Storynest — Privacy Policy

Effective date: 2026-07-20 Last updated: 2026-07-20

Storynest ("we", "us") is a bedtime story app for families. This Privacy Policy explains what information we collect, why, and the choices you have. If anything here is unclear, write to us at support@trystorynest.app.

1. Who this policy is for

Storynest is designed for parents and legal guardians of children aged 2–8. The parent is our customer and the account holder. Children do not sign in, do not enter data, and do not interact with any online service directly — every request is made by the parent's account.

If you are under 18, please do not use Storynest. If you are a child under 13 (US) or under 16 (EU/EEA) reading this alone, please ask a parent to speak to us.

2. What we collect

From the parent (you)

• Account: email address and password. Password is stored hashed by our authentication provider (Supabase). We never see it in plain text.
• Subscription state: whether you are on the free plan, trial, or premium; renewal dates. Provided by RevenueCat via the App Store or Google Play.
• Device: anonymous device identifier for crash reporting and analytics.

About your child (entered by you)

• Child's first name
• Age (2–8)
• Favorite animal, favorite color, dream profession
• Chosen story world
• Optional bedtime hour
• Stories generated for the child, including the text, audio narration, and any character reference image

We do not collect: child's last name, address, phone, school, photo, biometric data, or precise location. We do not track children's usage separately — analytics events reference your (parent) account only.

From your device

• App version, OS version, language setting
• Crash reports (Sentry) — includes stack traces and app state at time of crash, no personal data
• Product usage events (PostHog) — e.g. "story generated", "paywall shown". Tied to your parent account, not your child.

3. Why we use it

• Provide the service: create personalised stories, remember previous adventures for continuity, play audio, unlock premium features.
• Improve quality: aggregate analytics to see which features parents value, fix crashes.
• Bill: confirm your subscription is active via the App Store / Play Store receipt.
• Communicate: send optional bedtime reminders (only if you set one), respond to support requests.

We do not:

• Sell your data or your child's data.
• Show any advertising, ever.
• Share data with third-party ad networks or data brokers.
• Use your child's data to train AI models.

4. AI content generation

Every story is generated by OpenAI's language and speech models on our behalf, using the child's profile (name, age, preferences) as context. OpenAI processes the request under a zero-retention agreement — they do not train on API inputs.

Illustrations, when enabled, may be generated by Replicate (Flux Schnell). Same zero-retention treatment applies.

Every generated story passes through automatic moderation before it reaches the child.

5. Who we share data with

• Supabase (authentication, database, storage, edge functions) — our infrastructure provider.
• OpenAI (story text + narration) — processor.
• Replicate (illustrations, if enabled) — processor.
• RevenueCat (subscription management) — processor.
• PostHog (product analytics) — processor.
• Sentry (crash reporting) — processor.
• Apple / Google — for App Store / Play Store purchase processing.

Each of these providers is bound by their own contracts to only use the data to provide the service, not for their own purposes.

We may disclose data if required by law, subpoena, or to protect rights and safety.

6. Where data is stored

Data is stored on Supabase infrastructure (primary region: EU) and processed by the third-party services listed above, which may operate in the United States and elsewhere. By using Storynest you consent to this cross-border processing where lawful.

7. How long we keep data

• Active accounts: for as long as the account is open.
• Stories, audio, illustrations: for the lifetime of the account.
• Crash and analytics data: rolling 90 days.
• After account deletion: we permanently delete all child profiles, stories, audio, and derived data. Backups are purged within 30 days.

8. Your rights

You can, at any time, from within the app:

• Access & export all your data as a JSON file (Profile → Data).
• Delete your account and all associated data (Profile → Delete account).
• Withdraw consent by deleting your account.
• Change languages and preferences.

You also have rights under GDPR/GDPR-K (EU/UK), COPPA (US), and similar laws to correction, restriction, and complaint to a supervisory authority.

To exercise any right or ask a question, email support@trystorynest.app. We respond within 30 days.

9. Children's privacy (COPPA / GDPR-K)

We designed Storynest to comply with the Children's Online Privacy Protection Act (US, COPPA) and Article 8 of the GDPR (EU/UK, GDPR-K).

• Only a parent or legal guardian creates the account.
• Consent is captured before any child information is stored (onboarding preview screen).
• Children do not have direct access to online services, do not create accounts, and do not enter data.
• We collect only the minimum needed to personalise stories.
• We do not condition participation on providing more information than reasonably necessary.
• Parents may review, delete, and refuse further collection of their child's information at any time from within the app or by writing to us.

10. Security

We use industry standard measures: TLS in transit, encrypted storage at rest, hashed passwords, row-level security on our database, private signed URLs for media, and audited third-party processors.

No system is perfectly secure. If you suspect an account issue, contact support@trystorynest.app immediately.

11. Changes to this policy

If we make material changes, we will notify you in the app and update the "Last updated" date. Continued use after 30 days constitutes acceptance.

12. Contact

Storynest — Privacy Email: support@trystorynest.app

For EU/UK users, our representative can be reached at the same address.

This policy is provided in English and Turkish. Where a conflict arises, the English text prevails.