Privacy policy draft

1. Who operates WonderWords

WonderWords is the product name used at wonderwords.space. Owner review required: the operator's legal name, business address where required, country, data-controller details, and a monitored privacy contact have not been confirmed. This draft does not establish a jurisdiction or legal basis for processing.

2. Accounts and authentication

The application uses Supabase Auth for email/password accounts, verification and recovery flows, and Google sign-in when the provider is enabled. Account records can include an email address, user identifier, profile details, plan, and credit balance. Google sign-in exchanges account information through Google and Supabase. Authentication sessions use cookies or browser storage as provided by the integration. WonderWords uses Supabase's authentication APIs rather than storing passwords in its own custom password table.

3. Prompts, generated content, and saved projects

Using a generator sends your prompt and requested settings to the application's server. The reviewed implementation uses Anthropic for text generation and fal.ai for image generation, with an OpenAI image adapter available as an alternative. Which provider and model are active depends on deployment configuration. Avoid names, health information, private photographs, or other sensitive details in prompts unless you have a clear reason and appropriate permission.

Project records, generation status, text, image references, credit transactions, and saved creations can be stored in Supabase's database and storage services. Some generator previews are also restored from browser local storage. The application does not demonstrate a universal automatic deletion schedule.

The reviewed generated-image storage helper returns public URLs from the session-images bucket. A generated image may therefore be accessible to someone with its URL even when its project record is account-protected. The owner must confirm the actual storage access settings and disclosure before finalizing this policy. Do not generate or upload sensitive personal content on the assumption that a saved account project makes every associated image private.

4. Images and PDFs in WonderStudio

Ordinary personal files selected through WonderStudio's Open file control are decoded and colored locally in the browser. PDF pages are rendered with PDF.js. Colors are preserved while navigating pages in the current session; downloading a PNG creates a file on your device. Opening a remote asset fetches its URL and can expose network information to its host. Owner/admin gallery publication is a separate action that uploads assets to storage for public access. It is not part of ordinary personal file coloring.

Do not interpret this local-file behavior as a claim that all WonderWords content stays on your device: AI requests, accounts, saved projects, gallery assets, and external image URLs use networked services.

5. Payments and credit records

The application integrates Lemon Squeezy checkout and subscription webhooks. Billing events can contain identifiers, account email, subscription status, and plan information used to associate purchases and credits with an account. Payment details are entered through the checkout provider. The reviewed code does not implement its own card-entry form. The operator must confirm the checkout provider's current role, payment-data handling, retention obligations, and applicable customer rights.

6. Cookies and optional analytics

Essential authentication state supports sign-in and protected routes. The existing preference cookie, ww_consent, records an analytics decision with a configured duration of 180 days. Google Analytics and PostHog integrations load only after acceptance and only when their respective configuration is present. The owner must confirm whether either service is active in production, its event configuration, storage duration, and any PostHog recording or autocapture settings.

Vercel Web Analytics measures page views after you accept optional analytics. This integration removes query strings and fragments from page URLs, excludes account and authentication pages, and does not send custom events or user identifiers. Vercel describes its Web Analytics as cookie-free; its event processing can include page URL, referrer, approximate location, and browser/device information. The owner must confirm dashboard activation and provider retention. You can change your analytics choice below.

Hosting, authentication, and operational requests can still create technical records without analytics consent. Declining analytics does not prevent essential processing needed to serve a page or maintain an account.

7. Processors, hosting, and sharing

The reviewed service integrations include Supabase, Anthropic, fal.ai, optional OpenAI, Lemon Squeezy, optional Google Analytics and PostHog, Google OAuth, Vercel hosting, and optional Vercel Web Analytics. Prompts or generated assets are sent to the providers involved in the selected operation. Actual production providers, processing regions, subprocessors, cross-border arrangements, provider training/data-use settings, and contracts need owner confirmation. Public gallery content is accessible to visitors; do not publish private information there.

8. Retention and deletion requests

Owner review required: retention periods for accounts, prompts, generated images, saved projects, operational logs, backups, payment/credit records, and support requests are not confirmed. No self-service universal account-deletion workflow was verified. Deletion may involve more than removing a visible project, including storage assets and provider records. No immediate or complete erasure is promised by this draft.

A working channel for access, correction, deletion, objection, or other applicable requests must be established. The Contact page currently explains that delivery is unconfigured; its draft composer does not submit requests.

9. Security practices and limitations

The code contains server-side authorization, input validation, Supabase row-level-security policies, signature checks for billing webhooks, and restrictions around gallery publication. These are implementation controls, not a security certification or guarantee. Deployment settings, permissions, provider configuration, and ongoing maintenance must also be checked. Do not submit passwords, API secrets, or payment-card details through creative prompts or the contact composer.

10. Children, families, and education

WonderWords includes child-oriented creative material, family/teacher positioning, and pages that adults may use with children. An account-age rule, age-assurance system, and verifiable parental-consent workflow were not confirmed. The owner must determine whether the whole service or particular sections are child-directed, mixed-audience, or general-audience based on actual use and presentation. A general-audience label alone does not resolve this issue.

Before collecting children's information or adding advertising, review applicable children's privacy requirements, parental notices and consent, data minimization, and advertising restrictions. Adults preparing activities should avoid identifying information about children in prompts and public gallery content. This draft does not claim COPPA, GDPR, or other legal compliance.

11. Advertising — conditional, not activated by this work

No AdSense ad units or advertising scripts are added by these changes. If the owner later approves advertising, this policy and consent interface must be updated to describe the actual providers, cookies, identifiers, purposes, and user choices before activation. Google may use cookies or other identifiers for ad delivery and measurement when its advertising services are used. Applicable regional consent requirements, a suitable certified consent-management platform, child-directed treatment, and restrictions on personalized ads require review. The existing analytics preference is not a certified AdSense consent platform.

12. Policy changes and contact

This is a review draft dated 13 October 2026. The owner must approve a final effective date, legal identity, privacy contact, retention schedule, processor list, and applicable rights procedure. Until then, it should not be represented as a final approved policy or proof of AdSense eligibility.