Do you train AI models on my pictures?

No. We do not use your content to train models and we ask our providers not to use content submitted through our API for training. If that ever changes we will say so prominently before it takes effect.

What if I never use an AI feature?

Then nothing is sent to a third-party AI provider. Projects stay on your device unless you separately opt in to private Studio Plus cloud backup or choose to export or share them. Local creation works in aeroplane mode.

Is my photo's location sent?

No. The app strips metadata — location, camera details, timestamps — from the copy it uploads. Your original photo on your phone is untouched.

Can I see what will be sent before it goes?

Yes. The app shows the relevant source, prompt, frames, narration text, or planning settings before you start the request. Credit-bearing actions, including suggested descriptions, show the applicable cost before you start.

Do you keep the pictures I send for AI processing?

Doodle-controlled working copies are removed when no longer needed, and temporary delivery copies are removed from active storage within 30 days after the request ends. Protected backup/soft-delete rotation and an AI processor’s safety or abuse-monitoring records are separate and described below.

How your data is used with AI

The principle

Nothing is sent to an AI provider unless you ask for an AI action, and when you ask, you see what is going first.

This is not a marketing line — it is how the app is built. Free projects make no third-party AI calls at all. The AI features are separate, explicit, priced actions with visible input controls before each request.

Optional Studio Plus cloud backup is a separate Firebase storage feature. It can run automatically after you opt in, but it does not submit backed-up content to Gemini, OpenAI, or another generative-AI provider. See backup and sync.

What is sent, for each action

When you ask for	What is sent	What is not sent
A suggested description of a sketch or photo	A metadata-free copy of that one image	The original file, your location, your other pictures
An illustration	Your edited description, the style and shape you chose, and the source image if you used one	Your name, your account email, other project content
An AI page plan	Your outline, title, theme, layout, reader band, page count, feel, style, reviewed anchor description if selected, and applicable motion, language, and voice settings	The anchor image itself; image description is a separate action. Library images are not sent unless you choose previews for descriptions
Narration	The text you reviewed, and the voice and style you chose	Your images or other pages
A video clip	Your reviewed motion prompt, the specific start/end frames you selected, and any reviewed dialogue, scene-sound, music, or silence directions	The source video file — only a chosen frame is extracted and sent

What we strip before sending

Images prepared for AI processing have their metadata removed — GPS location, camera make and model, timestamps, and other EXIF fields. The copy that goes out is just the picture.

Rendered PDF and MP4 exports contain the page presentation rather than the source image files. A .ddstory archive is different: it intentionally includes the project’s original media so the project remains editable on another device.

The review step

AI actions follow the same input-first principle, although the exact controls vary:

You choose a source.
The app shows the relevant source picture, prompt, frames, narration text, or story settings. For the suggested-description action, the selected image itself is the input and the editable description is the result.
Where text is available before generation, you edit it until it says what you want.
A credit-bearing confirmation button names the exact cost, for example Generate video · 25 credits.
Only then does anything leave your device.

The input is visible and the action is deliberate. Standalone image and video generation also show the result before it is used. Planner artwork selected during plan review, generated narration, and media from an approved whole-book run can be attached to the selected pages when generation finishes. Whole-book approval covers the reviewed plan and quoted run; it is not a separate confirmation for every page request. Review the complete project before export or sharing.

Who processes what

The current processors are:

Image understanding and story text — Google (Gemini models)
Illustration generation — OpenAI (GPT Image models)
Video generation — Doodle-operated MiniMax H3 infrastructure
Narration — Google (Gemini text-to-speech)

Text and image model choices may change after review, while provider and model details stay server-side rather than being wired into the app. Video generation uses only Doodle-operated MiniMax H3 workers, whether those workers are in our colocation environment or our controlled GCP environment. There is no external hosted-video fallback. Adding a different video processor would require a new implementation, contract and privacy review, safety and deletion validation, and an update to this page before activation.

Training

We do not use your content to train AI models. We use paid provider/API configurations under terms where submitted content is not used to improve their models. Providers may keep limited content or sanitized records for safety, security, abuse prevention, or legal compliance under the terms applying to our account.

If this ever changes, we will say so prominently in the app before it takes effect — not in a quiet policy update.

Retention clocks

Doodle’s own temporary copies use one consistent outer limit. Recoverable request copies are deleted after provider acceptance or once they are no longer needed. Temporary generated delivery copies are stamped for deletion after 29 days and removed from active storage by a six-hour cleanup job, keeping active retention within 30 days. Protected soft-deleted or backup copies follow our routine infrastructure rotation. Current private-video task files are normally removed after seven days in production (three days in staging), and account deletion requests their earlier permanent removal.

A signed download link has a separate, shorter expiry. Link expiry controls access; it is not a claim that the underlying file was retained for that long or deleted at that moment.

Processor-side safety and abuse-monitoring retention is separate. It can vary by service and account configuration, and may continue for the processor’s stated period even after Doodle deletes its working copy. We review that period before enabling a route and do not treat a provider’s marketing summary as a substitute for the terms applying to our account.

Safety filtering

AI providers apply their own safety filters. Sometimes they refuse completely innocent family content, because the filters are blunt instruments. When that happens your credits are returned automatically and you can rewrite the description and try again. See generation errors.

What we will not build

Some things are off the table regardless of whether they are technically possible:

Face recognition or biometric matching
Likeness transfer that reproduces a specific real person’s face
Automatic inference of family relationships
Any public gallery, feed, or automatic sharing of what you make
Advertising, or any advertising SDK
Selling or renting your information

Turning it off entirely

Do not subscribe, or sign out. Without an eligible Studio entitlement the AI actions are not available and no AI request can be made. The rest of the app — drawing, editing, layout, narration you record, music, export — keeps working exactly as before.

Questions

Email support@doodledragon.app. If something here is unclear or reads as evasive, tell us and we will rewrite it.