Last updated: June 11, 2026
The short version: your photos stay yours and stay private. They are hosted in Québec, Canada, never sold, never used for advertising, never used by Shy Pug to train anything, and you can ask for their deletion at any time.
Shy Pug (shypug.com) is operated by Vincent Jean, in
Québec, Canada, who acts as the person in charge of the protection of personal information under
Québec's Act respecting the protection of personal information in the private sector (Law 25).
For any question or request: vincent@shypug.com.
| Information | Why |
|---|---|
| Email and password (hashed, never readable) | Creating and securing your account. |
| Your photos and the generated coloring pages | Only to make your coloring pages and your PDF book. Visible only from your account. |
| Anonymized usage data (pages viewed, buttons used, where the visit came from) | Understanding what works and improving the service. Never any photos, emails or typed text in this data. |
| IP address | Limiting abuse (rate limits) and preventing fraud (see below). |
| Fraud-prevention signals — your IP address, browser type, the email domain you sign up with, how interactions are timed, and basic technical characteristics of uploaded photos | Detecting and blocking automated abuse, fake accounts and advertising fraud. This is kept separately from your coloring history, used only to protect the service, and never used for advertising or shared. |
Shy Pug uses no third-party cookies and no third-party trackers — no advertising script is ever loaded on the site. The only things stored in your browser:
| Item | Role | Duration |
|---|---|---|
cadeau_session | Keeping you signed in (essential cookie). | 30 days |
shypug_trial | Counting the 2 free no-account tries (essential cookie). | 1 year |
shypug_attr | Remembering which campaign or ad introduced you to Shy Pug (first visit only) — used for the advertising measurement below. Only set when your visit comes from a campaign. | 90 days |
| Local audience-measurement identifiers | Anonymous internal statistics (first visit, traffic source). No tracking across other sites. | Local storage |
When you discover Shy Pug through one of our ads and use the free trial or create an account, we send the advertising platform your click came from (Meta — Facebook/Instagram — or TikTok) a confirmation of that conversion, from our servers: a hashed (unreadable) version of your email, your IP address, your browser type, and the ad-click identifier. For Google Ads, only the ad-click identifier and the sign-up date are reported. Never a photo, a name or any content. This serves only to measure whether our ads work. No advertising script or cookie from these platforms is ever placed on our site, and nothing is sent to them if your visit didn't come from an ad.
As long as your account exists. If you ask for your account to be deleted, your photos, coloring pages and personal information are removed from our servers within a reasonable time (at most 30 days), unless the law requires otherwise. Fraud-prevention signals (described above) may be kept for as long as necessary to detect and prevent abuse and fraud, which can be longer than the life of an account, since recognizing repeat abuse depends on retaining that history.
Write to vincent@shypug.com — we answer within 30 days. If you are not satisfied with the answer, you may contact the Commission d'accès à l'information du Québec, the privacy authority with jurisdiction over Shy Pug.
Hashed passwords (PBKDF2 with a unique salt), strictly authenticated image access (a leaked image address gives access to nothing without your session), encrypted connections (HTTPS). In the event of a confidentiality incident presenting a risk of serious injury, we will notify you and the Commission d'accès à l'information, as required by Law 25.
Shy Pug is made to delight children, but the account is created and managed by a parent or responsible adult, who remains responsible for the photos uploaded. We do not knowingly collect information directly from children.
If this policy changes in a meaningful way, the date above will be updated and significant changes will be flagged on the site.