Barely Drawn

Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how Orca Labs processes information when you use Barely Drawn, including any localized name used for the app, on iOS or Android. It also explains your choices and rights.

Important cloud-processing notice: Barely Drawn is not an on-device-only image editor. After you complete a rewarded advertisement and request generation, a prepared copy of the image you selected leaves your device and is processed through Cloudflare and Runware so the App can create and return a drawing. Do not start generation if you do not want that image processed in the cloud.

By using Barely Drawn, you acknowledge the practices described here. Your use of the App is also governed by our Terms of Service.

1. Scope and Operator

Orca Labs is the operator of Barely Drawn and is responsible for the processing described in this Policy, except where a third party acts independently under its own privacy policy.

This Policy applies to the Barely Drawn mobile apps, related cloud generation service, advertising, support communications, analytics, optional notifications, and the barelydrawn.app website. It does not govern a third-party app or website you choose to open, save to, or share with.

Barely Drawn currently does not require you to create an account.

2. Information We Process

2.1 Images You Select and Generated Results

When you choose an image and request a drawing, the App processes:

The App is designed to resize selected images to a maximum edge length of approximately 1,024 pixels and encode the upload as JPEG before cloud transmission. We do not intentionally include the original filename or EXIF metadata in the generation request. Re-encoding can reduce embedded metadata, but it does not remove personal information that is visibly present in the image.

The request passes through an Orca Labs service running on Cloudflare infrastructure and is processed by Runware. Runware may return a hosted result URL and generation task information, after which the App receives the generated image. Runware’s current platform documentation states that generated output URLs are retained for seven days by default. Provider behavior and retention may change under its current documentation, terms, or configuration.

Except when you deliberately submit a content report as described in Section 2.8, Orca Labs does not intentionally save generation request images or generated images to an Orca Labs application database or object-storage gallery. The cloud service must nevertheless receive and transiently handle the data to complete the request, and service providers may process or retain information under their own policies, legal obligations, security controls, and service settings.

2.2 Information Stored on Your Device

Barely Drawn may temporarily hold a selected image and generated result in app memory while you use the relevant screen. On Android, the App may create a temporary PNG file in its cache to share a result. That cached file may remain until it is overwritten, cleared by the operating system or App, or removed when you clear App storage or uninstall the App.

If you choose Save, the result is written to your device’s photo or media library using platform storage features. A saved image remains there until you delete it or your photo-storage provider handles it according to your settings.

The App may also keep local preferences, such as notification choices and basic app settings, using system storage. Those preferences may be included in device backups depending on your platform and backup settings.

2.3 Analytics and App Activity

Release versions of Barely Drawn use Firebase Analytics to understand whether core screens and features work and how the App is used. Analytics events may include:

Associated information may include an app-instance or installation identifier, device type, operating-system version, app version, language or locale, approximate region derived from network information, session timing, screen activity, selected style identifier and image MIME type. Firebase and the operating system may also process IP addresses and other technical identifiers as part of providing the service.

We configure our App analytics so that event payloads do not intentionally contain the selected image, image bytes, generated image, original filename, image URL or local path, EXIF metadata, face templates, Runware task identifier, or generation cost.

2.4 Advertising

Barely Drawn displays banner advertisements and requires completion of a rewarded advertisement before each new drawing. We use Google AdMob to request, show, and measure ads and Google's User Messaging Platform to obtain and manage advertising choices where required. The App requests Apple's App Tracking Transparency permission where applicable; declining tracking does not prevent ads from being requested when the applicable consent status allows it. After a rewarded advertisement ends, the App sends the selected image and reward token to our service. Our service checks the reward before forwarding the image to the AI provider for generation. If no ad is available, you close it early, or reward verification fails, a new drawing cannot start. A failed generation may be retried with the same image and style while its verified reward remains valid.

AdMob and its partners may process IP address and approximate location, device or advertising identifiers (including IDFA only when permitted), ad impressions and interactions, product interaction, crash information, performance data, and other diagnostics to deliver and measure ads, prevent fraud, and maintain the ad service. The ads you see may be personalized or non-personalized depending on your choices, location, device settings, and the provider's practices. We do not send your selected photo or generated drawing to AdMob for ad targeting. Google's data practices and retention are described in Google's Privacy Policy and Google Mobile Ads SDK disclosure.

Meta App Events may be used in release versions to measure app activation, installs, limited in-app activity, and the effectiveness of Meta advertising campaigns, subject to applicable advertising consent and platform tracking permission. The in-app events we send are drawing requests, rewarded-ad completion, drawing-generation failure, viewing a generated result, completed saves, and taps on the share control. These events may include limited technical parameters allowed for that event, such as a drawing style identifier. Meta may also process app and device information, installation or advertising identifiers, IP address, activation and event timestamps, and related technical information. We do not intentionally include selected photos, generated drawings, image bytes, original filenames, image URLs or local paths, EXIF metadata, face templates, names, email addresses, or a user account identifier in Meta App Events payloads. On iOS, our app enables Meta App Events only when the required tracking permission and advertising consent allow it; privacy-preserving SKAdNetwork install measurement may operate separately. Changing or withdrawing consent stops our app from sending further activity events when measurement is no longer permitted.

AdMob mediation may request banner advertisements from Meta Audience Network when that ad source is enabled. Meta may process device and advertising identifiers, IP address and approximate location, ad impressions, interactions, and diagnostics for ad delivery, measurement, and fraud prevention, subject to applicable consent and settings. See Meta's Privacy Policy.

2.5 Notifications

If notification features are offered and you choose to enable them, the App and Firebase Cloud Messaging may process a push-notification token, app-installation information, platform, locale, notification topic or campaign information, delivery status, and your in-app notification preference.

You can turn notifications off in the App or your device settings. When notification permission or the related in-app choice is disabled, the App is designed to stop registration and request deletion or invalidation of the relevant Firebase token where supported. Provider systems may retain limited records for security, delivery integrity, or legal purposes.

2.6 Support Communications

If you contact us, we process your email address, message, attachments, and any information you choose to provide. Please do not send sensitive images or personal information that are not necessary for support.

2.7 Information We Do Not Ask You to Provide

Barely Drawn currently does not ask you to create an account or directly provide a name, password, payment card, postal address, or contact list. The App does not offer a paid subscription or in-app purchase at this time.

2.8 Reports of Inappropriate Generated Content

If you choose the report control on a generated result, we receive the report reason, drawing style, platform, generated image URL, and receipt time. We may retain a copy of the reported generated drawing and that report information in Cloudflare R2 to review inappropriate content and protect the service. This is a deliberate exception to ordinary generation's transient image handling. The report does not intentionally include the original source photo or a user account identifier. Report records are retained as reasonably needed for content review, abuse prevention, follow-up, and applicable legal obligations. You can contact support@orcalabs.net about a report or a deletion request.

2.9 Website

The barelydrawn.app site provides app information, support, and legal pages. Its hosting infrastructure may process IP addresses, request URLs, browser and device information, and security logs to deliver pages and protect the site. When you follow an app-store link, the store processes the visit under its own policy. The site also uses Google Analytics to measure page views, the language, page type, and drawing style viewed, a coarse traffic source (such as search, social, or direct) and the referring site’s address without its path, and app-store button clicks. It sets first-party analytics cookies, except in the European Economic Area, the United Kingdom, and Switzerland, where analytics cookies are not set. Page addresses sent to Google Analytics exclude query strings and fragments, Google signals and ad personalization are turned off, and no user identifier is sent. If your browser sends a Do Not Track or Global Privacy Control signal, the site does not load Google Analytics. Contacting support by email is optional and is handled as described in Section 2.6.

3. Why We Process Information

We process information for the following purposes:

Orca Labs does not operate its own model-training pipeline using images submitted through Barely Drawn.

4. Legal Bases

Where a law requires a legal basis for processing, we rely on one or more of the following:

If local law requires a different basis or additional permission, we will apply that requirement.

5. How We Disclose Information

5.1 Service Providers

We disclose information only as reasonably necessary for the functions described below:

These providers may process information as our processors or service providers, or as independent controllers or businesses for portions of their services. Their current policies govern their independent processing.

5.2 Sharing You Initiate

When you choose a messaging app, social network, cloud drive, or another destination from the system share interface, we disclose the generated image and share text to that destination at your direction. The destination and its recipients control what happens next.

5.3 Legal, Safety, and Corporate Events

We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect a person’s safety, rights, or property; investigate fraud or abuse; enforce our Terms; or protect Barely Drawn and its providers.

If Orca Labs is involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the service, relevant information may be transferred subject to appropriate confidentiality and legal requirements.

6. Retention

We use different retention periods for different information:

Residual copies may remain temporarily in backups, security records, or provider systems after ordinary deletion. We may retain information longer when required by law or reasonably necessary to establish, exercise, or defend legal claims.

7. Data Security

We use reasonable administrative and technical measures designed to protect information. These measures include encrypted network transport, limiting generation payloads, re-encoding selected images before upload, restricting analytics event fields, and relying on established platform and cloud security controls.

No method of transmission or storage is completely secure. We cannot guarantee that information will never be intercepted, lost, misused, or accessed without authorization. You should avoid selecting images that contain unnecessary confidential, financial, health, identity, or other highly sensitive information.

8. Your Choices

Cloud Image Processing

You control which image to select and whether to start generation. If you do not want cloud processing, do not start a generation request. Barely Drawn cannot currently generate a result without this cloud processing.

Photo and Media Access

You can use the platform photo picker to choose a specific image. Saving is optional. You can review or change relevant permissions in device settings and delete saved results from your photo or media library.

Notifications

You can disable notifications in the App or device settings.

Local Data

You can clear the App’s storage or cache using device controls, delete saved images separately, or uninstall the App. Uninstalling does not recall content already shared with another person or service.

Advertising Choices

Where available, you can reopen advertising privacy options in the App to review or change your consent choices. On iOS, you can change tracking permission in device settings. Declining tracking may limit personalized advertising but does not remove the rewarded advertisement required for a new drawing. Choices may not affect data already processed.

Analytics and Provider Controls

Some platforms or providers offer additional privacy controls. Availability varies by device, region, and provider.

9. Your Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, withdrawal of consent, portability, or information about disclosures, and to appeal or complain to a regulator. You may also have a right not to receive discriminatory treatment for exercising a privacy right.

To make a request, email support@orcalabs.net. Because Barely Drawn has no user account and we intentionally avoid placing images or image identifiers in analytics events, we may not be able to identify or retrieve data relating to you. We may ask for information reasonably necessary to verify and locate a record, such as the email used for support, app version, platform, device details, and approximate date of activity. Do not send us the original photo unless we specifically explain why it is needed.

You may also need to contact an independent provider directly for information it controls under its own policy.

10. Sale and Advertising Use

Orca Labs does not sell selected source images or generated results and does not disclose them to advertising providers for ad targeting. The App displays banner and rewarded advertising through Google AdMob. AdMob and its partners may process advertising identifiers and related device, network, interaction, and diagnostic data for ad delivery, personalization where permitted, measurement, and fraud prevention, subject to your applicable choices and their policies.

11. International Processing

Orca Labs and its providers may process information in the United States, United Kingdom, South Korea, and other countries where they or their infrastructure operate. These countries may have privacy laws different from those where you live.

Where required, we and our providers rely on recognized safeguards for international transfers, such as adequacy decisions, standard contractual clauses, provider data-protection terms, or other lawful mechanisms.

12. Children’s Privacy

Barely Drawn is not directed to children under 13 or the higher minimum age required by local law, and we do not knowingly seek personal information from them. A parent or guardian should supervise any permitted use by a minor and should not allow a child to submit an image without appropriate rights and consent.

If you believe a child below the applicable minimum age submitted personal information through Barely Drawn, contact support@orcalabs.net. We will review the report and take appropriate action. Because the App has no account and ordinary generation content is not stored in an Orca Labs image gallery, please provide the approximate date, platform, and relevant circumstances without sending additional sensitive content unless requested.

13. Third-Party Destinations and Links

Barely Drawn may open a link or let you share to a third-party service. We do not control how that third party collects, uses, retains, or redistributes information after you interact with it. Review the destination’s privacy policy before providing information or sharing a result.

14. Changes to This Policy

We may update this Policy when our App, providers, legal requirements, or practices change. We will revise the “Last updated” date and provide additional notice or request consent when required by law. Material changes apply prospectively unless law permits otherwise.

15. Contact

For privacy questions or requests, contact:

Orca Labs

Email: support@orcalabs.net