Privacy Policy
Effective date: 2026-10-17
MKLabs (엠케이랩, represented by Minkyung Ha) ("we") operates Little Canvas Tales (the "Service"), a mobile app that uses generative AI to turn a drawing you upload into an illustrated Korean/English story. This policy explains what we collect, why, and your choices.
1. Who the Service is for
The Service is intended for adults (parents and guardians), not for children. We do not knowingly collect personal information directly from children under 14 (or under the age of digital consent in your country). If we learn that a user is underage, we will remove the account and related data.
You may upload a drawing made by your child. By doing so you confirm you have the right to upload and process it. Please do not upload photos of faces, real names, or contact details. If your child wrote a name on a drawing, that drawing is processed as-is.
2. Information we collect
| Category | Data | Required |
|---|---|---|
| Account | Email address, user ID | Yes |
| Content you provide | Uploaded drawing; selected theme, age range, language; child's name or nickname | Drawing: yes (to generate). Name: optional |
| Generated content | Story text, illustrations, titles created by AI | Needed to provide the Service |
| Reports | Reason, any comment you write, and the story text at the time of the report (drawings are not copied) | Optional (only if you report) |
| Purchases | Product bought, time, credit balance changes, subscription status. Payment card details are handled by Apple/Google; we never receive them | When you buy |
| Automatic | Server logs (IP address, timestamps, device/OS type), error logs | Yes |
We currently do not use advertising identifiers or behavioral analytics. We will update this policy before that changes.
3. How we use it
To sign you in; to generate and store your stories; to manage credits, subscriptions and refunds; and to keep the Service secure and reliable. We do not use your drawings or stories for advertising, marketing, or to train our own AI models.
4. Service providers and international transfers
We use the following processors. Your data is therefore processed outside your country, including the United States. Our database and file storage are hosted in Seoul, South Korea; our provider (a foreign company) may access them remotely for administration. Data is sent over encrypted connections.
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Authentication, database, file storage | Email, user ID, drawings, stories, purchase/credit records |
| OpenAI | AI analysis of the drawing; story text and illustration generation | Drawing, theme/age/language, child's name if entered |
| Resend | Sending sign-in emails | Email address |
| RevenueCat | Managing in-app purchase and subscription status | User ID, purchase details |
| Apple / Google | Processing in-app payments | Payment details (we receive only the purchase result) |
| Railway Corp. | Running our API server | Server logs, request data in transit |
Data sent to OpenAI through its API is, under OpenAI's API policies, not used to train its models by default and may be retained for up to 30 days for abuse monitoring (longer where required by law). We do not sell your personal information.
5. Retention
Account data, drawings and stories: until you delete them or your account (backups, if any, purged within 30 days). Purchase and credit records: kept for 5 years where required by law, then deleted. Reports about AI results: kept for 1 year after handling (disconnected from your account if you delete it). Server logs: 3 months.
6. Your rights
You can access, correct, delete, or export your data, object to or restrict processing, and withdraw consent. In the app: Settings > Delete account removes your account, drawings and stories, and you can delete individual stories from My Stories. Otherwise email us at [email protected] and we will respond within 30 days. If you are in the EEA/UK, our legal bases are contract performance (providing the Service), legal obligation (purchase records), and legitimate interests (security); you may also lodge a complaint with your local data protection authority.
7. Security
Encryption in transit (TLS); row-level access control so users can only read their own data; API and service keys kept server-side only; least-privilege access; drawings and illustrations are stored privately and served only through short-lived signed links.
8. AI-generated content
Stories and illustrations are generated by AI and may be inaccurate or differ from your original drawing.
9. Changes and contact
We will notify you in the app or by email before material changes take effect. Contact: Minkyung Ha, CEO, [email protected], L-901, 37 Gimpohangang 10-ro 133beon-gil, Gimpo-si, Gyeonggi-do, Republic of Korea.