Privacy policy: Extreme Drawing app and website

Who is responsible

Extreme Drawing and this website are made by Game Tailors, the Netherlands. Game Tailors is the controller for the little personal data described below, under the EU General Data Protection Regulation (GDPR).

• Company: Game Tailors (alias Orbit Games)

• Address: Schieweg 15Y-40, 2627 AN Delft, the Netherlands

• Chamber of Commerce (KvK): 92437702

• VAT number: NL866044474B01

• Privacy questions: info@gametailors.com

• Phone: +31 6 4227 5919

The iPhone, iPad and Android apps

The apps don't ask for a name, an e-mail address, a birthday or anything else about your child. There are no accounts, no advertising, no analytics and no third-party trackers.

What stays on the device. Drawings, the page your child is working on, home-made stencils, settings and whether the full toolbox is unlocked are stored in the app's own storage on the device. They are not sent to us. If your device backs up apps (for example through iCloud or Android's backup), saved drawings may be included in that backup, which is between you and Apple or Google.

No internet of its own. On Android the app asks for no internet permission at all. On iPhone and iPad the app makes no network requests of its own.

The painter's voice. The painter who talks to your child speaks recorded lines that come with the game. Nothing your child says or does is recorded or sent anywhere: the game never uses the microphone or the camera. A grown-up can turn the voice off in the settings.

Purchases. The one optional purchase is made through the App Store or Google Play, by a grown-up behind the parent gate. Apple or Google handle the payment and tell the app only whether the full toolbox is owned. Their own privacy policies apply to that payment. To offer the right price, the app asks the store which country it's in.

DEPLAY MAX. On DEPLAY Kids tablets, the Android app asks the DEPLAY MAX app on the same tablet whether the family's DEPLAY MAX subscription covers Extreme Drawing, and keeps that yes or no on the device. The question stays on the tablet; nothing about your child is in it. This only happens on DEPLAY tablets.

Saving pictures. When a grown-up saves a picture (behind the parent gate), the device's own share sheet opens and the grown-up chooses where it goes.

The browser version (play.extremedrawing.com)

The browser version stores drawings, settings and any unlock in your browser on your device, not with us. It sets no tracking cookies and loads nothing from advertising or analytics services; its fonts, sounds and pictures come from its own address. What it keeps in your browser (drawings, settings, and after a purchase the licence and the restore code) is needed for the game to work, and goes when you clear the site's data.

Buying in the browser. If a grown-up buys the full toolbox in the browser, the payment page is run by Stripe. Stripe processes the card or other payment details, the country and the e-mail address for the receipt. We see the purchase in our Stripe account (the e-mail address, the amount, the country and the restore code), but not your full card details. The receipt e-mail contains the restore code.

The game talks to our licence server at play.extremedrawing.com only for the purchase: to show the price, start the payment, collect the licence, restore it with a code, and check about once a week that the payment still stands (for example, that it wasn't refunded). For that it sends the payment's reference, the licence or the restore code, never anything about your child.

Internet addresses. Like every website, the browser version receives your device's internet (IP) address with each request. We, and Cloudflare for us, use it only to deliver the game, to keep it secure and to limit how many purchase requests one address can make per minute. It is never used to contact anyone, to build a profile or to show ads. We have not switched on stored request logs for the game. Whether the browser version sells the full version where you are (in the EU, Norway, Iceland and Liechtenstein) is decided from the country Cloudflare reads from your internet address; that country is not stored.

This website (extremedrawing.com)

This website uses no tracking cookies and no analytics, and shows no ads. It loads no fonts or scripts from other companies.

Like any website, the servers that deliver these pages may keep technical logs, which can include your IP address, for security and to keep the site running. The website is hosted with Google Firebase Hosting, which keeps IP addresses for a few months to detect abuse.

What we use, why, and for how long

• Web purchase (e-mail address, country, amount, restore code, payment reference): to sell and deliver the full toolbox and send the receipt; legal basis: the contract (GDPR art. 6(1)(b)). Kept for 7 years, because Dutch tax law requires us to keep our sales records that long.

• Withdrawal (your name, if you give it, and when you withdrew): to refund the purchase and to show we did; legal basis: our legal duty to take the withdrawal (art. 6(1)(c)). Kept with the payment record, as above.

• Licence, restore and weekly check (payment reference, licence, restore code, IP address): to deliver what was bought and to stop a refunded licence; legal basis: the contract. Not stored by us beyond the payment record above.

• Security and rate limits (IP address): to keep the game and the payment safe; legal basis: our legitimate interest in a secure service (art. 6(1)(f)). Held only for the minute the limit counts, plus whatever Cloudflare keeps for its own security.

• E-mails you send us (your e-mail address and what you write): to answer you; legal basis: our legitimate interest in answering, or the contract. Deleted when they are no longer needed, at the latest two years after the last contact, unless they are part of the sales records.

Who else is involved

• Stripe (Stripe Payments Europe Ltd. and Stripe, LLC) processes web payments for us. For fraud prevention and its own legal duties, Stripe decides itself how it uses the data; its privacy policy applies to that.

• Cloudflare delivers the browser version and runs our licence server.

• Google Firebase Hosting delivers the website.

• Apple and Google sell the apps and the in-app purchase under their own privacy policies.

Stripe, Cloudflare and Google may process data in the United States. They are certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), and the EU's standard contractual clauses apply as a fallback.

Children

Extreme Drawing is made for children aged about 4 to 10. We do not knowingly collect personal information from children, in the app, in the browser version or on this website. Anything a child makes stays on the device. Purchases, settings and links out of the app sit behind a parent gate meant for grown-ups. Apart from the internet address that every device sends to every website, which we use only as described above, the game collects nothing from a child.

Your rights

Under the GDPR you can ask us what personal data we hold about you, ask us to correct or delete it, object to or restrict its use, and ask for a copy. Because the app and the website collect next to nothing, there is usually nothing to return. For a web purchase, we can look up what Stripe holds for us. For a child under 16, a parent can make these requests.

E-mail info@gametailors.com. We answer within one month. If you're not happy with our answer, you can complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; in the United Kingdom, the ICO.

Changes to this policy

If the app or the website starts handling data differently, we'll update this page before the change takes effect and change the date below.

Last updated: 24 October 2026.