Privacy Policy

This Privacy Policy explains how Kid Story ("we", "us") handles your personal data when you use our AI children's book generator. We designed the Service to collect as little personal data as possible, and we never ask for photos of children's real faces.

1. Data We Collect

• Account data: your email address, a display name (optional), and a salted, hashed version of your password (we never store the password itself).
• Content data: the books, characters, and toy photos you upload or generate, stored privately under your account.
• Technical data: a login session cookie (strictly necessary) and minimal server logs for security and troubleshooting.
• Product analytics (first-party only): we collect minimal usage events — page visits, sign-ups, logins, and creation activity (e.g. books created, illustrations generated) — to understand how the product is used. Events are stored in our own database, linked to your account and/or a random identifier in your browser's local storage, and may include the marketing campaign that brought you to the site (UTM parameters). We use no third-party analytics services, no advertising trackers, and no profiling for advertising.

We do not use advertising or third-party analytics/tracking cookies. See our Cookie Notice for details.

2. Children's Privacy (COPPA and GDPR-K)

• The Service is intended to be used by adults. Accounts may only be created by users aged 18 or over.
• We do not knowingly collect personal data from children under 13 (or under 16 in the EU), and we do not request photos of children's faces — the product processes photos of toys and generated illustrations only.
• If you believe a child has created an account, contact us and we will delete it promptly.

3. How We Use Data (Legal Bases)

• Contract performance: providing your account, saving your books, and generating illustrations you request.
• Legitimate interests: securing the Service (e.g., login sessions, abuse prevention) and keeping it reliable.
• We do not sell your data and we do not use your content to train AI models.

4. Sharing and Processors

Your content is stored on Cloudflare infrastructure (D1 database and R2 object storage). Illustration and story generation involves sending your prompts and reference images to our AI provider, which processes them solely to fulfill your request. We share data only with these processors as needed to operate the Service, or where required by law.

5. International Transfers

Our infrastructure and processors may process data outside your country. Where required (e.g., transfers out of the EEA/UK), we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Retention

Your books and characters are kept until you delete them or close your account. If you delete content, it is removed from your view and purged from backups on our normal backup rotation. Sessions expire after 30 days of age regardless of activity.

7. Your Rights

Depending on where you live (including the EU/EEA, UK, and certain US states such as California), you have rights to:

• Access the personal data we hold about you (including a copy of your books and characters).
• Correct or delete your data, or delete your account entirely.
• Object to or restrict certain processing, and data portability where applicable.
• Lodge a complaint with your local data protection authority (EU/EEA/UK) or state attorney general (US).

To exercise any right, contact privacy@storynest.example (replace with your support address before launch). We respond within 30 days.

8. Security

Passwords are hashed with PBKDF2-SHA256 and a per-user salt. Sessions use opaque, HttpOnly tokens. Uploaded files are access-controlled per account and are not publicly reachable. No system is perfectly secure, but we design and review our data flows to minimize the impact of any incident.

9. Changes to This Policy

We will post any changes on this page and update the "Last updated" date. For material changes affecting your rights, we will notify you by email or in-app notice.