies). It is kept only in short-lived counters that are deleted within 2 days, or as a one-way hash (one web reply per invite, and invite statistics with a key that changes every day). Our hosting provider Cloudflare also processes IP addresses to deliver and protect the service.

Invite statistics. To see whether invites work, we count steps such as "invite created", "link opened", "reply sent" and "joined", with the type of device (Android, iPhone, desktop). These counts contain no names and no IP addresses.

Usage statistics and crash reports (optional). The app uses Google Firebase Analytics and Firebase Crashlytics to learn which features are used and to fix crashes. They receive app events (for example "doodle sent" or "widget added", with small details like the brush used), device and app information (model, Android version, language, app version, country derived from the IP address), crash logs, and a random app-instance id. They never receive your name, your doodles, your circles, invite codes or account id. You can switch this off at any time in Settings → Share anonymous usage & crash data; where the law requires it (for example in the EU and UK) we ask before turning it on. Google keeps individual analytics events for up to 2 months and crash reports for 90 days.

Account deletion requests. If you use the web form at squiggle.tandevs.com/delete-account, we store the email address you enter, the optional account id and note, so that we can handle and confirm your request.

We do not collect your location, contacts, microphone, advertising id or browsing history, nor any photo you did not pick yourself to doodle on, and we don't use cookies or tracking scripts on our website.

Legal bases

Where laws like the GDPR apply, we process your data to provide the service you asked for (your account, doodles, circles, widget delivery, purchases), based on our legitimate interests in keeping Squiggle safe and working (abuse limits, moderation, invite statistics, security), based on your consent for usage statistics and crash reports (which you can withdraw in Settings), and to comply with legal obligations (for example reporting child sexual abuse material).

Who we share data with

We don't sell your data and we don't share it for advertising. We use these service providers, who process data on our behalf:

• Cloudflare (servers, database and file storage for accounts, circles and doodles): Cloudflare Privacy Policy
• Google Firebase (push messages, optional analytics and crash reports): Privacy and Security in Firebase
• Google Play (app distribution, payments and, if you link it, Google sign-in): Google Privacy Policy
• RevenueCat (purchase status for Plus and streak freezes): RevenueCat Privacy Policy

These providers may process data in countries other than yours, including the United States and India. We rely on their safeguards (such as standard contractual clauses) for these transfers.

The people in your circles see your name, colour, doodles, reactions and streak activity. We may disclose information when the law requires it, or to protect people from harm, for example by reporting child sexual abuse material to the authorities (see our Child Safety Standards).

How long we keep data

• Doodles (picture, strokes and, for photo doodles, the photo) are deleted automatically one year after they were sent, or earlier if you delete your account or if everyone leaves the circle.
• Your account: until you delete it. When you delete your account, your profile, the doodles you sent, your memberships, blocks and invites are removed immediately. Remaining traces (for example in backups, logs or on the anonymous deleted-account record) are removed within 30 days.
• Reports: up to 1 year (moderation history). When the reporter or the reported person deletes their account, their id is removed from the report.
• Deletion requests from the web form (including your email): deleted 30 days after we complete the request, and at most 90 days after you sent it.
• Invite statistics: 180 days. Purchase event records: 90 days. Abuse-limit counters: 2 days.
• Banned accounts: to enforce a ban we keep a one-way hash of the banned account's token and of its Google account id.
• Analytics and crash reports at Google: up to 2 months and 90 days.

Your rights and choices

Depending on where you live (for example under the GDPR in the EU/UK, the CCPA/CPRA in California, or India's Digital Personal Data Protection Act, 2023), you have the right to access your data, correct it, delete it, receive a copy, object to or restrict some processing, withdraw consent, and nominate someone to exercise your rights if you can't. We don't sell or "share" personal information for cross-context advertising, and we don't treat you differently for using your rights.

• Change your name or colour in the app at any time.
• Leave a circle, unpair or block someone instantly in the app.
• Delete your account in the app under Settings → Delete account. It is instant and removes everything listed above.
• No longer have the app? Use the form at squiggle.tandevs.com/delete-account. We handle requests within 30 days.
• Switch off analytics and crash reports in Settings.
• For any other request, email rajaryan.space@gmail.com. We answer within 30 days. Because accounts are anonymous, we may ask for your account id (shown in Settings → About) to find your data.

If you are unhappy with our answer, you can complain to your local data protection authority (in India, the Data Protection Board of India).

Children

Squiggle is for people aged 13 and older. The app asks you to confirm your age before you start. We don't knowingly collect data from children under 13. If we learn that an account belongs to a child under 13, we delete it. If you believe a child under 13 uses Squiggle, contact us at rajaryan.space@gmail.com.

Security

Connections between the app, the website and our servers are encrypted (HTTPS/TLS). Account tokens are stored only as hashes on our side and in the phone's secure storage on yours. Doodle files are reachable only by circle members or through short-lived signed links. No system is perfectly secure, but we work to protect your data and limit what we keep.

Changes

If we change this policy, we will update it in the app and on our website and change the effective date. For important changes we will tell you in the app.

Contact

Raj Aryan (tandevs), India. Email: rajaryan.space@gmail.com