Privacy Policy

Last updated: August 2026

The short version

What we collect

You can browse and create without an account. If you choose Google sign-in, Doodle AI receives the basic profile information Google shares for authentication, such as your name, email address, and profile image. We also create authentication and session records so you can stay signed in securely.

When you are signed in, we store the Doodle AI content needed to sync your workspace: chat thread metadata and messages, generated-image references, saved moodboard items, saved characters, and generation metadata such as the selected skill, prompt, status, and credit usage. This content is scoped to your account.

What stays in your browser

• Signed out: chats and interface preferences may remain in your browser's local storage, but image generation and uploads require a signed-in account.
• Signed in: your browser keeps a local mirror so the interface is responsive, while supported chats, boards, characters, and generation data are synchronized to your account for access on your other devices.
• Credentials: Provider credentials stay on the server and are not sent to your browser.

How your content is processed

When you send a chat message, the message and relevant conversation context are sent to the language model service that powers the Doodle AI agent. When you attach a photo or request an image, the photo, reference assets, prompt, and generation settings are sent to PicX through Doodle AI's server-owned connection. PicX hosts the resulting media and returns URLs that Doodle AI can display or save. Each generation is charged against the signed-in account's credit balance.

Do not upload anything you do not have the right to use. The privacy practices of PicX and the model provider also apply to the information you send to those services.

Who helps run Doodle AI

• Cloudflare — hosts the site, API, D1 database, and session storage.
• Google — provides optional Google OAuth sign-in. See Google's privacy policy.
• PicX — processes image-generation requests, manages uploaded assets, and hosts generated media through Doodle AI's platform account.
• OpenRouter — routes chat requests to the language model used by the Doodle AI agent.
• DataFast — provides website analytics about visits, referrals, pages, and general device, browser, and country-level information.
• Mixpanel — provides product event analytics (sign-up, generation, skill usage), user profiles, and session replay (a playback of your on-screen activity, used to diagnose bugs and confusing steps). See Mixpanel's privacy policy.
• Google Analytics — provides traffic analysis, session measurement, and audience insights. See Google's privacy policy.

Analytics and cookies

We use three analytics services to understand how people find and use the site:

• DataFast — pageview analytics (visits, referrals, device and country info). Uses cookies to recognise returning visitors.
• Mixpanel — product event tracking (sign-up, generation, skill selection) and anonymous user profiles linked by internal ID. Uses localStorage, not cookies.
• Google Analytics 4 — traffic sources, sessions, engagement, and audience demographics. Uses cookies (_ga, _ga_*).

We do not run advertising pixels, participate in an ad network, or sell analytics data. You can block or clear analytics cookies in your browser settings; the site should continue to work without them. See each provider's privacy policy linked above for their processing details.

Session replay

While Doodle AI is in beta we record session replays through Mixpanel. A replay is a reconstruction of what happened in your browser — the pages you moved through, where you clicked and scrolled, the prompts and skills you chose, the doodles that came back, and any error messages you saw. We watch these to find steps where people get stuck or where generation fails, and to fix them.

• What is recorded — page structure and on-screen content, mouse and touch interaction, browser console messages, and the timing and status of requests our own app makes.
• What is never recorded — password, email, telephone and hidden form fields, and any field your browser treats as autofill, are masked by Mixpanel and cannot be revealed by our configuration. We do not record the contents (bodies) or authentication headers of network requests, so your session cookie and access tokens are not captured.
• Where it is stored — with Mixpanel, and deleted automatically 30 days after it is recorded. Short-lived recording data is held in your browser's IndexedDB under keys prefixed __mprec_ until it uploads.
• Who can watch it — only signed-in members of the Doodle AI Mixpanel project.
• Opting out — replays are not captured if your browser sends a Do Not Track signal, and blocking Mixpanel (via browser settings or an extension) stops recording without affecting the rest of the site.

Server logs and security

Our hosting and security providers may process standard request information such as IP address, user agent, timestamps, and request details to deliver the site, maintain security, and investigate abuse. We do not use server logs to build advertising profiles. No internet service can guarantee absolute security, but we use access controls and account scoping to protect stored data.

Retention and deletion

Children

Doodle AI is not directed at children. If you believe a child has provided personal information to us, please contact us so we can review and remove it where appropriate.

Changes to this policy

If our data practices change, we will update this page and the date at the top. Your continued use of Doodle AI after an update means you acknowledge the revised policy.

Contact

Privacy questions or deletion requests: yash@picxstudio.com