Privacy policy

Last updated: 22 October 2026

Colora makes coloring pages and books with AI. It is operated by Norvane Studio ("we"). This page explains what we collect, why, who processes it and how to remove it. Questions: norvane.studio@gmail.com.

What we collect

• Account data: your email address, an optional name, the language you choose, and a one-way hash of your password (never the password itself). The links and 6-digit codes in our emails are stored only as one-way hashes and stop working once used or after 24 hours (1 hour for password resets).
• What you create: the descriptions, notes and change requests you type, the pages drawn for you, the characters you save (a name, a note and a copy of the page they come from) and your books (their title and the list of what is in them).
• Photos you upload to turn into a page. A photo is deleted a day after the last page made from it, or straight away when you delete that page. The page itself stays until you delete it.
• Getting-started progress: which steps of the app's guide you have done or skipped and whether you hid it. Most steps are ticked from what your account already holds; the app ticks three when you do them: downloading a page, exporting a book PDF and opening a free tool.
• Waitlists: if you join one (such as printed books), that you joined, when, and the answers you choose to give. We use them to email you when the feature opens.
• API keys: a key's name, when it was created and last used, and a one-way hash of it (the key is shown once and never stored).
• Credit and billing history: credits granted, spent and refunded, your plan, and the Stripe ids that link your account to its payments, plus today's count of page-idea requests for the daily allowance. We never see or store your card details.
• Settings: your choices in the app, such as the language and whether PNG downloads keep the image model's provenance data.
• Free-credit record: a one-way hash (SHA-256) of your email address, normalised so that aliases of one inbox match. It shows only that this inbox has had its free pages.
• Referral: if you sign up with an affiliate's link or code, which affiliate referred you. The affiliate sees only that someone joined on a given date, whether they confirmed their email, their plan and the commission earned, never your name or email address.
• Affiliate program: if you join it, your code, the PayPal email you give for payouts, and your commission and payout records.
• Connected AI apps: if you connect an AI app such as Claude or ChatGPT, its registration (the name it gives and the address it returns to), when you connected it and last used it, and one-way hashes of its access tokens.
• Technical logs: request times, page and API addresses (without query strings) and status codes, kept to run and secure the service. They contain no IP addresses, no browser details and none of your descriptions or images.
• Usage statistics: see the next section.

Usage statistics

We measure how the website and the app are used with our own first-party statistics, to understand which pages bring people in, where they get stuck and what the service costs to run. There are no cookies, no third-party analytics and no advertising trackers.

• Page views: each page you open sends us its address, the site that linked to it (its name only, such as google.com), any campaign tags in the link (utm_source, utm_medium, utm_campaign, or an affiliate's ref code), and the type of device, browser, operating system and language derived from what your browser sends. Clicks on buttons that lead into the app, and uses of the free tools, are counted the same way.
• No identifier is stored on your device. To count visitors, our server combines your IP address and browser with a random value that changes every day and is then deleted, and keeps only the resulting code. It cannot be turned back into your IP address and cannot follow you from one day to the next. Your IP address itself is never stored.
• Signed-in activity: actions such as logging in, downloading a page, exporting a book, seeing the plans (and what led to it), starting a checkout and payments are linked to your account, with the AI calls made for you (which model, tokens and estimated cost, never your descriptions). When you sign up, we note the first page you saw that day and where it was linked from.
• A/B tests: a page may show one of two versions of a part, such as a headline. Your version is picked from the same daily code, so nothing is stored on your device, and is recorded like a page view.
• Do Not Track and Global Privacy Control are honoured: if your browser sends either signal, nothing is recorded for you.

Statistics are kept for 13 months. When you delete your account they are kept only without any link to you.

What we don't do

No advertising, no selling of data, no third-party tracking, no cookies. Your browser's local storage holds your sign-in token, the language you chose and the page settings you used last (detail, shape, border); logging out removes the token. While a tab is open, its session storage holds where to take you back to after signing in. The free website tools run entirely in your browser: the images you give them are never uploaded.

AI providers that process your content

To draw pages we send the minimum needed to these providers, under their paid API terms:

• Google, Gemini API: the instructions for each page (built from your description, note or change request), and the image it works from: your photo for a photo page, the saved character's page, or the page being changed.
• Mistral AI (France): the text you type (descriptions, notes, change requests, character names, themes), checked by its moderation model before anything is drawn, and the themes you ask page ideas for.

Other providers

• Brevo (Sendinblue SAS, France) delivers our account emails (email confirmation and password reset): it receives your email address and the message.
• Stripe processes payments. Card details go directly to Stripe and never reach our servers. Stripe receives your email address and payment information and acts as an independent controller for payment and fraud prevention.
• PayPal pays affiliate commissions: it receives the payout email you give us and the amount.
• AI apps you connect receive the results of the tools you ask them to use (pages, previews, links, your credit balance). We never receive your conversation with the app; what its provider does is covered by its own privacy policy.

Where it is kept

Data is stored on a server operated for us by OVHcloud in Europe. The database and image storage live on that server and are not shared with other companies. Nightly database backups are kept for up to six months on a rolling basis.

How long we keep it

For as long as your account exists (photos: a day, see above; statistics: 13 months). Deleting a page deletes its image. Deleting your account deletes everything immediately from the live service, and from backups as they rotate out, except the free-credit record above: we keep that hash, unlinked from any account, so the free pages can't be claimed again by signing up anew. It contains no readable email address.

Your rights

You can access, correct, export or delete your data at any time. Delete your account in the app (Account → Delete account), or write to norvane.studio@gmail.com. If you are in the EU or UK you can also complain to your data protection authority.

Children

Colora makes pages for children, but accounts are for people aged 13 and over (16 in the EU). Only upload a photo of a child if you are their parent or guardian, or have their permission. We do not knowingly collect data from children.

Changes

When this policy changes, this page is updated and the date above moves. Significant changes are announced by email.