Cookie Policy
Last updated: July 4, 2026
This Cookie Policy explains the cookies and similar browser-based tracking technologies used on the Color the Picture (colorthepicture.com) web application. Color the Picture is an AI-powered coloring-book application for children, offered under the supervision of a parent or legal guardian.
Our use of cookies is managed in line with applicable data-protection and e-privacy law, in particular the EU General Data Protection Regulation (GDPR) and the EU ePrivacy Directive (2002/58/EC and 2009/136/EC, as implemented in national law, e.g. the UK PECR). Where children in the United States are concerned, we also apply COPPA (Children’s Online Privacy Protection Act) principles. If you are located in Türkiye, our processing of your personal data is additionally subject to the Turkish Data Protection Law (KVKK, Law No. 6698).
This policy covers only cookies and similar technologies — not our data processing activities as a whole. For a comprehensive explanation of how we process your personal data, please see our Privacy Policy.
1. What Is a Cookie?
A cookie is a small text file placed on your browser when you visit a website. Cookies are used to recognize you on return visits, remember your preferences, keep your session secure, and — where you have consented — collect anonymous usage statistics.
When we say “cookie” in this policy, we also mean other browser-based technologies used for similar purposes (for example, browser local storage / localStorage, session storage / sessionStorage, and pixel tags).
1.1. Categories of Cookies
Color the Picture uses cookies in two main categories:
- Strictly Necessary Cookies — Technically required for the site to function and to keep your account secure; these do not require consent and cannot be switched off.
- Analytics Cookies (Optional) — These are activated only with your explicit consent; you can decline them through the cookie banner or withdraw your consent at any time afterward.
We do not use cookies for marketing, advertising, or behavioral profiling. No behavioral advertising tracking is carried out on children.
2. Cookies We Use
The tables below are provided for information purposes. Cookie names, durations, and providers may change with technical updates; the current list is always available from the “Cookie Settings” screen in our cookie banner.
2.1. Strictly Necessary Cookies
These cookies are required for the site’s core functions and for the security of your account, and cannot be disabled. Their legal basis is necessity for the performance of a contract with you (GDPR Art. 6(1)(b)) and our legitimate interests (GDPR Art. 6(1)(f)); under applicable ePrivacy rules, cookies of this kind do not require separate consent.
| Cookie Name | Purpose | Retention Period | Attributes |
|---|---|---|---|
user_auth_token |
Parent user session management (signed session token) | For the session, or up to 30 days | HTTP-only, Secure, SameSite=Strict |
active_child_id |
Identifies the active child profile (for parents with more than one child profile) | Up to 30 days (deleted when you sign out) | HTTP-only, Secure, SameSite=Strict |
cookie_consent |
Stores your cookie consent preference (so the banner is not shown again) | 1 year | Secure, SameSite=Lax |
i18n_redirected |
Remembers your chosen interface language so pages open in the right language | 1 year | Secure, SameSite=Lax |
Note: Passwords are never stored in a cookie. Parent passwords are hashed server-side using bcrypt, and session tokens are securely signed.
2.2. Analytics Cookies (Optional — Consent-Based)
These cookies are loaded only when you click “Accept All” in the cookie banner, or explicitly enable the analytics category in “Cookie Settings.” If you decline, no analytics cookies are loaded and analytics measurement remains disabled.
| Cookie Name | Provider | Purpose | Retention Period |
|---|---|---|---|
_ga, _ga_* |
Google Analytics 4 | Anonymous visit statistics, aggregate usage analysis | Up to 2 years |
_gid |
Google Analytics 4 | Daily visitor counting | 24 hours |
_clarity, CLID |
Microsoft Clarity | Usability analysis: heatmaps and session replay | Up to 1 year |
Google Analytics 4 is used only to measure aggregated, anonymous metrics (visit counts, page views, session duration, etc.); IP addresses are anonymized. We do not build profiles to identify individual users or child profiles. Analytics cookies are not used for advertising or retargeting purposes.
Plain-language notice about session replay. When you consent to analytics, Microsoft Clarity records how you move through the page (mouse/scroll/click traces, screen size, how long you stay in a section) so that we can spot usability problems. This is not a video recording of you; it is a reconstruction of the page. It is not used for advertising or profiling and is never sold.
Child-profile rule: When a child profile is active, session replay is never started — even if analytics consent has been given. This is how the product actually behaves (not merely a promise): with a child profile active, the recording script is not loaded.
2.3. Non-Cookie Local Storage
For the app to function correctly, your browser’s local storage (localStorage / sessionStorage) may hold certain technical data (for example, a coloring draft in progress, or temporary session information). These are not technically cookies; they are not automatically sent to our servers, and they are deleted when you clear your browser data.
⚠️ Correction (5 August 2026): Your interface language preference is not kept in local storage but in the i18n_redirected cookie, which your browser sends to the server with every request; the server reads it to render the page in the correct language. The cookie contains only a language code (e.g. tr, en) and no identity information.
3. AI Photo Uploads and Cookies
Photos you upload to generate an AI coloring page are not stored via cookies. These images are processed only temporarily (in memory, in an encoded form) for the duration of the generation process and are not retained after processing completes. We do not use any cookie to identify or track the raw photos you upload.
4. Cookie Consent
On your first visit to the site, you can set your preference through the cookie banner that appears on screen:
- “Accept All” — Enables strictly necessary cookies plus analytics cookies.
- “Necessary Only” — Enables only strictly necessary cookies; analytics cookies are not loaded.
- “Cookie Settings” — Lets you manage each cookie category individually.
No analytics or optional cookie is loaded before you give consent. Your choice is stored in the cookie_consent cookie so the banner is not shown again on future visits.
4.1. Withdrawing Consent
You may change or withdraw your consent-based cookie preferences at any time, as easily as you gave consent. To do so, use the “Cookie Settings” link in the site footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
5. What Happens If I Decline the Cookie Banner?
- The site continues to work: sign-in, account management, child profiles, the coloring canvas, the ready-made coloring-page library, AI coloring-page generation, and gamification features all remain available.
- You will not contribute to anonymous usage statistics.
- Certain optional personalization features we may add in the future may work in a limited way.
Strictly necessary cookies cannot be declined, as they are required for you to use the site; if you block them in your browser, you may be unable to sign in or use certain features.
6. Security-Related IP and Audit Logs (Not Cookies)
To meet our data-security obligations under GDPR Article 32 (security of processing) — and, for users in Türkiye, under KVKK Article 12 — your IP address and device/browser information are recorded for the following actions as server-side audit logs, not through cookies:
| Action | Purpose / Record | Retention Period | Legal Basis |
|---|---|---|---|
| Data export request (“Download My Data”) | Record of who made the request and when | 5 years | GDPR Art. 5(2) accountability + Art. 30 record-keeping (KVKK Art. 12 for users in Türkiye) |
| Data deletion request (child profile/account deletion, consent withdrawal) | Record of what data was deleted and when | 5 years | GDPR Art. 5(2) accountability + applicable statutory retention obligations (KVKK Art. 12 for users in Türkiye) |
| Suspicious/failed sign-in attempts | Security monitoring and brute-force attack detection | 90 days | GDPR Art. 6(1)(f) legitimate interests (KVKK Art. 12 for users in Türkiye) |
These logs are not used for individual tracking; they exist so we can answer accountability questions — such as “what data was deleted or exported, and when” — as part of our data-protection compliance. Even if you decline the cookie banner, these server-side security/audit logs continue to be kept as a legal obligation.
7. Third-Party Cookies and Service Providers
We use trusted third-party service providers for certain functions. Some of these providers may set their own cookies when you use the relevant feature or, for analytics, once you have given consent:
- Google Analytics 4 (Google Ireland Limited / Google LLC): Anonymous traffic analysis — only once you have given analytics consent (see Section 2.2).
- Google OAuth (Sign in with Google): When you use the “Sign in with Google” option, Google’s own cookies are activated for authentication purposes.
- Google Cloud / Gemini: AI image generation runs on this infrastructure. This processing happens server-side and does not place marketing cookies on your browser.
- Lemon Squeezy (Merchant of Record): When you are redirected to the checkout page for a subscription/payment, Lemon Squeezy’s payment-session cookies are activated.
- Hetzner (hosting): Our servers are hosted in Germany/the European Union; hosting itself does not place cookies on your browser.
We may onboard additional service providers in the future, such as Sign in with Apple or email-delivery providers (e.g. Resend/SendGrid); we will update this policy if we do.
These third parties are subject to their own privacy and cookie policies:
- Google Privacy Policy
- Google Analytics Terms of Service
- Lemon Squeezy Privacy Policy
- Hetzner Privacy Notice
7.1. International Data Transfers
The infrastructure of some of the service providers listed above may be located outside your country of residence (for example, in the EU and/or the United States).
For users in the EU/EEA: transfers are carried out under Chapter V of the GDPR (Articles 44–49) — on the basis of an adequacy decision, standard contractual clauses, or other appropriate safeguards.
For users in Türkiye: transfers are carried out under Article 9 of the KVKK as amended by Law No. 7499 (Official Gazette 12 March 2024, No. 32487; in force since 1 June 2024). Under that regime a transfer may take place, in order: (i) to countries covered by an adequacy decision of the Turkish Data Protection Board; (ii) failing that, where appropriate safeguards are provided (for example a standard contract notified to the Authority within 5 business days of signature, or binding corporate rules); (iii) failing those, only in the incidental (exceptional) cases set out in the Law. Transfers of a continuing nature can no longer rely on explicit consent alone.
8. Managing Cookies in Your Browser
In addition to the preferences available in our cookie banner, you can view, delete, or block cookies through your browser’s own settings:
- Chrome: Settings → Privacy and Security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings/Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Warning: If you delete all cookies or block strictly necessary cookies, your session will end, your preferences will be lost, and some parts of the site may not work correctly.
9. Children’s Privacy
Color the Picture accounts are for parents/legal guardians who are 18 or older. Children (roughly ages 3–13) are managed as a “child profile” under a parent’s account. We do not use behavioral advertising cookies or perform profiling on children. Analytics cookies are used only with the explicit consent of the parent managing the account, and only for anonymous measurement purposes. For further detail on children’s privacy, see our Privacy Policy. In addition: when a child profile is active, session replay is never started; this is the application’s technical behaviour, not merely a statement in this text (see Section 2.2).
10. Changes to This Policy
We may update this Cookie Policy from time to time. Updates take effect as soon as they are published on this page, and the “Last updated” date above will be revised accordingly. If we make a material change to the cookies we use, the cookie banner will be shown again to obtain your renewed consent; where appropriate, we will also notify you at your registered email address.
11. Data Controller and Contact
The data controller responsible for the cookie practices described in this document is:
The company’s official legal title, address, and registry details (MERSİS / Trade Registry / KEP) will be published in this section once the registration process is complete. In the meantime, you may use the email channels indicated for your data protection and contact requests.
You can reach us with any requests or questions about our use of cookies or your personal data:
- General inquiries: iletisim@colorthepicture.com
- Data protection requests: kvkk@colorthepicture.com
- Technical support: destek@colorthepicture.com
For detailed information about your data subject rights (access, rectification, erasure/“right to be forgotten,” data portability, withdrawal of consent, etc.) and how to exercise them, please see our Privacy Policy.
This Cookie Policy forms an integral part of, and should be read together with, our Terms of Use and Privacy Policy. Your mandatory consumer-protection and data-protection rights under the applicable law of your country of residence remain fully reserved in all cases.