Privacy & play

Who this app is for

Adults aged 18 or older operate Together Doodle for their households. We do not offer children accounts, independent sign-in, public profiles, chat, or purchases. Children may suggest guesses or draw on paper while an adult operates the app. Do not enter or draw names, contact details, photos, or other personal information.

If information about a child has been submitted, contact us so we can investigate and delete it.

Information used to run a game

We store random room and player identifiers, assigned animal labels, drawing strokes, prompts, turn times, scores, hashed invitation and session credentials, and a room purchase entitlement when applicable. Your browser keeps its session credential in session storage so a refresh can rejoin. Practice drawings remain on your device.

Inside Zoom, an encrypted app context is verified on our server. It includes a Zoom user identifier, meeting identifier and context timestamps. We derive keyed hashes to put participants into the same game. Raw Zoom identifiers and OAuth access or refresh tokens are not stored in our database. A Zoom player’s access must be refreshed with a valid context at least every five minutes.

Our app does not access meeting recordings, calendars, contacts, video or audio. Guesses are spoken on your existing call. We do not use advertising, behavioral analytics, or tracking pixels.

Who can see the data

Players in the same game see drawings, animal labels and scores. Only the current drawer receives the prompt before it is revealed. Browser invitations are private links; keep them private. In Zoom, signed-in adults in the same meeting can enter its game. The game host may also create a private browser invitation. Anyone given that link can join the same game, including people outside the Zoom meeting. The link expires after 30 minutes and can be replaced or disabled by the host. Existing players remain until removed, the room ends, or it expires. Browser players do not supply a Zoom identity and are labeled Browser.

Our hosting providers, including Sites infrastructure and Cloudflare, process application data and technical connection information to deliver the service. A hashed network identifier is retained temporarily to limit abuse. If you email support, we receive your email address and the information you include. We do not sell personal information.

Retention and deletion

Free rooms become inaccessible six hours after creation. A browser Family Night Pass, when enabled, extends access to six hours after purchase. The host’s End room & delete action immediately deletes the game record and its Zoom membership indexes.

Expired room records are deleted when accessed or when another game is opened or created. This is request-triggered cleanup, not a promise that every physical copy disappears at the six-hour mark. Hosting logs and backups follow the providers’ retention practices.

When Zoom sends a verified app removal event, we delete active rooms associated with the removing user, including their shared drawings and scores. Other players in those rooms will need a fresh game. A keyed removal marker rejects older app contexts; markers become eligible for cleanup after 24 hours. Browser-only rooms are not linked to a Zoom account.

For deletion help, email fahadmubiru1@gmail.com. Include a room reference or a description of the issue. Never send session credentials, invitation links, passwords, or card details. We aim to remove support correspondence within 90 days after resolution, except where retention is needed for a payment dispute or legal obligation.

Payments

The initial Zoom release is free. Paid browser passes remain disabled until live payments are configured. When enabled, Stripe processes the adult purchaser’s checkout and receipt details. We receive a checkout reference and payment status; we do not receive card numbers. Stripe retains its payment records under its own policies. Closing a room deletes its app entitlement but does not erase Stripe’s transaction records.

Your privacy rights

Depending on the law that applies to you, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to processing, and receive portable data. These rights can have legal exceptions. We do not use your information for automated decisions that have legal or similarly significant effects.

To exercise a right, email fahadmubiru1@gmail.com with your request and, if relevant, a room reference. We may ask for proportionate information to verify that the data belongs to you, and will respond within the period required by applicable law. Do not send passwords, authentication codes, session tokens or card details. Data that has already been deleted may no longer be available. You may also complain to your local data protection authority.

Questions and changes

Old Oak Labs operates this app. Contact: fahadmubiru1@gmail.com. We will update the effective date on this page when this policy changes. Material changes to data handling will also be described in the app before they take effect.