PRIVACY POLICY

Last updated: 15 October 2026

1. Who is the controller?

Storytime World, Suite 11034, 26–27 Upper Pembroke Street, Dublin 2, D02 X361, Ireland. Email: [email protected].

2. Scope

This Policy explains how we collect, use and protect personal data when you visit the Site or use the App (together, the Services).

3. Data we collect

Voice Data is collected only if you choose to use parent voice narration. Only the adult account holder may record, and only their own voice. Because a voice representation could be used to recognise or imitate a person, we treat Voice Data as special-category (biometric) data under Article 9 GDPR and process it only on the basis of your explicit consent (Article 9(2)(a) GDPR). You give this consent in the App before recording, and you can withdraw it at any time by deleting the voice (see sections 8 and 11).

Website & Advertising Data may be processed only on our website. In the EU/EEA, the UK and Switzerland we ask for your consent in a cookie banner (or in the optional box when you sign up) before any advertising cookies or measurement, and you can change your choice at any time via “Cookie settings” on the website. Elsewhere we measure our advertising by default and you can opt out at any time via “Your privacy choices” on the website; we also treat a Global Privacy Control signal from your browser as an opt-out. To decide which applies, we use the country derived from your IP address by our content-delivery provider (Cloudflare), only for this purpose; if the country is unknown, we ask for consent. Every choice (yes or no, how it was made, the country and the time) is recorded on our servers as evidence. If you install the App from a partner or advertising link, we record within our own systems which campaign brought you to us (section 6).

To protect the Services from abuse and to enforce complimentary usage limits available before a subscription is purchased, we process limited technical identifiers provided by your device’s operating system as part of integrity and security checks.

• On iOS, we use Apple App Attest to generate an app-scoped cryptographic key identifier.

• On Android, we may use an app-scoped platform identifier (for example, ANDROID_ID or an equivalent identifier available on the device) to support abuse prevention. Where used, it is hashed before storage and used only for integrity checks and complimentary usage-limit enforcement.

These identifiers are pseudonymous technical identifiers. On their own, they do not directly identify you or your child by name, but they may be treated as personal data under applicable laws (for example, GDPR) because they can be used to distinguish a device or app installation.

We use these identifiers only to:

• protect the security and integrity of the Services;

• prevent fraud and abuse; and

• enforce complimentary pre-subscription usage limits.

We do not use these identifiers for advertising, profiling, analytics targeting, or cross-app tracking, and we do not access or use the device’s advertising identifier (such as AAID) for these purposes.

We process device integrity data solely within our own systems for security and abuse-prevention purposes. We do not share this data with advertisers, analytics providers, data brokers, or other third parties, and it is not used for cross-app tracking or profiling.

We follow data minimization principles - collecting only the minimum information necessary to provide age-appropriate stories. We do not collect unnecessary personal information from either parents or children.

We collect minimal child data (nickname and birth year) solely to customise story content to age-appropriate levels. This data is provided by parents/guardians, not collected directly from children.

Our legal bases are performance of contract, legitimate interests (including partner referral attribution and our own first-party analytics), consent (for the child profile, and — in the EU/EEA, the UK and Switzerland — for advertising cookies and advertising measurement on our website), legitimate interests with a right to opt out (for advertising measurement on our website elsewhere), explicit consent (for Voice Data), and legal obligation (for tax & safety-related processing). We do not sell your data, we never share your child’s data for advertising. The only advertising-related sharing we may do happens on our website, as described in sections 6 and 13.

4. How do we use the data

• Provide, improve and personalise the Services;

• Generate stories on your request;

• If you choose to record your voice, narrate the stories in your account in that voice. Voice Data is used only to narrate stories for your account. It is never used to train AI models or for profiling or advertising, and your recording and voice representation are never shared with or used for any other account. If you choose to share a story or submit it to Community Stories, other people will hear its narration in your voice;

• Monitor and improve performance and safety;

• Comply with legal obligations;

• Contact you about our service;

• Verify app and device integrity;

• Enforce complimentary pre-subscription usage limits;

• Detect, investigate and prevent fraud, abuse, or circumvention of usage limits;

• Protect the security and reliability of the Services;

• On our website, we may measure whether our advertising led you to create an account, open the App, start a trial or subscribe, and ask Meta to find people similar to our customers (with your consent in the EU/EEA, the UK and Switzerland; elsewhere with a right to opt out); and, for partner links, record which partner brought you to us so that we can calculate commissions (section 6).

5. Communications

We may contact you (the parent/guardian account holder) for the following purposes.

Service and security communications (Contract / Legitimate Interests)

We may send emails, in-app messages or push notifications that are necessary to:

• verify your account;

• send security alerts and suspicious-activity notifications;

• provide important service updates and availability notices;

• send subscription and billing information;

• if you created your account on our website to get a free first story and the App is not installed yet, tell you once by email when that story is ready, with links to the App Store and Google Play;

• respond to your support requests; and

• inform you of material legal or policy changes.

Because these communications are necessary to provide the Service and keep it secure, you generally cannot opt out of them (other than by closing your account or disabling the Service).

Marketing and optional communications (Consent / Soft opt-in) With your consent, or where permitted by applicable law under a “soft opt-in” for existing customers, we may send you:

• surveys and questions about how you use the Service;

• requests for feedback to help us improve;

• news about new features and product updates;

• special offers and promotions;

• educational content, tips and best practices; and

• information about new content or content updates available in the Service.

You can opt out of these marketing and optional communications at any time by using the unsubscribe link in our emails, adjusting your in-app communication settings, or changing your device notification settings. Withdrawing consent (or opting out) does not affect your ability to use the Service or receive essential service and security communications.

We may send these communications by email and, where you have enabled them, by in-app or push notifications. Where consent is required, we will ask for it explicitly and you can change your preferences at any time in your account or app settings.

6. Sharing with third parties

We share data only as necessary with:

• Payment processors: Apple Inc., Google LLC (billing information; subscriptions are bought only in the App Store or Google Play).

• Cloud hosting: Amazon Web Services (EEA, US regions).

• Voice processing: speech recognition and voice synthesis run on our own servers located in Ireland or Amazon Web Services servers located in EU. Voice Data is not sent to any third-party AI provider; recordings and voice representations are stored with Amazon Web Services as described above.

• AI providers: OpenAI LLC, Anthropic PBC (prompts and model outputs processed; no training).

• Analytics: usage statistics and crash logs are collected by our own first-party analytics and stay within our systems; they are not shared with any analytics provider or advertiser.

• Advertising measurement on our website (Meta): We may use the Meta Pixel and the Meta Conversions API on storytime.world to tell Meta Platforms Ireland Limited when a visitor views the website or creates an account on it. In the EU/EEA, the UK and Switzerland we do this only if you accept advertising cookies (in the cookie banner or the optional box when you sign up); elsewhere we do it by default unless you opt out (section 3). Meta may receive the Meta cookie identifiers (_fbp, _fbc), your IP address and browser information, the event time and, when you create an account on the website, a one-way hash (SHA-256) of your email address and a hashed account ID. Our servers then also tell Meta, at 1 hour, 3 hours, 1 day, 2 days and 7 days after you sign up, whether your account has been opened in the App, whether it has started a free trial and whether that trial became a paid subscription, whichever store you used. These reports carry the same hashed email address and hashed account ID and never anything about your child or what you do in the App. We keep the browser identifiers from your signup (_fbp, _fbc, IP address and browser information) for up to 180 days, then delete them. Meta uses this data to measure our advertising, as an independent controller under the Meta Business Tools Terms and its own Privacy Policy (https://www.facebook.com/privacy/policy).

• Similar audiences (Meta “lookalike” audiences): if you created your account on our website, your measurement choice is “on” and you start a free trial or subscribe, we may include a one-way hash (SHA-256) of your email address in a customer list that we upload to Meta, so that Meta can show our advertisements to people similar to our customers. Meta matches the hashes against its own users, uses them only to build the audience and deletes those that do not match, acting on our behalf under its Custom Audiences terms. We are not told who matched. Nothing about your child is included.

  Hashing does not make this data anonymous: Meta can match it to a Meta account you hold. Legal basis: in the EU/EEA, the UK and Switzerland, your consent (Article 6(1)(a) GDPR and the ePrivacy rules on cookies); elsewhere, our legitimate interest in measuring and improving our advertising, with your right to opt out. You can withdraw your consent or opt out at any time via “Cookie settings” or “Your privacy choices” on the website, or by emailing [email protected]; this stops all future data and keeps you out of future customer lists, but we cannot recall data already delivered to Meta.

• Partner and campaign links: If you reach us through a link shared by one of our partners or through an advertisement (for example storytime.world/r/…), the link carries a campaign code. We record which campaign brought you to us, how (website link, app-store install referrer or campaign link) and when, so that we can pay the partner a commission. This stays within our own systems; we share only aggregate figures with partners (for example, how many subscriptions a campaign generated) — never your name, email address or any account data. Legal basis: our legitimate interest in running and paying for partner programmes.

7. International transfers

When we transfer data outside the European Economic Area, we rely on:

• Adequacy decisions under Article 45 GDPR, or

• Standard Contractual Clauses under Article 46 GDPR plus supplementary safeguards.

Data sent to Meta for advertising measurement may be transferred by Meta to the United States under the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

8. Data retention

We may retain a hashed, non-reversible, app-scoped device integrity record separately from your account data for fraud-prevention purposes, to reduce repeat abuse of complimentary usage limits. This record is not used to identify you by name and is not used for advertising or cross-app tracking.

These records:

• are not linked to personal identity;

• are not associated with a user account after deletion; and

• are reviewed periodically and minimized.

This processing is based on our legitimate interest in protecting the Service from abuse.

9. Security

We implement industry‑standard measures such as at‑rest encryption (AES‑256), TLS 1.2+ in transit, server‑side access controls. No system is 100 % secure; please keep your credentials confidential.

Voice recordings and voice representations are stored with server-side encryption (AES-256), are never publicly accessible, and are processed only on our own servers located in Ireland or Amazon Web Services servers located in EU.

As part of our security measures, we perform device integrity checks using operating-system-provided APIs (Apple App Attest and Google Play Integrity). These checks help confirm that requests originate from a legitimate installation of the App and have not been tampered with.

10. Children’s privacy (COPPA & GDPR Art 8)

We do not knowingly collect data directly from children. All accounts must be created by parents/guardians aged 18+. Payment verification through Apple or Google serves as age confirmation. Parents provide limited child information (nickname, birth year) solely to customize story content. Children access stories under parental supervision only and cannot create accounts, make purchases, or generate content. Parents may review, modify, or delete child data at any time through their account settings.

We comply with COPPA by:

• Not collecting data directly from children under 13

• Requiring parental account creation and payment verification

• Providing parents full control over child data

• Not displaying advertising or marketing to children

• Allowing parents to review and delete all child data at any time

The App contains no third-party advertising or analytics software. Advertising measurement may happen only on our website, only for the adult who visits it, with that adult’s consent in the EU/EEA, the UK and Switzerland and with a right to opt out elsewhere. Nothing about your child is ever sent to Meta or any advertising partner.

Parent voice narration is available only to adult account holders, who may record only their own voice. We do not intentionally collect children’s voices. If you believe a child’s voice has been recorded, delete the voice in the App or contact [email protected] and we will delete it.

11. Your rights

Under GDPR (and, where applicable, UK GDPR and CCPA) you have the right to:

• Access your personal data;

• Rectify inaccurate data;

• Erase data (“right to be forgotten”) to the extent permitted by law;

• Restrict or object to processing;

• Port data to another provider;

• Withdraw consent at any time (without affecting past processing). To withdraw consent for Voice Data, delete the voice in the App (Settings → My voices). This deletes the recording and voice representation; narration already generated for existing stories is not removed, and you can delete those stories if you no longer want them. If you want narration in your voice removed from a Community Story you submitted, email [email protected] and we will remove or re-narrate it;

• Withdraw your consent to, or opt out of, advertising cookies, advertising measurement and similar audiences on our website at any time via “Cookie settings” or “Your privacy choices” on the website, or by emailing [email protected]. Future data stops immediately; reports already delivered to Meta cannot be recalled by us, but you can manage how Meta uses data it receives from businesses in your Meta account settings (“Activity off Meta technologies”);

• Lodge a complaint with the Irish Data Protection Commission or your local regulator. Email [email protected] to exercise any right.

Parents/guardians have full control over their child's data and can:

• Access all child data through their account

• Delete child profiles at any time

• Prevent access to community stories

• Review all generated content before sharing

12. California notice (CCPA/CPRA)

We do not “sell” personal information as defined by the CCPA. On our website we share cookie identifiers, website activity and — if you create an account on the website — a hashed email address and hashed account ID, whether that account is opened, starts a free trial or becomes a paid subscription during its first week and, if you start a trial or subscribe, your hashed email address in a customer list for similar audiences, with Meta Platforms Ireland Limited; this may constitute “sharing” under the CPRA. You can opt out at any time via “Your privacy choices” on the website or by emailing [email protected], and we treat a Global Privacy Control signal from your browser as an opt-out. The App does not share personal information with anyone for advertising. Residents may also request disclosure or deletion of any personal information we hold.

13. Cookies and similar technologies on our website

This section applies to storytime.world only. The App uses no cookies and no advertising or analytics software from third parties.

• Essential (always on): cookies or browser storage needed for the website to work — keeping you signed in while you sign up, remembering your measurement choice, the details you type about your child until you create your account (kept only in your browser tab), security and fraud prevention, and the referral/campaign code from a partner or advertising link. Legal basis: legitimate interest / performance of contract.

• First-party analytics (always on, no third parties): we record page views and clicks on our own servers using a random session identifier kept in your browser only for the current tab session. This data is not shared with anyone and is not used for advertising.

• Advertising (where used): we may use the Meta Pixel and Meta Conversions API described in section 6. Cookies: _fbp (up to 90 days), _fbc (up to 90 days). In the EU/EEA, the UK and Switzerland we ask for your consent in a cookie banner before setting any advertising cookies, and you can withdraw it at any time via “Cookie settings”. Elsewhere they are set by default and you can opt out at any time via “Your privacy choices”; a Global Privacy Control signal is treated as an opt-out.

• Sign in with Google or Apple: if you choose “Continue with Google” or “Continue with Apple” when you sign up on the website, Google’s or Apple’s sign-in script is loaded only after you accept our Terms, and Google or Apple may set or read their own cookies for that sign-in under their own privacy policies. We receive your email address and a sign-in identifier from them, as in the App.

14. Changes to this Policy

We may update this Policy periodically. We will notify you of material changes via the App or by email at least 30 days before they take effect.

15. Contact

Questions about privacy? Email [email protected] or write to our address above.