The short version. Coordinate Pictures does not ask who you are. There are no accounts, no names, no email addresses and no passwords.
If you are not using a class code, nothing you draw leaves your device at all.
If you join a class, what gets shared is your drawing and a name the site made up for you, like Brave Otter. Nothing that identifies you is stored, and the whole class is deleted after 60 days.
This policy covers Coordinate Pictures, the classroom activity at
tringle.education/cp, and the sharing service behind it. It does not
cover the main tringle application, which is a separate product with separate
systems and its own policy.
Coordinate Pictures is provided by High Tea IT, trading as tringle, based in New Zealand. High Tea IT is responsible for the information described here.
If you never type in a class code, this page never talks to a server. Everything stays in your own browser.
Coordinate Pictures is a single web page. Your drawing, your settings and a count of how many times you have opened the page are saved in your own browser's local storage, on your own device. None of it is sent anywhere, and nobody else can read it.
Clearing your browser data deletes all of it. So does pressing Clear all on the page, for the drawing.
When you join a class, your picture goes on a shared wall so your class can see it. It has a made-up name on it, not yours.
A teacher creates a class and gets a four-word code, like
book-desk-star-fish. Anyone with that code can join the class and see
the pictures in it. That is the whole access control, so the code should be handed
out in class rather than posted publicly.
| Your drawing | A short compressed string of coordinates and colours, up to 8 KB. The server never reads or interprets it — it stores and returns it exactly as sent. |
|---|---|
| A made-up name | Two words picked from a fixed list, like Brave Otter. You choose from three the site offers you. There is no way to type a name of your own, so nothing you write can appear on anyone else's screen. |
| A device number | A random number your browser generates for itself the first time you open the page, and keeps in local storage. It is not linked to you, your school or anything else. It exists so that saving your drawing again replaces your own picture instead of adding a second one. |
| The class code | So your picture appears on the right wall. |
| A timestamp | When the picture was last saved. |
Because none of that is asked for, none of it can be stored, and none of it can be lost in a breach.
Your picture is not published on the open web, is not listed anywhere, and cannot be found without the class code.
The service runs on a server rented from Hetzner Online GmbH, located in Germany. Data is held in a single database file on that server.
Germany is a good place for it to be. Data held there falls under the European Union's General Data Protection Regulation, which is among the strictest privacy laws anywhere, and under German national data protection law on top of that — Germany has long been one of the strictest countries in Europe on this subject. Both are enforced by independent regulators with real powers, and between them they set a higher bar than the law in either New Zealand or Australia requires. The European Union has also formally recognised New Zealand's own privacy law as offering adequate protection, which gives a sense of how closely the two regimes are regarded.
In practice the question matters less here than it would for most services, because there is nothing personal in the database to protect in the first place — no names, no contact details, nothing typed by a student. What crosses a border is a drawing and the words Brave Otter.
There are no other third parties. Specifically, there is:
Nothing is ever used to train a model.
Requests to this activity are not logged. Most web servers keep a line per request holding the visitor's IP address and the address they asked for; that is switched off here, for both the page and the sharing service, because the address would contain the class code and we have no reason to keep children's IP addresses.
Two things are still recorded, both on the same server and both kept for 14 days before being deleted automatically:
An IP address at a school is usually shared by everybody on the network, so it does not pick out an individual.
You do not need to ask us, and there is nothing to prove:
If you would rather we did it, or you want to know what is held for a particular class code, email the address at the bottom and we will act within 30 days. In most cases there is nothing to wait for, though: the three options above take effect the moment you use them, and they do not need us. Because no picture is tied to a person, we cannot look up "everything about a named student" — there is no such link to follow.
The database file is not encrypted on disk, and that is a deliberate choice rather than an omission. Encryption at rest protects information from someone who gets hold of the storage itself; it cannot protect information from the running program, which must be able to read it. Since this database contains no names, no contact details and nothing else that identifies a person, there is nothing in it for that protection to protect. We would rather tell you what is in the file than encrypt a file that holds nothing sensitive.
The server as a whole is backed up once a day. Seven days of backups are kept, and each new one replaces the oldest. They are held by the same hosting provider in the same data centre in Germany, under the same protections as the server itself.
This means a drawing you delete, or a class that expires, can still exist inside a backup for up to seven more days before that backup is overwritten in the normal cycle. Backups are never opened or read except to restore the server after a failure.
If we find or are told about a breach, we will investigate immediately, take the service down if that is what it takes to stop it, and fix the cause. If the breach is likely to cause harm, we will publish what happened on this page and notify affected schools we know of, along with any regulator we are required to notify, within 72 hours of becoming aware. Given what is stored, the realistic worst case is that somebody sees drawings they should not have — but we would rather say that up front than promise there is no scenario at all.
This activity is built for students aged around 11 to 14, and is designed on the assumption that its users are children.
That is why there is no sign-up, no free-text name, no messaging between students, no profile, no way to contact anyone through it, and no way for a student to be identified by what they share. A teacher decides whether the class feature is used at all; if they never hand out a code, nothing ever leaves the classroom's devices.
Schools remain responsible for their own consent and notification requirements. We are happy to answer questions from a school's privacy officer directly.
If this changes, the date at the top changes and the new version replaces this page. If a change means more data being collected, we will say so here rather than quietly swapping the wording.
Questions, deletion requests, or anything a school needs answered: privacy@tringle.education.
High Tea IT, New Zealand.
If you are not satisfied with how we have handled a privacy question, you can raise it with the privacy regulator in your country — in New Zealand the Office of the Privacy Commissioner, and in Australia the Office of the Australian Information Commissioner.