Privacy policy

1. Who is responsible

The service is operated by StoryMoon (operated by the SongReveal team) ("we"). Operator details will be updated upon company registration. For anything about your data, write to support@storymoon.com.

2. What we collect

We collect only what the books need.

• About you (the parent or guardian): your email address, the sign-in links we send you, your language, and your subscription status. Payments are handled by Lemon Squeezy; we receive the order and subscription details but never your card number.
• About your child: first name, pronouns, age band (2–4, 5–7 or 8–10), book language, a few appearance words (eye, hair and skin colour, glasses), favourites you choose to add (a toy, an animal, a city, a pet's name), the optional note about the week, and up to three photos plus optional photos of favourite objects.
• What we create: the hero portraits, the books, songs and films, and the PDF files.
• Technical data: server logs (IP address, browser, time of request) kept for 30 days for security, and product events such as "book generated" or "error" that we record ourselves, without any third-party analytics.

3. Why we use it, and on what basis

• To draw the hero and produce the books, songs and films you subscribe to — performance of our contract with you.
• To process your child's photos and appearance details — your consent as parent or guardian, given during setup. You can withdraw it at any time by deleting the photos or the account.
• To send the emails the service needs: sign-in links, "your book is ready", the note before the next book, billing notices — performance of the contract.
• To keep the service secure and fix problems — our legitimate interest in running it safely.
• To keep invoices and payment records — legal obligations.

We do not sell data, we do not build advertising profiles, and we do not send marketing email unless you ask for it on the website.

4. Your child's photos

Photos are stored in a private area of our server that is not reachable from the web. They are used for one thing: drawing your child's hero. To do that we pass them to our image provider through signed links that expire within minutes; the provider does not receive your child's name or your email alongside them, and nothing is copied to a public location.

We never use your photos to train AI models, our providers process them only to generate your book, we never show them to other users and we never publish them. The sample children on our website are fictional.

5. Who helps us process data

We use a small number of service providers, each bound by a data processing agreement and only for the purpose listed:

• KIE — image generation (hero and pages) and music generation (the song).
• Anthropic — adapting the human-written text to your child (name, age band, the note about the week) and the automated checks of every image.
• Postmark — delivering our transactional email.
• Lemon Squeezy — payments, invoices and subscription management, as merchant of record.
• Our hosting provider, which runs the server the service lives on.

Some of these providers are based outside the European Economic Area. Where that is the case, transfers rely on the safeguards in the provider's data processing terms, such as the EU Standard Contractual Clauses.

6. How long we keep it

• Photos: while your account exists, unless you delete them earlier from Settings.
• Heroes, books, songs, films and PDFs: while your account exists, so your library stays available.
• Account and child profile: until you delete the account. We remove everything within 30 days of a deletion request; residual copies in backups are gone within 90 days.
• Invoices and payment records: as long as tax law requires, at Lemon Squeezy and in our records.
• Server logs: 30 days.

7. Children

StoryMoon has no child accounts. The account belongs to a parent or guardian, who creates the child's profile and gives consent for the photos. We do not knowingly collect information from children directly, and the reader is designed to be used together with an adult.

8. Your rights

Under the GDPR and similar laws you can:

• See what we hold about you and your child, and get a copy — ask us.
• Correct it — tell us and we fix it.
• Delete it — photos, the child profile or the whole account, from Settings, or by writing to us.
• Withdraw consent for the photos at any time; this does not affect processing that already happened.
• Object to processing based on our legitimate interests, and ask us to restrict processing.
• Complain to the data protection authority in your country of residence.

Write to support@storymoon.com from the email on your account and we will answer within 30 days.

9. Cookies

The app uses one cookie: the session cookie that keeps you signed in. There are no third-party analytics, no advertising trackers and no social-media pixels. The marketing site (this page) sets no cookies at all.

The site loads its fonts from Google Fonts, which means your browser requests the font files from Google's servers and sends its IP address to do so.

10. Security

Everything travels over HTTPS. Photos and generated files live in private storage; the only way to fetch them is through short-lived signed links issued to you or to a provider for a specific job. Access to the server is limited to the team that runs the service.

11. Changes to this policy

We will post changes here with a new date at the top. If a change matters to how we use your child's data, we will email you before it takes effect.