How we handle your data

Applies from 31 October 2026.

This is a translation. The Swedish text is the one that applies.

In short

• We keep your email address so that you can sign in. You have no password.
• Everything we keep is on our own server in Sweden, with encrypted backups within the EU.
• What you ask us to draw is sent to an AI service in the USA, which draws the pictures. Do not write names or anything else about yourself or anyone else in it.
• We use every picture drawn here, and what you wrote to get it, to train our own AI model.
• No ads, no tracking and no cookies other than the one that keeps you signed in.
• You can delete your account yourself whenever you like, under Settings in your account.

Who is responsible?

Pyssly is run by Adinosaur AB (company registration number 559352-9364), the company behind 2Fivers. We are responsible for your data. Send questions to [email protected].

What do we keep?

• Your email address, when the account was created and when you last signed in. The account is created when you confirm the address with the link we send when you register, not before.
• The emails we send. For every confirmation or sign-in email we keep the address it was sent to, when, and the link and code in a form that can only be compared with, not read back. A confirmation link works once within 24 hours, a sign-in code or sign-in link once within 15 minutes.
• Your sign-in. A cookie in your browser with a random code, and the same code on the server in a form that cannot be read back. It lasts 30 days or until you sign out. With each sign-in we also keep which browser and system it was made from (such as "Chrome on Windows"), the country and when it was last used, so that you can see where you are signed in and sign out what you do not recognise. We do not keep the IP address there.
• What you ask us to draw, in the words you wrote, and the pictures you got.
• Your favourites and what you like: which of your pictures you have made favourites, and which pictures in the gallery you have liked.
• We do not keep photos. If you redraw a photo as a colouring page (so far only for us who run the service), the photo is sent to the AI service that draws and is with us only while the pictures are drawn. The colouring page is kept like your other pictures, and it may look like the photo. Pictures from photos are never shown in the gallery.
• Your crayons: how many you have been given and used, and when. If we give you crayons, we also keep how many, why and which of us gave them.
• Invitations. Your account can have an invitation link of its own. If someone registers with it, we keep that their account came through yours until they have drawn their first picture and you have both had your crayons. Then we remove the link between the two. We count how many have made an account with your link and how many crayons it has given you, and show you that, but only the numbers. The one who invited is never told who registered.
• If you share a picture with your own phone or computer, or download it, we are not told where it goes.
• Private links. You can make a private link to one of your pictures. Whoever has the link can see, print and download the picture, but not what you wrote or that it is yours. We keep that the picture has a link until you turn it off or delete the picture.
• Pictures you send by email through us: we send an email with a link to the picture, and the email says it comes from your email address. We use the recipient's address for that one email only and do not keep it. We only keep when you sent one, so that nobody can send any number of them.
• How many times a picture has been seen in the gallery and through a private link, per day. We keep nothing about whoever looked. So as not to count the same visitor more than once, the server holds the visitor's IP address in memory for at most half an hour, without keeping it. Your own looks and ours are not counted.
• The language you use the site in, or the one you chose for the emails, so our emails are in it.
• Your purchases, if you buy crayons: which package, the price, when, how the payment went, the country of your billing address and that you confirmed you are 18. We never see the card details; Stripe handles them.
• Technical logs, for example IP address and time, to keep the service running and stop misuse.

We do not ask for your name, your age or anything else about you, except what Stripe needs to take payment when you buy crayons.

Why?

We use your email address so that you can sign in and use the service, and what you write to draw and keep your pictures, that is, to fulfil our agreement with you (the terms). We keep purchases because Swedish bookkeeping law requires it. The logs, the limits on how many links can be sent and the backups are there to keep the service safe and running, and the list of crayons we have given so that we can keep track of which of us gave away what, which is our legitimate interest. We keep the link between an invitation and the account it brought so that we can give you the crayons the terms promise. Private links and the emails you send are there because you asked for them, and counting views is our legitimate interest, as is using the recipient's address for the one email you asked us to send. We also use the pictures and what you wrote to get them to train our own AI model, so that we can draw the pictures ourselves instead of sending what you write to someone else. That too is our legitimate interest.

Where is the data, and who else sees it?

• Our own server in Sweden, where the database is.
• We who run Pyssly can see what you asked us to draw and the pictures, to choose pictures for the gallery and stop misuse. Where we look at them, it does not say whose they are.
• Everyone who visits the site can see and print the pictures in the gallery on the front page. A picture ends up there only if you have allowed it and we have chosen it, and it is shown without what you wrote and without anything that says it is yours. Everyone sees how many like a picture in the gallery, but nobody sees who, and nobody else sees your favourites. If you take the permission back it disappears from the gallery at once, but someone who has already opened it may keep it for a while in their browser, and a printout of course remains. Everyone also sees how many times a picture in the gallery has been seen.
• Whoever has a private link can see, print and download that picture, and pass the link on. If you turn the link off it stops working at once.
• Backups are made every night, encrypted and kept by a storage service within the EU.
• An email service from an American company sends the sign-in emails and the pictures you send by email, and therefore gets your email address and the recipient's. We have turned off all tracking in the emails.
• An AI service from an American company draws the pictures and therefore gets what you wrote, and the photo when a picture is drawn from one. It may keep it for a while to detect misuse. It does not get your email address or anything else about you, and does not learn who wrote it.
• A network that protects the site from attacks, also from an American company, stands between your browser and our server and therefore sees your IP address and which pages you visit.
• Stripe takes the payment when you buy crayons and therefore gets your email address, your name, your billing address and your card details. Stripe is itself responsible for them under its own privacy policy, and may transfer them to the USA.

When data goes to the USA it does so under the EU–US Data Privacy Framework or the EU's standard contractual clauses. If you want to know which the companies are, write to us and we will tell you. We never sell data and do not hand it to anyone else.

Our own AI model

We use every picture drawn on Pyssly, and what was written to get it, to train an AI model of our own, which is to draw the colouring pages here. From them the model learns which words go with which pictures. What it is trained on does not say who wrote it, and the model is ours and used only by us. It is no collection of the pictures or the words and shows them to no one, but what it has learnt from them stays in it. If you delete a picture we remove it and what you wrote from what we train on, but what the model has already learnt from them cannot be removed. That is one more reason not to write names or anything else about yourself or anyone else.

Write nothing about yourself

What you ask us to draw is sent to the AI service that draws and kept by us. So do not write names, addresses or anything else about yourself or anyone else. Write "a boy playing football" rather than "my brother Charlie playing football": the picture turns out just as nice.

For how long?

• Your account stays until you delete it.
• What you asked us to draw and the pictures are kept until you delete them or your account. What our AI model has learnt from them stays in it.
• What you have liked is kept until you stop liking it, the picture is deleted or you delete your account.
• A private link lasts until you turn it off or delete the picture, and how many times a picture has been seen is kept for as long as the picture exists.
• When you sent pictures by email is kept until you delete your account.
• We delete accounts that have not been used for 24 months, after first sending a reminder to the email address.
• The data about confirmation and sign-in emails is deleted two days after they were sent.
• Sign-ins stop working after 30 days, or when you sign them out. The browser, system and country we kept go with them.
• Purchases are kept until the end of the eighth calendar year after the purchase, as the books require, even if you delete the account. They are then kept without any link to you.
• Crayons we have given you stay in our list of crayons given, even if you delete the account. It then no longer says who they went to, only how many, when, why and which of us gave them.
• Technical logs are kept for at most 30 days.
• Backups are kept for up to a year. What you delete therefore stays in them until the old copies disappear, but we use them only to restore the service if something has broken.

Children

You must be at least 13 to have an account of your own. Younger children can draw with an adult's account, and then it is the adult's email address we keep.

Your rights

You have the right to know what data we have about you, to have mistakes corrected, to have it deleted, to get a copy of it and to object to how we use it. You delete the account yourself under Settings in your account; everything else you ask for at [email protected]. If you think we are doing something wrong, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Cookies

We use a single cookie, the one that keeps you signed in. It is needed for the service to work, so we do not ask for permission for it. Your browser also remembers whether you were signed in last time, so that the menu shows the right button at once. It is only a yes, it stays in the browser and goes when you sign out. We have no cookies for statistics or ads.

Changes

When the service changes we change this text, and the date at the top shows when that happened.