Draft — pending legal review. Last updated 16 October 2026.

Privacy Policy

Pibbly is made for parents, so we keep things simple: we collect as little as we can, we never sell your data, and you can delete everything whenever you like.

Who we are

Pibbly (heypibbly.com) is run by Harrysson Invest OÜ, a company registered in Estonia (registry code 16125264, address Soo 19-2, 10414 Tallinn, Estonia). We are the “data controller” for your personal data. Questions about privacy? Email hello@heypibbly.com.

Pibbly is for grown-ups

Accounts are for adults (18+) only, usually parents, carers or teachers. Children don’t get accounts and we don’t knowingly collect data from children. Please don’t put a child’s full name or other identifying details into prompts. A first name for a birthday page is fine, but you don’t need it.

What we collect and why

• Your email address: to log you in with a magic link and send messages about your account. (Legal basis: contract.)
• Your prompts and the pages we make: to create, store and show you your coloring pages. Prompts are checked for safety before an image is made. (Contract; legitimate interest in keeping the service safe.)
• Subscription and payment details: plan, status and billing history, handled by Stripe. We never see or store your full card number. (Contract; legal obligation under accounting law.)
• Anti-abuse data: a random ID in a cookie and a one-way hashed version of your IP address (we never store the raw IP), used to enforce the 3 free pages and stop abuse. (Legitimate interest.)
• Basic technical logs kept by our hosting providers for security and troubleshooting. (Legitimate interest.)

We don’t use your data for advertising, we don’t sell it, and we don’t use your prompts or pages to train AI models.

Who helps us run Pibbly

We use these trusted service providers (“processors”), each bound by a data-processing agreement:

• Supabase: database, login and image storage, hosted in the EU.
• OpenAI: receives your prompt to check it for safety and to generate the image (USA).
• Stripe: payments and subscription management (Stripe Payments Europe, Ireland, plus the USA).
• Vercel: website hosting (global network, including the USA).
• Resend: sends login and account emails (EU region).
• Cloudflare: domain name (DNS) services.

When data goes outside the EU/EEA, we rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

How long we keep things

• Your account, prompts and pages: kept while your account is open. When you delete your account, your pages, prompts and image files are deleted straight away (and any subscription is cancelled). Copies in our database provider’s backups disappear within 7 days.
• Free pages made without an account: deleted automatically, image files included, 12 months after they were made. If you sign up in the same browser before then, they move into your account instead.
• Anti-abuse data (the random device ID and hashed IP stored with each page): deleted automatically after 12 months.
• Billing records: 7 years, as Estonian accounting law requires.

A cleanup job runs every day to carry out these deletions.

Cookies

We only use cookies that are strictly necessary for the site to work, so there’s no cookie banner:

• a login session cookie (lasts 30 days)
• a free-page counter cookie, holding a random ID (lasts 12 months)
• cookies Stripe sets on its checkout and billing pages, for payments and fraud prevention

We don’t use analytics, advertising or tracking cookies. If that ever changes, we’ll ask you first.

Your rights

Under the GDPR you can ask to see, correct, delete or export your data, and you can object to or limit how we use it. You can delete your account and all your pages yourself on your account page, or just email hello@heypibbly.com. We’ll answer within one month.

If you’re not happy with how we handle your data, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority where you live.

Security

All traffic is encrypted (HTTPS), images are kept in private storage, and access to data is restricted.

Changes

If we make important changes to this policy, we’ll tell you by email or on the site before they take effect.