Astory Privacy Policy
This English text is the authoritative privacy policy. Localized UI strings in the app summarize the same points and do not replace this page.
Astory is a parent-managed children’s story app. A parent creates one account. Children pick an avatar and supply five words to hear an age-banded story. This policy explains what data we access, collect, use, and share.
Data we collect
- Parent account: email address, password (stored hashed by our auth provider), optional display name, preferred language, optional parent PIN hash, consent timestamp.
- Child profiles: nickname, birth year (not a full birthday), emoji avatar.
- Stories: the five words, generated title and story text, linked to the child profile.
- Usage counters: monthly successful and failed story generation counts per parent.
- On-device preferences: active child id and wait-activity choice stored locally on the phone.
We do not collect photos, precise location, contacts, payment card data, or advertising identifiers. We do not show ads or sell personal data.
Microphone
The microphone is used only when a parent or child holds Speak, to convert one spoken story word into text. Recognition is requested on-device. We do not store audio recordings on our servers.
How stories are generated (sharing with Google)
When a story is created, the five words, age band, and language are sent from our EU Supabase backend to Google Gemini. A facts pass may use Google Search grounding. The child’s nickname is not included in the model prompt. Gemini safety filters are enabled. Google processes that content as our subprocessor under Google’s generative AI terms; we do not control Google’s own log retention beyond what those terms allow.
Subprocessors
- Supabase — authentication, database, and edge functions (EU region).
- Google — Gemini story generation and optional Search grounding; on-device speech/TTS engines on many Android devices.
- Cloudflare — website hosting, DNS, transactional auth email delivery, and inbound routing for privacy mail.
Legal basis (GDPR)
We process parent account data to perform the contract of providing the service, and children’s profile/story data based on the parent’s consent and our legitimate interest in providing age-appropriate stories. Parents can withdraw consent by deleting the account.
Retention and deletion
Data is kept while the parent account exists. Parents can delete a child profile or the entire account in the app (Parent area). Deleting the account removes the auth user and cascaded profiles, children, stories, and usage counters. You can also request deletion via the web deletion page. Email deletion requests sent to info@astory.me from the account email are handled within 30 days after we verify ownership.
Access and export
Parents can download a copy of their account data (profile without PIN hash, children, stories, and monthly usage) from the Parent area → Download my data. You may also email info@astory.me to exercise access or other GDPR rights.
Children
Astory is designed for families. Children do not create accounts or type passwords. Parents control setup, settings, export, and deletion.
Contact
Privacy questions and data rights: info@astory.me
Related: Terms of service · Delete account