Privacy
Controller
Nicolas LanquetinHumboldtstr. 1176131 KarlsruheGermany
Email: info@colorwombat.com
Website and hosting
Page requests transmit IP addresses and technical connection data to the server and potentially the hosting provider.
Hosting provider:OVH GmbH (OVHcloud)Oskar Jäger Straße 173/K650825 KölnGermany
Server region: Frankfurt, Germany.
Technical operational and error logs support secure operation and troubleshooting. They may also contain IP addresses or requested URLs.
The server configuration checked so far uses size-based rotation for operational and error logs from the application and front-end web server: older log files are removed when size and file-count limits are reached. This limits storage space, not the age of entries. Automatic deletion after a fixed period has not currently been verified for these logs; older entries may remain longer when usage is low.
For necessary personal operational and security logs under our control, we have set a period of seven days from the event. Complete technical enforcement across all affected systems has not yet been verified. Only necessary evidence of a specific incident is intended to be kept separately until at most 90 days after that incident closes, with a monthly review of continued need.
According to OVHcloud support, scrubbing-centre logs are retained for one year and traffic-chart data for two months in the described network-protection context. The routing metadata, source IP addresses, flow counters and packet-level information processed by network devices in this context are, according to support, processed only in real time, not stored and discarded when the mitigation or routing operation ends. OVHcloud acts as an independent controller for network protection. This statement concerns the named network-protection data, not all OVHcloud data or our own application and system logs.
An HttpOnly cookie associates private results with your browser, generally for 30 days. Protected access grants and moderator sessions use additional time-limited access records. Clearing site data can remove access to your private pictures; it does not delete pictures on the server.
Generation with OpenAI
Real generation sends your description, style, difficulty and derived image instructions to OpenAI. Input and generated pictures undergo content checks there. A picture preview is also sent to create a title and description. PDF conversion runs on the application server. Image test mode uses fixed examples without these generation requests.
The provider under the standard API terms applicable to Germany is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. These terms incorporate the Data Processing Addendum (DPA).
The project data region is “Global”. Data may also be processed in the United States and other countries in the sub-processor list linked below; processing is not restricted to the EU.
Under the API terms, OpenAI does not use customer content for training or improving its services without explicit agreement. Data sharing for feedback, evaluations/fine-tuning, and inputs and outputs is currently disabled.
For image generation, titles and descriptions, abuse monitoring logs may generally be retained for up to 30 days, with longer retention where legally required or necessary for safety. Image inputs suspected of containing child sexual abuse material may be retained for manual review. For the separate moderation service, OpenAI lists no abuse monitoring or application-state retention.
Response storage for later API retrieval is disabled for titles and descriptions. This does not remove abuse monitoring logs or promise that no data is retained.
For transfers from the EEA to third countries, the DPA provides for EU Standard Contractual Clauses or an applicable adequacy decision. Public contract information and sub-processors are linked below. You can request information about the safeguards or a copy from privacy@openai.com; you can also send questions to our privacy contact given above.
Stored results and retention
The application server stores job status, review decisions, settings, image files and usage records. Your private template contains the original description and settings. Only the authorized creator can retrieve it, including when the picture is published.
Inactive, unpublished results generally expire 30 days after creation. Private templates, including those for published pictures, can be retrieved for at most 30 days from job creation; after that, the original description can no longer be reused as a template. The application checks cleanup at startup and hourly thereafter. Ongoing processing is not interrupted by file deletion; shutdowns or errors may delay removal. Published pictures remain until editorial removal.
When operational timing is enabled, durations of real generations are stored for up to 30 days for technical planning. They are visible only in protected administration.
New jobs record the accepted Terms version with the job association and creation time, without an additional IP address or device profile. We have set a period of 90 days after final job completion for these personal records; for published pictures, that period starts on removal from the catalog. The application includes cleanup on initialization and hourly during operation. Unresolved execution and open review cases are handled separately. Migration of older operational and test records is not yet complete. Deleting a record does not end usage permissions already granted.
According to OVHcloud support, when a new backup completes successfully, the previous backup is deleted immediately as part of rotation. If new backups fail, the last successful backup remains available without a time limit until a successful new backup replaces it or the backup option is disabled. We therefore cannot guarantee a fixed maximum retention period. The statement does not establish secure physical erasure of all replicas. Deletion from the active data store does not mean that every backup copy is deleted at the same time. Previously deleted images may reappear after a backup is restored.
Only when a new creation job is actually recorded do we also store the statement “18 or older”, the access-policy version and its designation as a self-declaration with that job. This is not age or identity verification or evidence of parental permission. No date of birth, identity document, face or parental contact is collected for this purpose; the age statement is not sent to OpenAI. Existing jobs receive no retrospective age record. The same 90-day rule and stated migration limitations apply to this record as to other minimal job records.
Creation is restricted to adults. This does not technically prevent someone from entering personal information about children or other people. A limited local input check does not reliably detect such information. Content checking at OpenAI already sends the text to OpenAI and is not a prior local privacy check. Use only fictional scenes without personal information.
Storage in your browser
In a normal browser, your 18+ self-declaration and acceptance of the current Terms apply only to the open Create page. These confirmations are not saved in cookies or browser storage. After reloading, reopening or restoring a previously abandoned page, you must confirm both again. Further pictures on the same open page do not require repetition; merely changing focus or tabs does not reset them.
Only in a view recognized as a standalone web app do we additionally offer the initially disabled choice “Remember on my personal device”. Only after you explicitly select it and confirm both required statements do we save your 18+ self-declaration, the Terms and declaration versions and the storage choice together locally. This record lasts until reset, website-data deletion or a relevant new version. It contains no date of birth, personal identifier, description or picture. The normal website never adopts it, even when storage is shared. App mode proves neither age nor identity or exclusive device use; other people with access to the app can use the record.
You can reset both statements in the expandable confirmations. In the web app this also revokes its record; a fixed non-personal reset marker may remain in storage. Storage errors never automatically grant access and are shown. If both overwriting and deletion are blocked, both statements remain blocked here; an old record can nevertheless return after reopening the app. In that case, clear website data in browser settings. Earlier Terms records are neither adopted nor automatically deleted; existing job evidence remains unchanged.
Tab session storage can contain your unsent description, style, difficulty, an active request identifier and navigation positions. Merely opening an unchanged Create form does not create a new draft; existing drafts are restored without being saved again. Changes to the form are still saved automatically within the tab. Successful submission clears the unchanged draft; you can erase the text yourself. Its lifetime depends on the browser, including possible session restoration.
For new visits without existing offline support, the web app no longer creates its own offline cache. Existing ColorWombat offline support, including update checks, is preserved. Its cache contains two generic information pages, in German and English, with no pictures, PDFs, jobs or API responses. Without that existing support, your browser displays its own offline message when disconnected. Your browser may also use its ordinary cache. Search and coloring-pack selections may appear in the page address and be disclosed when you share a link.
Optional voice input
ColorWombat requests only on-device speech recognition. Dictation does not start without support for this mode; no automatic fallback to cloud recognition is provided. ColorWombat does not store audio recordings. Recording is requested only after the separate notice and your start action. Browser microphone permission is separate.
The notice acknowledgment lasts only within the open Create form and is not stored persistently. Resetting it under Voice input information also aborts an active recording. Confirmed text remains; provisional text and later results are discarded. Old persistent notice records are no longer read; you can remove any existing old values by deleting site data. Recognized text is treated like a typed draft. You can always type instead.
On-device recognition requires matching browser, system and language support. ColorWombat does not automatically download language packs. You can still type if support is missing or an error occurs. The local-only controls have so far been tested with simulated browsers; actual device and data-route checks and legal approval remain open. Your device keyboard’s microphone feature is outside these ColorWombat controls.
Catalog measurement and picture reports
Optional catalog measurement is disabled. New visibility and PDF selection events are not collected. Stored measurement data use a 24-hour browser identifier and aggregate daily counters for up to 28 days.
Picture reports contain the picture identifier, reason, optional text of up to 300 characters and a pseudonymous browser association. They are stored on the protected server for editorial handling. This channel does not send email replies; use the contact in Operator details for a reply.
The application includes a cleanup function for closed picture reports: 90 days after documented closure, the report and its associated handling records are removed from the active data store during the next successful cleanup. The check runs when the application store is initialized and hourly thereafter while running. Downtime or an error delays deletion. Open or reopened reports are not deleted; a new closure starts the period again. This rule does not limit retention in backups.
Legal bases
For the picture creation and private delivery you request, we process the necessary information under Article 6(1)(b) GDPR where a valid agreement for free use exists with you. This does not automatically cover publication, training, measurement or information about other people. Picture creation is restricted to adults. An adult creating a picture for a child does not automatically permit processing personal information about that child.
Technically necessary catalog delivery, access security and abuse prevention rely on Article 6(1)(f) GDPR where processing is necessary and your interests and fundamental rights do not override it. Our interests are reliable operation, protecting private results against unauthorized access, and preventing abusive generation requests and disruption. This does not permit unlimited logging; the unresolved retention periods described above still need clarification.
For limited server-side operational timing, we are assessing Article 6(1)(f) GDPR to identify technical bottlenecks and provide progress estimates. Measurements are linked to jobs and are therefore not considered anonymous. Current activation, necessary data scope, the legal justification for the technically configured 30-day retention, and the balancing of interests have not been fully established. This does not approve the separate catalog measurement, which remains disabled.
To handle your data protection rights, we process the necessary information under Article 6(1)(c) together with Articles 12–22 GDPR. Any necessary check that the relevant data can be attributed to you must remain proportionate; this does not create a general requirement to submit an identity document.
Optional voice input is intended to rely on prior, voluntary and informed consent under Article 6(1)(a) and Article 7 GDPR. Typing remains available. Microphone permission alone is insufficient. Requiring on-device recognition does not replace the pending review of the actual data route and legal basis. “Stop recording” ends recording; “Reset acknowledgment” also aborts it and removes acknowledgment within the open form. Confirmed text remains. Withdrawal takes effect for the future; you can send questions to our privacy contact.
Storing or accessing information on your device is also subject to Section 25 TDDDG, including information that is not personal data. The exception in subsection 2, no. 2 can apply only to strictly necessary access, security and job assignment functions, and necessary session state for a function you expressly request. The content, timing and duration must each be necessary.
The 30-day browser assignment, persistently remembered Terms acceptance and the voice acknowledgment limited to the open form, automatic draft and navigation storage, and existing offline support with its update access still require individual assessment. They are not all exempt from consent. We intend to use non-essential additional features only after consent under Section 25(1) TDDDG and, where personal data is processed, Article 6(1)(a) GDPR. This is our planned model; device access and personal data processing require separate legal assessments. Such an additional consent mechanism is not currently implemented.
Permission to use a picture does not automatically permit publication of personal data. Personal content is not published without a separate valid basis.
Your rights
Subject to statutory conditions, you may request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Separate consent may be withdrawn for the future without affecting the lawfulness of earlier processing.
Use the contact in Operator details. If your browser association is lost, proportionate proof of entitlement is required. You may complain to a data protection authority, particularly where you live or where an alleged infringement occurred. For the operator in Baden-Württemberg identified here: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (state data protection authority), Postfach 10 29 32, 70025 Stuttgart, Germany, poststelle@lfdi.bwl.de. The complaint route is linked below.
Your description and necessary technical data are required for the requested generation. Without them it cannot proceed. This workflow makes no solely automated decisions with legal or similarly significant effects. Content filters can refuse generation.