Privacy Policy

Last updated: April 2026

1. Information we collect

Account information

• Email address and password (stored as a secure hash — we never store your actual password).

Family profiles

• Children's first names and age bands (e.g. 4–5 years).
• Story preferences you choose: writing style, tone, interests, and content values.
• Appearance descriptors if you opt in to AI profile portraits (requires parental consent).

Content you create

• Story text, cover art, illustrations, and audio narration generated for your family.
• Any edits you make to story titles or text.

Usage data

• Playback history (which stories were played and when).
• Anonymous page views and events via Google Analytics (see Cookies section below).

Payment information

• Payments are processed by Stripe. We never see or store your full card number.

2. How we use your information

• To generate personalised stories, audio narration, and illustrations for your children.
• To manage your account, subscriptions, and credit balance.
• To improve our service based on anonymous, aggregated usage patterns.
• To send you essential account notifications (e.g. payment confirmations, password resets). We do not send marketing emails unless you opt in.

3. How AI is used

We use artificial intelligence and machine learning technologies to create personalised stories for your family. We never send your email, password, surname, or any identifying family information to AI services.

• Story text: AI generates story text based on your child's first name, age band, interests, tone, and any story context you provide.
• Images: AI generates cover art, character illustrations, and page images based on story scene descriptions and age band. We never send children's names for image generation. Profile portraits require explicit parental consent.
• Audio narration: AI converts story text into spoken audio. Only the story text is sent — no child names, ages, or personal information.
• Data retention: Our AI providers do not use your data to train their models and do not retain data beyond what is needed to process your request.

4. Cookies and tracking

We use a small number of cookies to make the service work and to understand how it is used.

Cookie	Purpose	Type	Duration
wayfable_session	Keeps you logged in	Essential	Session
_ga, _ga_*	Anonymous page views and usage	Analytics	2 years

• We do not use advertising or tracking cookies.
• No personal data is sent to Google Analytics.
• You can block analytics cookies in your browser without affecting the service.

5. Third-party services

• Stripe — processes payments securely. We never handle your card details.
• Google Analytics — collects anonymous usage statistics.
• AI service providers — generate story text, images, and audio as described in Section 3.
• Yoto — if you connect your Yoto account, we send story audio and metadata when you push a story. You can disconnect at any time from Settings.

6. Children's privacy

• Accounts are created by parents or guardians, not by children.
• We collect only the minimum data needed: a child's first name and age band.
• AI profile portraits require explicit parental consent.
• We never contact children directly.
• We never use children's data to train AI models.
• We never sell or share children's data with third parties.

7. What we don't do

• We never sell or share your data for advertising or marketing.
• We never use your data to train AI models.
• We do not build advertising profiles based on your usage.
• We do not send unsolicited marketing emails.

8. Data storage and security

• All data is stored in a secure database on our servers.
• Audio and image files are stored in a protected directory.
• Passwords are hashed using industry-standard algorithms.
• All connections are encrypted via HTTPS.
• Payment data is handled entirely by Stripe and never touches our servers.

9. Data deletion

• You can delete your entire account from Settings > Delete Account.
• You can delete individual child profiles, removing their stories, audio, and AI portrait.
• Deletion permanently removes all associated data from our servers.
• Yoto cards already pushed remain on Yoto's servers — delete those from the Yoto app.
• You can also email us to request data deletion at any time.

10. Your rights (UK GDPR)

If you are in the United Kingdom or European Economic Area:

• Access — request a copy of your data via Settings > Export Data, or email us.
• Rectification — edit your children's profiles and preferences at any time.
• Erasure — delete your account or child profiles from Settings, or email us.
• Data portability — your export is provided as a JSON file.
• Withdraw consent — opt out of consent-based features (e.g. AI portraits) at any time.
• Restrict processing — contact us to limit how we use your data.
• Object — object to processing based on legitimate interests at any time.
• Lodge a complaint — contact the ICO at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through a notice on the service.

12. Contact

The data controller is Wayfable Stories. For privacy questions, data access requests, or deletion requests:

[email protected]

We respond to all data requests within 30 days, as required by UK GDPR.