KidStory Privacy Policy and Children’s Data Notice

Version and effective date: September 2, 2026

KidStory is a family story creation, reading, and narration service. A parent or guardian must create and manage the family, make purchase decisions, and consent to child-related processing.

Information we process

• A random family identifier, sessions, hashed recovery credentials, timestamps, and security audit facts.
• A child’s family nickname and age band. Exact birth dates are not collected by the server.
• Parent-entered story ideas and preferences, language, generated text and audio, safety results, library, and favorite state.
• Apple product, order, transaction and subscription identifiers, entitlements, credits, and refund or revocation status. KidStory does not receive full payment-card details.
• Push notification device tokens, locale, and notification preferences when notifications are enabled.
• Feedback text and, when the parent chooses, app version, device, system, language, request ID, or story ID.
• Limited first-party product events only with separate analytics consent. Story text, story ideas, and child nicknames are excluded, and KidStory does not use advertising or cross-app tracking SDKs.

How information is used

We use information to create and recover a family, generate and save stories, synthesize narration, provide Daily Story, enforce consent and safety controls, verify Apple purchases and credits, deliver requested notifications, respond to feedback, provide exports and deletion, secure the service, and—with separate consent—understand feature use.

Service providers and transfers

Necessary story inputs are sent to DeepSeek for text generation, and story text is sent to Volcengine Doubao Speech for narration. Apple processes App Store purchases and push delivery. Infrastructure providers host the service. These providers process data only for their respective service functions; KidStory does not sell children’s personal information or use it for targeted advertising.

Retention

Personalized story text is retained until the parent deletes the story or account, subject to legal obligations. Personalized server audio is normally retained for about 30 days after it becomes ready. Sessions last 30 days. Recovery credentials may remain valid for up to five years unless rotated, revoked, or the account is deleted. Necessary transaction, credit, fraud-prevention, and audit records may be retained in minimized form where required for law or dispute handling.

Parental choices

Parents can separately grant or withdraw consent for personalized generation, natural voice, cloud retention, and first-party analytics. In Parent Area → Privacy & Consent, a parent can export data, delete stories or child profiles, and request account deletion. Account deletion immediately revokes sessions and recovery credentials, then deletes or de-identifies eligible data.

Security and contact

KidStory uses encrypted transport, hashed credentials, device Keychain storage, least privilege, family-scoped access controls, and database row isolation. No system can guarantee absolute security. For privacy questions, use Parent Area → Feedback & Support or email support@johnnyself.com. Do not send child information through public App Store reviews or email. See KidStory Support.