1. Children's privacy

The Service is used by parents and guardians. We do not knowingly collect personal information from children: children do not create accounts, make purchases or enter anything themselves.

The only information about a child is what a parent chooses to enter: the child's age range (2–3, 4–5 or 6–8 years) and, optionally, a first name, so that the child becomes the hero of the tale. Please enter only a first name or a nickname — never a surname, address, school, photo or other details.

We do not show advertising, do not build profiles of children, do not use behavioral tracking and do not sell or rent any data.

Parents and guardians can at any time ask us to review or delete a tale or any information about their child, or to stop using it — write to the email address on this page (coming soon). If we learn that we have collected information from a child without a parent's involvement, we delete it.

This approach is designed to follow the U.S. Children's Online Privacy Protection Act (COPPA), the EU and UK GDPR rules on children's data and similar laws in other countries.

Signing in, payments and entering a child's name open only after the visitor tells us their year of birth and is an adult. A tale with a child's name is private: only the family who created it can open it (see section 6).

2. What we collect

Tale settings and content: language, age range, genre, the optional child's name, the three tale ideas shown, the chosen tale, its text, illustrations and narration.

Visitor identifier: a random identifier stored in a cookie for one year, a hash of browser characteristics (screen size, language, time zone and similar) and a hash of the IP address. We use them only to keep the “one free tale per family” limit and to protect the Service from abuse; the IP address itself is not stored.

Account (subscribers): email address and, with Google sign-in, the name and email your Google account shares. Subscription status and limits used.

Payments: Paddle processes payments as the Merchant of Record. We do not receive or store card details; we receive the subscription or order status, a customer identifier and the price.

Usage statistics: anonymous page views and events (for example, “tale created”) via Vercel Web Analytics, which does not use cookies. Tale addresses are removed from statistics.

3. Why we use it

To create, store and show your tales (performance of our agreement with you); to provide the subscription and purchases (contract); to keep the free limit and prevent abuse (legitimate interest); to improve tale ideas from anonymous statistics (legitimate interest); to meet tax and accounting obligations (legal obligation).

We never use tales or children's names for advertising, and we do not use them to train AI models.

4. Who processes data for us

Vercel (website hosting, servers in Frankfurt; anonymous analytics); Supabase (database, file storage and sign-in); OpenRouter and the AI providers it routes to — Anthropic (tale text and safety review), Google (illustrations) and a speech provider for the storyteller voice; Paddle (payments); Google (if you sign in with Google); Cloudflare Turnstile (bot protection, when enabled).

To write a tale, the AI providers receive the tale settings and, if entered, the child's first name. They process this data to return the result and do not use it to train their models under their API terms.

Some providers are located outside your country, including in the United States. Transfers are protected by the providers' standard contractual clauses or equivalent safeguards.

5. Cookies

We use only cookies needed for the Service to work: vid (visitor identifier for the free-tale limit, 1 year) and sb-… (login session, for signed-in users). Paddle may set its own cookies in the payment window, and Cloudflare Turnstile may use them for bot protection. We do not use advertising or tracking cookies, so we do not show a cookie banner.

6. Shared links

Every tale has its own link. A tale without a child's name can be opened by anyone who has the link, so share it only with people you trust. Tale pages are hidden from search engines.

A tale with a child's name is private: it opens only in the browser or account that created it, the “Share” button is hidden for it, and its title is not shown in link previews. Anyone else who opens its link sees only that the tale is private.

7. How long we keep data

We keep data only as long as needed and delete it automatically:

Personal tales — text, illustrations and narration, including the child's name inside the tale — are deleted 24 months after they were created, or earlier at your request. Tales that failed to be created or did not pass the safety review are deleted within 7 days.

Technical records — free-limit counters and the tale ideas shown to you — are deleted after 90 days. The visitor cookie expires after 1 year.

Account data is kept while the account exists and is deleted within 30 days after you ask us to close it. Payment records are kept by Paddle and by us for as long as tax law requires. The Tale of the Month contains no personal data and is kept while it is published.

8. Your rights

Depending on your country, you have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy, and withdraw consent. Write to the email address on this page (coming soon); we answer within 30 days. You may also complain to the data protection authority in your country.

9. Security and changes

Data is transferred over encrypted connections, access to the database is restricted to the Service's servers, and passwords are not used at all (sign-in is by email link or Google).

We will update this policy when the Service changes; the effective date is shown at the top. Important changes are announced to subscribers by email.

We follow a written information security program: access to the database and storage is limited to the Service's servers and the operator, keys are kept only on the servers, providers are chosen for their security and data commitments, and the program is reviewed at least once a year and after any incident.