Privacy Policy

Account Information

Your name, email address, and password (hashed) to create and manage your account.

Child Profiles

First name, learning level, age range, and pronouns. We deliberately do not collect surnames, addresses, or school details for children.

Photographs (with Consent)

Reference photos of a child, uploaded only after explicit parental consent. These are used solely to generate personalised book illustrations. EXIF metadata (GPS coordinates, device information, timestamps) is automatically stripped on upload.

Usage Data

Basic analytics such as pages visited and features used, to improve the service. We do not use third-party tracking scripts.

Parental Consent

Before any child photograph can be uploaded, the parent or guardian must provide explicit, informed consent through our consent wizard. Consent records are immutable and cannot be edited or deleted, creating a full audit trail.

Minimal Data Collection

Child profiles contain only a first name, learning level, age range, and pronouns. No surnames, no school details, no location data.

Photo Usage

Reference photos are used exclusively to generate consistent character illustrations in educational books. Photos are encrypted at rest and served via time-limited pre-signed URLs (15-minute expiry) in production.

Upload Safety Screening

Every uploaded photo is safety-screened by OpenAI (United States) before it is stored— an automated moderation check that protects children. The photo is used only for that check. OpenAI's published API terms state that data submitted through their API is not used to train their models.

Text Generation

Story text is generated using Anthropic's Claude API (United States). The child's name is replaced with a placeholder before sending and re-inserted on our servers; their age, pronouns, learning level, and selected topic are included to personalise the story. No photos accompany these story-text requests.

Image Generation

Creating an illustration involves two separate overseas transfers: the child's reference photo is sent to Anthropic (United States) for appearance analysis, and then to the image provider — OpenAI (United States) as our primary provider, or Google Gemini (United States) as a fallback — to generate the illustration. Reference photos are provided at inference time only, included in the API request to guide the illustration. We use these providers on their paid API tiers, whose published terms state that data submitted through the API is not used to train their models.

No Model Training

We use every AI provider on its paid API tier, whose published terms state that data submitted through the API — including photographs — is not used to train the provider's foundation models. We specify the paid tiers deliberately: some providers permit training on data sent through their free tiers, so we do not use those for your child's data. We rely on those published terms alongside our own technical safeguards. We want to be precise about the limits of that assurance: we cannot independently audit a provider's internal systems, and we do not hold a separate zero-retention arrangement with them, so their published terms govern how long they hold API data.

Australian Data Residency

All personal data and biometric data (photographs) are stored exclusively in Australian data centres (Sydney region). This includes our database (Supabase Sydney) and file storage (Supabase Storage Sydney). Your child's stored data stays in Australia. There are three transient exceptions, each a distinct transfer overseas:

• At upload, the photo is safety-screened by OpenAI (United States) before it is stored.
• At story generation, a placeholder-substituted prompt (including the child's age and pronouns, but never their name and never a photo) is sent to Anthropic (United States).
• At illustration generation, the reference photo is sent to Anthropic (United States) for appearance analysis, and then to OpenAI (United States), or Google Gemini (United States) as a fallback, to generate the image.

These transfers are transient, and we use these providers on their paid API tiers, whose published terms state that data sent through the API is not used to train their models (see “AI & Image Processing” above).

Encryption at Rest

All data is encrypted at rest. API keys and sensitive credentials are additionally encrypted using AES-256-GCM before storage. Photographs are encrypted via the storage provider's server-side encryption.

Access Controls

In production, photos are served via pre-signed URLs that expire after 15 minutes. Role-based access control (RBAC) with granular permissions ensures only authorised users can access child data.

EXIF Metadata Stripping

All uploaded images are automatically stripped of EXIF metadata, including GPS coordinates, device information, and timestamps, before storage. Stripping is enforced at the storage layer, so no upload path can bypass it, and we can run an on-demand audit across stored files to confirm none persists.

Generation Logs

AI generation prompts and responses are stored only for sample demonstration profiles, used solely for internal quality and safety review, and automatically deleted after 30 days. We do not retain generation prompts or responses created for a real child's profile.