Your work. Your choice.

Your photos and your painting

paintr converts photos into paint-by-number paintings on your device. Personal painting does not require a paintr account. Your Studio holds your source images, generated paintings and saved progress.

Optional iCloud sync sends your saved work to your private iCloud storage through Apple. Exports go to the place or person you choose. An editable .paintr backup can include the source image and progress; a finished image or replay shows the content you export. These are separate from playable sharing.

Deleting a local painting moves it to Recently Deleted. It is kept there for recovery; this is not a promise of permanent erasure. Copies in iCloud, backups and exports need to be considered separately.

When you choose to share

Playable links and community submissions upload the generated puzzle—its colors and numbered spaces—along with the title, preview choice and, for community posts, chosen tags. They do not upload the original source photo or your coloring progress. The generated painting can still resemble your photo, so share only material you want other people to see.

Anyone with an unlisted playable link can open and forward it. Links do not expire automatically and currently have no in-app removal control. Community posts are discoverable in Explore. Each recipient starts their own blank copy and keeps their progress privately.

A surprise hides the finished preview from ordinary browsing, but it is not a privacy barrier: community surprises can be deliberately revealed, and the finished painting is always available to safety screening.

Safety checks, including surprises

Before a new painting can be shared, safety-screening services receive a rendered, finished-color version of the generated painting, its title and any writing detected in the image. This applies to both unlisted links and community posts, including surprise paintings. The original source photo and your progress are not sent for screening.

Microsoft Azure provides image and text safety checks and reads writing in the generated image. Mistral reviews the generated image, title and detected writing in context and can suggest community tags. If the checks cannot clear a painting, it is not shared. You can continue painting privately.

paintr retains a fingerprint of the submission, screening outcome, policy version, suggested tags and limited diagnostic information so it can apply decisions consistently and diagnose failures. The screening record does not store raw images, titles or detected writing. Accepted generated paintings and their titles are stored separately to deliver sharing.

Your optional community account

The community beta starts in the United States. You can browse without a paintr account; contributions are for people 16 and older. Sign in with Apple is used to share, like, report or suggest tags. Where required, Apple age and permission checks run on your device.

paintr does not request your name or email from Apple. It keeps a private account identifier, protected authorization information and the method and time of your 16+ eligibility declaration. It does not ask for or store your birth date, identity documents or a selfie. Your public creator label starts as a neutral alias. If your app offers profile editing, you can choose a public display name and optional bio. The name and bio are sent to Microsoft Azure for text safety checks before an update is saved publicly. If the checks cannot clear an update, your existing public profile stays unchanged.

The service stores your posts, likes, tag contributions, reports, creator blocks and sharing limits. To support tag voting, it records whether you started a community painting. This participation record is not public and does not include your coloring progress, completion history or time spent painting.

Removal, deletion and retention

Remove a post from your shared paintings to take it out of Explore and stop new downloads. In apps with a Profile tab, look there for your shared paintings; otherwise, open My community paintings in Explore. This does not retrieve copies people already saved. Removing a post is different from deleting your account.

To delete your community account, open Community account from Profile if your app has that tab, or from Explore in earlier versions. Deletion removes your community posts and account records and revokes the account’s Apple authorization. Your personal paintings remain in Studio. If deletion cannot finish, follow the app’s retry guidance or contact support; do not assume it completed.

Unlisted playable links are separate from community posts and are not removed by community account deletion. Contact support with the link for a removal or ownership concern. Already downloaded paintings, exports and copies held by other people cannot be recalled.

Limited security, owner-action and safety-screening records may remain after account deletion. The service does not currently set an automatic expiry for all of these records or for unlisted paintings. Do not assume that deleting an account erases every service or provider record. Contact support for questions about a specific record or deletion request.

Reports and restrictions

Reporting a community painting hides it for you immediately and sends the report to paintr’s owner for review. It does not automatically remove the painting for everyone. You can also hide a creator’s paintings from your own view.

Abuse can lead to restrictions on publishing, likes or tag contributions. Personal painting remains available, and restrictions do not prevent community account deletion. Contact support about an ownership concern or a decision you believe is mistaken.

Keeping sharing available

To limit repeated requests before they reach safety screening or sign-in, the sharing service uses a protected fingerprint of the requesting network address that changes each day. These protection records contain request types, times and counts, plus separately protected painting fingerprints to recognize retries. They do not contain the raw network address, title, image, request body or a link to your community account.

Request-protection records use two UTC calendar-day buckets. Older records are removed when the next protected request triggers cleanup, so they can remain longer while the service is idle. Failure summaries use seven UTC calendar-day buckets and are cleaned up on later failure or status checks. These summaries contain failure categories, counts and times, not raw provider responses or screening content.

Providers and service requests

Cloudflare hosts the website and sharing infrastructure; the website is published through OpenAI Sites. Apple supplies TestFlight, optional iCloud services and Sign in with Apple. Microsoft Azure and Mistral process the safety-screening content described above. These services process requests and technical information needed to operate their services.

Provider processing, retention and any permitted use are governed by their applicable terms and account settings. We do not promise that every provider immediately deletes requests or retains no data. paintr does not add advertising or cross-app tracking, and has no ads or subscriptions.

When you email support, your email address and the information you send are used to respond and investigate the issue. Please avoid sending original photos, passwords, verification codes or identity documents.

Questions or privacy requests

Contact paintr’s owner at support@paintr.dev for privacy questions, deletion help or a concern about shared content. Include a relevant painting link and a short explanation when possible.

This page describes the app, website and sharing service. We will update it when those practices change.