Privacy Policy

1. Who We Are & Contact

Welcome to StoryHoot ("we," "our," or "us"). We create personalized, AI-assisted bedtime stories designed to spark imagination, encourage reading, and bring calm to families at bedtime. We treat your family's privacy and security with the highest level of care and transparency.

If you have any questions, requests, or concerns about your data, you can reach our dedicated privacy team anytime at [email protected].

2. Who StoryHoot Is For (Children's Privacy & COPPA)

StoryHoot is built strictly to be used by parents, legal guardians, and adult caregivers. Children should not create accounts or submit personal information directly.

In full compliance with the Children's Online Privacy Protection Act (COPPA), GDPR-K, and applicable child safety standards, any information regarding a child (such as a first name, age, or bedtime theme) is provided exclusively by the child's parent or legal guardian for the sole purpose of personalizing stories within the parent's account.

3. What We Collect

We collect only the information necessary to provide, personalize, and improve your storytelling experience:

• Account Information: Your name, email address, and authentication credentials when you sign up via Clerk.
• Child Profiles: First name or nickname, age, gender, appearance descriptions, favorite interests, and optional reference photos that you provide to personalize bedtime stories.
• Story Content: Your story prompts, chosen themes, generated stories, accompanying illustrations, and synthesized narration audio.
• Optional Family Voice Recordings: If you choose to generate a personalized bedtime narration voice, you provide a short voice sample and a spoken consent confirmation recording. For your family's privacy, we retain only a secure cryptographic fingerprint (hash) of the consent recording to verify authorization—we never retain the spoken consent audio itself.
• Payment Information: All billing, credit card numbers, and payment details are securely processed directly by Stripe. StoryHoot never sees, processes, or stores your credit card number.
• Usage Analytics: Aggregated, privacy-focused usage data via Google Analytics (GA4) to understand which features help families at bedtime. We configure GA4 without child names, story prompts, story titles, story text, or user IDs.

4. Children's Photos & Likeness

When you choose to upload a photo of your child for custom character illustrations, we apply strict safeguards:

• Purpose-Limited: Uploaded photos are used solely to write a text appearance description and serve as a visual reference for generating personalized storybook illustrations.
• Private & Secure: Photos are stored privately in encrypted cloud storage, are never accessible to the public, and are visible only within your authenticated account.
• Parental Consent Required: Explicit parental/guardian consent is required and recorded before any photo upload can proceed.
• Deletable at Any Time: You can remove your child's photo at any time from your child profile in the app, which immediately and permanently deletes the file from our storage servers.
• No AI Model Training: We never use your child's photos, likeness, name, or profile to train or fine-tune public artificial intelligence models.

5. How We Use Artificial Intelligence

StoryHoot uses Google Gemini to generate creative story text, beautiful bedtime illustrations, and natural-sounding audio narration based on the prompts and preferences you select.

All AI generation is executed with robust, multi-layer child safety filters enabled to prevent inappropriate themes, violence, or sensitive content. Our AI partners process data securely via enterprise APIs under strict confidentiality agreements and do not use your family's private story inputs to train public foundation models.

6. Story Sharing & Community

Private by default: Every story, image, and narration you create is completely private to your account.

• Share Links: If you wish to share a story with family members (such as grandparents), you can create an unlisted share link. For free accounts, share links expire automatically after 48 hours. Shared story pages are excluded from web search engine indexes and never display your child's photo or profile details.
• Community Publishing: Submitting a story to the StoryHoot Community library is completely optional and always subject to human and automated review before being made visible to other families.

7. Service Providers (Sub-Processors)

We work with selected, reputable service providers who process data on our behalf under strict data processing agreements:

8. Cookies & Analytics

StoryHoot uses minimal cookies to keep your experience secure and intuitive:

• Essential Cookies: Required for secure sign-in, maintaining your authenticated session, and security protections.
• Analytics Cookies (Google Consent Mode v2): For visitors located in the European Union, European Economic Area, the United Kingdom, and Switzerland, Google Analytics (GA4) cookies are enabled only if you grant consent. Visitors outside these regions can also manage their preferences.
• Zero Advertising: We never display third-party advertisements or sell user data. Advertising storage is permanently disabled.
• Cookie Settings: You can review or change your cookie preferences at any time by clicking the "Cookie settings" link in our website footer.

9. Data Retention & Deletion

You have full control over your family's data at all times:

• In-App Deletion: You can delete any child profile, reference photo, or story from the app at any time. Deleted assets are immediately removed from storage.
• Account Deletion & 30-Day Grace Period: You can delete your account from your account Settings. When initiated, your account enters a 30-day grace period during which you can cancel deletion simply by signing back in. After 30 days, your account, child profiles, stories, images, and audio are permanently and irreversibly erased from all active databases and storage buckets.
• Data Export: You can export your stories and account data from the Settings page at any time before deletion.

10. Your Rights (GDPR, UK GDPR & COPPA)

We respect your privacy rights under international privacy laws, including the European Union and UK General Data Protection Regulation (GDPR / UK GDPR) and the U.S. Children's Online Privacy Protection Act (COPPA):

• Access & Portability: You may request a copy of the personal information we hold about you and your child.
• Correction & Erasure: You can correct inaccuracies or request deletion of your account and related information.
• Restriction & Objection: You have the right to object to or restrict certain types of data processing.
• Parental Rights under COPPA: Parents and guardians may at any time review their child's personal details, request deletion, and refuse further collection or use.
• Supervisory Complaints: If you reside in the EU or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

You can exercise these rights directly within your account Settings or by contacting us at [email protected].

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect improvements to StoryHoot, evolving AI features, or legal requirements. When updates are published, we will revise the "Effective date" at the top of this page. For significant updates, we will provide noticeable notice within the application or via email.