Privacy policy

Whose account it is

Only an adult has an account. Children have no accounts and use Tale Forge together with the adult. Everything in the account – child profiles, heroes and stories – belongs to the account holder. Our staff look at a family's stories only to fix a problem or answer a request you sent.

What we keep and why

• Account: email address and sign-in (passwords are stored only as an unreadable hash, or Google sign-in; then we receive your name, email and a link to your profile picture from your Google account). The sign-in service records the time and IP address of sign-ins for security. Basis: contract and, for security, legitimate interest.
• Child profile: first name or nickname, age, interests and language, to tailor the stories. Basis: see Your child's data below.
• Hero: chosen looks and the drawn illustration, so new stories get the same hero. Basis: see Your child's data below.
• Stories: text, choices, pictures, narration, things the child's world remembers, and the answer to the talk question if you save it. Pictures and audio are private and open only for your signed-in account. Basis: see Your child's data below.
• Notes about the day (optional): what you write is sent to the story-text AI service and turned into a made-up story; the AI is instructed to replace real names (except the hero's), places and schools. The note stays in the parent area until you delete it. Do not include health or other sensitive information, or information about other children or adults. Basis: contract and legitimate interest. [DRAFT – this handling is being assessed in our impact assessment.]
• Parent code: stored only as a hash. Basis: contract.
• Story allowance and payments: stories left, reservations and, once payments start, the subscription status at Stripe. Card details never reach us. Basis: contract and bookkeeping law.
• Ad measurement (optional, off by default): if you came here from an ad in ChatGPT and say yes, OpenAI learns whether the ad led to an adult account being created or to the account's first paid subscription starting. What is sent is a start signal when measurement starts and the event itself, for subscriptions also the plan and the amount paid, a pseudonymous event id, the time, the website's address, the ad reference from the ad link and a random browser id. As with any request over the internet, the IP address and browser information also reach OpenAI. Never names, email, children's details, photos, stories or anything you write. On the account we note that the event has been reported so that it counts once. You can change your mind at any time in the parent area or at the bottom of this page. Basis: consent.
• Support requests: category, email address, your messages and our replies. Basis: contract; for people without an account, legitimate interest; for requests about your rights, legal obligation.
• Withdrawal requests: name, email address, the subscription concerned, the time and the receipt we sent. Basis: legal obligation (Swedish distance selling law) and legitimate interest in being able to show what was requested.
• Technical cost and timing data for each AI call (token, character and image counts, timings, model), linked to an account id but never to story text. Timings, model and token counts are also sent, with the story id, to Langfuse (EU). Basis: legitimate interest (operations and cost control).
• Error reports (Sentry, EU): from the server only the error type and which job failed, without ids, names or text. Browser errors and usage statistics (PostHog, EU) are sent only if you switch it on in the parent area on that device. The statistics carry a random device id and the story id but no person profiles, no IP address, no location and no screen recording, so they are pseudonymous rather than fully anonymous. Never names, story text, photos or email. Basis: legitimate interest and consent respectively.

Your child's data

The contract is between us and you as the adult; the child is not a party to it. We therefore process the child's data because you and we have a legitimate interest in creating the stories you order for the child, and we give the child's interests particular weight: only what the story needs, private storage, no advertising, no profiling and deletion whenever you want. The rights belong to the child; as the parent or guardian you exercise them for the child, and a child who has grown up can ask for the data to be deleted themselves. [DRAFT – the legal basis for the child's data is to be settled in our impact assessment.]

Photo for the hero (optional)

If you start from a photo, it is shrunk in your browser and sent once to Google's Gemini API to draw an illustration. We do not store the original photo. Illustrated drafts are saved in your account; you choose which becomes the hero. Under its published terms Google keeps requests, including the photo, for up to 55 days to detect abuse. Without a photo we draw the hero from the looks you choose. Basis: your consent, given in the form.

Providers that process data for us

• Microsoft Azure: our server in Sweden Central (EU).
• Azure OpenAI: writes the story text. The resource is in Sweden Central, but the deployment type is Global Standard, so calls may be processed in any Azure region, including outside the EU. Under its terms Microsoft does not use the content to train models; what is stored for abuse monitoring stays in the resource's geography.
• Google Gemini API: checks text, draws pictures and portraits, and is the backup for text and voice. Our Google project has billing enabled, so Google's terms for paid use apply: the content is not used to improve Google's products, but requests are kept for 55 days to detect abuse and may be processed in any country where Google has facilities.
• ElevenLabs: narration of the story text. Data is stored in the USA. ElevenLabs keeps each narrated text and its audio in a history in our account with them. We delete that entry as soon as we have received the audio, and retry automatically if the deletion fails. For our account, use for model training and Share to Explore are switched off.
• Supabase: sign-in, database and private files, in London (United Kingdom, which has an EU adequacy decision). Supabase Inc. in the USA may access the data for operations and support under the EU standard contractual clauses.
• Resend: sign-in, support and receipt emails. Sending uses an EU region, but Resend's primary processing takes place in the USA. Email logs are kept for 30 days.
• Google Workspace: our email, where messages to support@ and privacy@ arrive.
• Stripe: payments and subscriptions once introduced.
• Sentry (EU), PostHog (EU, consent only) and Langfuse (EU, technical data only).

Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework or the EU standard contractual clauses. We don't sell data, show no ads in the app and don't train any AI models of our own on your stories. Data is not used for advertising, except for the optional ad measurement above, which concerns only the adult's account and payment. How the providers may use the content is described above.

Ad measurement (only with your consent): OpenAI is not our processor. We and OpenAI are jointly responsible for collecting the data on our website and sending it to OpenAI; OpenAI alone is responsible for its further processing, for example counting the ad's results, under OpenAI's privacy policy (openai.com/policies). The data may be processed in the USA. You can send questions and requests about your rights to us and we will help you onward.

How long

• Account, child profiles, heroes and stories: until you delete them or the account (see Deletion below).
• Support requests: category, email address, your messages and our replies remain even if the account is deleted; the account link is then removed. Ordinary closed requests are automatically deleted after 12 months without activity. Billing, privacy and withdrawal requests, cases under a legal hold and cases with unresolved email delivery are excepted; closed billing and privacy requests without a hold have a technical safeguard (a technical upper bound) at the end of the tenth calendar year after the last event. [DRAFT – the ten-year bound is a technical safeguard; the justified retention period per case category under storage limitation must be determined.]
• Withdrawal requests: remain even if the account is deleted, so we can show what was requested, and have a technical safeguard (a technical upper bound) at the end of the tenth calendar year after the last event unless under a legal hold. [DRAFT – the ten-year bound is a technical safeguard; the justified retention period under storage limitation must be decided.]
• Cost and timing data: while the account exists; deleted with the account.
• Timing data at Langfuse: deleted automatically after 30 days.
• Ad measurement: OpenAI's cookies on this website last 30 days (the ad reference and the consent choice) and 1 year (the browser id) and are removed when you switch ad measurement off. How long OpenAI keeps the measurement is decided by OpenAI. The note on the account that an event has been reported is kept as long as the account exists.
• Error reports (Sentry) and usage statistics (PostHog): in our accounts with these providers, error reports at Sentry are kept for 90 days (Business plan) and events at PostHog for up to 7 years under PostHog's paid plan. [DRAFT – the retention period is not confirmed as final under storage limitation and must be set before the public launch.]
• Log of what our staff do in an account (for example added stories): remains after the account is deleted and has a technical safeguard (a technical upper bound) at the end of the tenth calendar year, provided the support or withdrawal record it concerns no longer exists. [DRAFT – the ten-year bound is a technical safeguard; the justified retention period under storage limitation must be decided.]
• Server logs: technical lines about each AI call (story id, time, provider) and error codes, without story text, are kept for 30 days. Lines from before 13 October 2026 are removed when the server's system log rotates. The web server's access log is kept for 14 days without IP addresses.
• At providers: under their terms Google keeps requests for 55 days and Resend keeps email logs for 30 days. ElevenLabs: each narration is deleted from the history as soon as we have the audio, and all older entries in the account history were deleted on 13 October 2026.
• Payment bookkeeping records: 7 years under Swedish bookkeeping law (at Stripe and in our books).
• Backups: we have made encrypted recovery copies of the database contents, account details including password hashes and the private files. They are kept in private storage at Microsoft Azure, separate from normal operation, so that we can restore the service after a failure. Data you delete may therefore remain in these copies. Our database provider Supabase may also keep its own copies as part of its operation.
• Backups are automatically pruned after 30 days, but the latest two copies are always kept. Media archives remain while any retained database backup needs them. Pinned recovery copies are excluded from automatic pruning and may therefore remain longer.

Deletion

• In the parent area you can delete a story, a child profile or the whole account. You can only delete what belongs to your own account. Deletion removes stories, pictures, audio and profiles from the database and file storage.
• If a story, picture or narration is still being made, or files cannot be removed, the deletion stops before it is finished. Whatever was not yet deleted remains, and you can try again later or contact us.
• An account that has or has had a subscription, or where a purchase was started, cannot currently be deleted in the parent area. Send a request in the Privacy category on the help page or email privacy@tale-forge.app, and we will delete the account for you. Bookkeeping records are kept as described above.
• After a deletion, data may remain in backups, support requests, withdrawal requests, the staff log, server logs and at providers (for example Google's abuse log), as described above.

Your rights

You can request access, correction, deletion, restriction and portability, and object to processing based on legitimate interest. Delete in the parent area as described under Deletion, or send a request in the Privacy category on the help page, or email privacy@tale-forge.app. You can get a copy of the data on request. You exercise the rights concerning your child's data for the child. We reply within one month. You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Storage on your device

The app stores your sign-in (sb-*), language (tf-lang), reading preferences (tf-reduce-animations, tf-reader-paper, tf-reader-size), unlocked parent session (tf-pin-ok) and – only if you switched it on in the parent area – your choice and a random pseudonymous statistics id (tf-analytics, tf-aid) in your browser's localStorage/sessionStorage. Your ad measurement choice is stored as tf-ads. Only if you said yes to ad measurement does OpenAI's measurement script store three cookies on this website: __oppref (the ad reference, 30 days), __oaiq_consent (your consent, 30 days) and __obref (a random browser id, 1 year). These are needed for the app to work according to your choices, except the statistics id and OpenAI's cookies, which exist only with your consent. Without that consent no cookies are used for advertising or tracking. Fonts are served from our own website.

Changes

A new version gets a new version number here. If we change something you consented to, we ask again.