Privacy policy

FairyTales writes personalized bedtime stories for children, with pictures and narration. To do that it handles information about you, your child and your family. This policy explains what we collect, why, who else receives it, how long we keep it, and how you control it.

Who we are. FairyTales is operated by [TO BE CONFIRMED: company legal name], [TO BE CONFIRMED: registered address] ("we"). We decide how your information is used (we are the "controller"). Contact us about privacy at [TO BE CONFIRMED: contact email].

Our representative in the European Union is [TO BE CONFIRMED: EU representative], and in the United Kingdom [TO BE CONFIRMED: UK representative].

Adults only, and your child's information

FairyTales is for adults. Every account holder confirms a date of birth showing they are 18 or older; we check it and throw it away, keeping only the fact and time of the confirmation. Children do not create accounts and do not give us information themselves. Pages a child may see, such as reader mode and shared stories, have no forms, no advertising and no analytics.

Parents and guardians tell us about their children so we can write stories for them. We treat that information as children's information and protect it accordingly: we use it only to make your stories, never for advertising or profiling, and you can delete it at any time.

Children under 13 (COPPA). We do not knowingly collect personal information directly from a child under 13. If we learn that a child has used an account or given us information directly, we close the account and delete that information. If you think this has happened, contact us.

What we collect

Your account

• Your email address, and a password stored only as a one-way hash (we cannot read it). If you choose "Sign in with Google", we receive your email address and Google's confirmation that it is verified, and no password.
• That you confirmed you are 18 or older, and when (not your date of birth).
• That you accepted our terms and this policy, when, and which version.
• Your credit balance and history, purchases and subscription status, and that you confirmed at checkout you are 18 or older and the card holder. Not your card details (see "Who receives your information").
• Your settings, such as a preferred narration voice.

What you tell us about your family, when you describe a character:

• name, age, relationship (for example "little brother"), personality, appearance, and favourite characters;
• photos, if you choose to add them, with your confirmation each time that you are the person's parent or guardian or have their permission;
• for a story: what tonight's story should be about, and anything happening in your child's life right now (for example a new sibling, a fear, or a pet that died). This free text can be sensitive. Only share what you're comfortable with, and don't include medical details, addresses or school names. It may count as health information; we use it only to write that story, and it is deleted with the story.

What we make for you: stories, their pictures, character likeness sheets, narration audio and translations, and your edits to them.

Your actions on stories: your approval of each story (when, and a fingerprint of the text you approved), share links you create and when they expire, and problem reports you file.

Technical and safety records:

• for each story, which AI models were used, how much text and how many pictures they produced, and what that cost — not the content itself;
• short-lived counters keyed by IP address, account or email address, to stop abuse (see "How long we keep it");
• error reports, with request bodies, headers, cookies and IP addresses removed before they leave our servers;
• signals our host uses to tell people from automated bots.

In your browser: before you create an account, what you enter on the home page (including photos) is kept in your browser's local storage so it survives signing up; it is removed when your story starts or when you discard the draft. We use cookies only to keep you signed in and to remember sign-in steps such as the age check and accepting the terms. We use no advertising or analytics cookies.

Photos and likenesses

This section is our notice and written policy for photos and the likenesses we draw from them, including for the purposes of biometric privacy laws such as the Illinois Biometric Information Privacy Act.

• Consent first. Each time you add a photo you confirm you are the person's parent or legal guardian, or that they are an adult who agreed. Without that confirmation the photo is refused. We record the confirmation with the date and the version of this policy.
• Safety check. Every photo is checked by an automated moderation service. Photos with nudity or sexual content are refused. Any sign of sexual content involving a minor blocks the upload, locks the account, and is reported as the law requires; that photo is kept as evidence and not deleted.
• Metadata removed. Photos are re-encoded on upload, which removes embedded data such as location.
• Likeness sheets. When you make a character sheet from a photo, the photo is read once, in memory, to draw an illustrated likeness of the person and a short written description of their appearance. That photo is not stored. The sheet is a drawing, deliberately never photographic.
• Photos kept on a character. [TO BE CONFIRMED: pending FAI-122, which removes this path.] A photo you attach to a character as a picture reference is stored privately with that character, and sent with each story's picture requests so the illustrations look like the person, until you remove the photo or delete the character.
• No faceprints. We do not create, store or use face geometry, face templates, face embeddings or any other biometric identifier. We do not use photos or likenesses to identify anyone.
• Private. Photos and sheets are never publicly addressable. They are served only to the signed-in owner, and a sheet never appears on a shared page by itself (a shared story shows its pictures, which may include the character).
• Purpose. Photos and likenesses are used only to illustrate your stories in FairyTales. Any other use would need your fresh consent first.
• Retention and destruction. A stored photo or sheet is permanently deleted when you remove it, delete its character or delete your account, and in any case within [TO BE CONFIRMED: e.g. 3 years] after your last sign-in. Photos uploaded but never saved to a character are deleted automatically after 24 hours.
• No sale. We never sell, lease, trade or otherwise profit from photos or likenesses, and disclose them only to the service providers below that need them to make your stories, or where the law requires.

Why we use your information

We use your information to provide FairyTales: to create your account, write, illustrate, narrate and translate your stories, take payment, keep the service safe, and meet our legal obligations. We do not sell your information, share it for advertising, use it to build profiles, or let anyone use it to train AI models.

If you are in the EU or the UK, our lawful bases are:

Who receives your information

These service providers process information on our behalf, only to provide the service, under contracts that limit their use of it:

OpenAI does not use data sent through its API to train its models. [TO BE CONFIRMED: the data retention setting on our OpenAI account, and whether zero data retention applies.]

We may also disclose information when the law requires it, to protect a child or anyone else from harm, to report child sexual abuse material to the National Center for Missing & Exploited Children, or to a company that takes over FairyTales, which would remain bound by this policy.

Where your information is. Our app, database and files are hosted in the United States (US East). If you are outside the US, your information is transferred there. For transfers from the EU, the UK and Switzerland we rely on [TO BE CONFIRMED: the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses with the UK addendum].

Shared stories

When you create a share link, anyone who has the link can see that story and its pictures, without signing in. Links expire after 30 days unless you choose 7 days or no expiry, and you can switch a link off at any time. Only stories you have approved can be shared. If someone reports a shared story, the link stops working at once until we have reviewed it.

How long we keep it

Deleting a story removes its pictures, narration, translations and share links. Deleting a character removes its photos and sheet. A deletion reaches backups when they are overwritten.

Getting a copy of your data

In Settings → Download my data you can download everything we hold about you as one ZIP file: your account and consent record, your credit and subscription history, every character with its photos and sheet, and every story with its pictures and narration.

Deleting your data

You can delete any story or character at any time. In Settings → Delete account you can delete everything at once: your account, every character, photo and sheet, every story with its pictures and narration, every share link, and your credit history; any subscription is cancelled. This cannot be undone.

Security, and if something goes wrong

Files are private and served only to their owner, passwords are hashed, traffic is encrypted, and access to our systems is limited to the people who run FairyTales. No system is perfectly secure. If a breach puts your information at risk, we will notify you without undue delay, and the regulator within 72 hours where the GDPR applies, or as other laws require.

Your rights

You can see, download, correct and delete your information yourself in the app. For anything else, email [TO BE CONFIRMED: contact email]. We may need to confirm your identity first, and we answer within one month (GDPR) or 45 days (US state laws).

• EU and UK: you have the right to access, correct, delete, restrict and port your information, to object to processing based on legitimate interests, and to withdraw consent at any time. You can complain to your data protection authority, such as the authority in your country or the UK Information Commissioner's Office.
• California and other US states: you have the right to know what we collect, to access, correct and delete it, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising, and we use sensitive personal information only to provide the service you asked for. If we deny a request you may appeal by replying to our answer.
• Parents can review, change or delete their child's information at any time, as described above.

Changes

When this policy changes we update the version and date below. If a change is material, we tell you and ask you to accept it before you continue.