The appLast updated: October 14, 2026.
1. Data controller
Vision Publishing LLC, 2105 Vista Oeste NW Suite E #3990, Albuquerque, NM 87120, USA, publishes the application. For any questions or requests: contact@hepaly.com.
2. On-device notebooks
The app stores up to four profiles: nickname, age in whole years, avatar, progress, activities and levels, favorites, activity time, flashcards, texts, melodies, drawings and coloring pages. Age determines the activities shown. The salted parental-code hash and device preferences remain local; the code is never sent to our servers. It protects the parent interface without encrypting device storage. Use nicknames and avoid real names, contact details or sensitive information in creations.
3. Optional Parent Account
A parent can create an account or sign in with an email address and six-digit code, with Google, or with Apple on iOS. We process their email address, account ID and stable identifier supplied by Apple or Google. We request only identification and a verified address, not access to contacts, photos, files or messages. The provider processes sign-in under its own policy; Apple may provide a private relay email address.
The email address is encrypted in our database. Email codes, sessions and provider identifiers are protected using cryptographic hashes. An email code expires after ten minutes, at most five attempts, or one successful use. Temporary email and IP hashes limit attempts. Native sessions are stored in iOS Keychain or Android Keystore. Signing in alone never triggers a payment.
4. Saving notebooks, with the adult’s consent
An initially unchecked option lets the responsible adult authorize backup of profiles, ages, progress, favorites, activity time and creations, including drawings and coloring pages. The data is linked to the parent account, transmitted over HTTPS and encrypted at rest on our servers in Germany. It is used only to back up and sync the family across devices, not for advertising statistics or audience analytics. This backup is not end-to-end encrypted.
On a new device, the parent signs in, creates a new local parental code and enables restoration. Changes and deletions sync when the app reconnects. If a conflict cannot be resolved, syncing stops and asks for the parent’s attention. The parent account and its backup can be deleted in the app or on request. Local copies on another offline device must also be erased on that device. Local settings and the PIN are not restored.
5. Discovery period, purchases and Premium access
The seven-day discovery dates are stored separately from the notebook, locally and, when signed in, on the server, so the same end date applies across devices. Erasing a notebook does not restart the discovery period.
Apple, Google, or Stripe for a web offer processes the payment; the app never receives card details. We verify purchase records: transaction IDs, product, plan, available amount and currency, dates, and renewal, refund, revocation or test status. Verified in-app purchases can be linked to the parent account to restore Premium on other devices. For a hepaly.com offer, the order email address, reference and access dates are sent to the account service. Financial records are kept separate from notebook content.
External and Google access require online verification after no more than 72 hours, without exceeding their expiration date. StoreKit also verifies Apple receipts. Deleting the account does not end the payment contract: cancel through the purchase provider.
6. Magic coloring and read-aloud
Magic coloring is disabled until an adult enables it in Parents → Settings. This permission can be withdrawn there. Each new creation also requires a fresh parental code and approval. The prompt, detail level and a random device ID are sent to Hepaly. Only the prompt and detail level are then sent to OpenAI: Hepaly does not send OpenAI any device ID, account, nickname, exact age, notebook or phone IP address. Do not include personal information in a prompt. The prompt and generated result are deleted from the generation server within one hour. Drawings saved to an optional family backup follow that backup’s retention rules. Temporary quotas use the random ID and a hash of the IP address. Neither prompts nor raw IP addresses are logged.
Instructions are read with an offline system voice in the selected app language. No recordings of children’s voices or text for read-aloud are sent to a voice service.
Report a drawing
“Report this drawing” opens a form in the app. After entering the parental code, the adult chooses a reason and confirms sending it. Hepaly receives only a reduced copy of the original drawing and the selected reason: no child’s coloring, prompt, device ID, account or contact details. Our team reviews reports to improve content filters. Reports are stored on our server in Germany, accessible only to authorized operators, and deleted within 30 days. They are not sent to an AI provider. A temporary, non-reversible hash of the IP address limits abuse; no raw IP address is stored in the report.
7. Purposes and choices of the adult
The account, authentication and subscription access are used to provide the requested service. Optional backup, magic drawings and content reports require prior approval from the responsible parent. Security and abuse prevention rely on our legitimate interest; financial records follow legal obligations. Children are never asked for their real name or a social media account. Purchases, external links and settings are in the adult area. Parental controls do not replace explicit consent to backup.
8. Data retention
- Local notebooks: until deleted on the device.
- Account and online backup: until their requested deletion, or daily cleaning after one year without account activity.
- Images removed from backup and abandoned uploads: access is removed immediately; daily cleanup deletes them after at least 24 hours. Service backups: 30 days.
- Connection codes and counters: daily purge, maximum 48 hours; code usable ten minutes. Sessions: maximum 90 days.
- Financial supporting documents and external rights: validity, then at most seven years after expiration; Test purchases: 90 days.
- Apple token required for revocation: encrypted, then erased after confirmation of revocation when deleting the account.
- Sign-in emails: message content is retained for up to 30 days and technical delivery records for up to 180 days. Support correspondence: up to 12 months after the request is resolved.
9. Service providers and transfers
Hetzner hosts the service in Germany. Cloudflare protects and routes connections. Gabriel MTA sends codes and confirmations. Apple and Google provide distribution, the chosen sign-in method and their payments; Stripe processes web subscriptions. OpenAI receives only the magic drawing prompt. Some providers may process data outside the European Economic Area under their applicable safeguards and contractual mechanisms. Our sync service does not send backed-up notebooks to Apple, Google or OpenAI.
10. Your rights and deletion
You can view and export progress, edit profiles and erase data in the parent area. To delete your account and online copy, choose “Our subscription → Delete my parent account” and confirm. Without the app, use our removal procedure. Your request may also concern access, portability, restriction or objection under applicable law. Proportionate identity verification may be needed. We respond within one month. You may contact your data protection authority, including the CNIL in France.
Exported files and system backups remain under your control. Automatic app backup is disabled on Android. On iOS, iCloud and local backups depend on your Apple settings.
11. Security and developments
Connections use HTTPS. Accounts and backed-up images are encrypted at rest. Each family can access only its own notebooks, and each verified purchase record is linked to one account at a time. Account routes do not log notebook content or sign-in secrets. Any new data collection is explained in advance and accompanied by an appropriate choice in the app.