Privacy policy

Updated: September 2026

1. Who is the data controller

Controller: TaleBud, España. Privacy contact: hola@talebud.com.

2. What we process, why, and on what legal basis

• Child data on the device (first name, age, avatar, progress, stories and settings): stored in your browser's local storage. Purpose: to run the app and adapt to their level. Legal basis: performance of the service requested by the adult.
• Family voice recordings (if an adult records themselves reading a story): stored only on the device and never uploaded to the cloud or to any provider. They are deleted when you delete the story or clear the site data in your browser. Legal basis: consent.
• Adult account (email and hashed password): only if you choose to create one. Purpose: to identify you and sync profiles across devices. Legal basis: performance of a contract.
• Trial emails: if you create an account, we email you at most 4 times during the free trial (welcome, 2 days left, second week starting and trial ending). Every email has a one-click unsubscribe link. Legal basis: performance of a contract and legitimate interest in telling you about the service you use.
• Content sent to AI (see section 3). Purpose: to generate the story and its illustrations. Legal basis: performance of the service, with the consent of the adult who accepts the initial screen.
• Technical data (IP, browser type) and cookieless aggregated analytics. Purpose: security, abuse prevention and understanding usage. To limit stories created without an account we keep an encrypted, irreversible fingerprint of the connection (never the IP) for at most 7 days. Legal basis: legitimate interest.
• Story shared by link: if an adult with an account shares it, we store the story title and pages, without the child's name or personal data. Legal basis: consent.

3. What is sent to AI providers (important)

Creating a story requires third-party AI services. Here is exactly what leaves your device:

• The idea the child speaks, types or draws.
• Their first name, only if you enable “Be the hero!” (so the main character shares their name).
• Their age and language, to tune the difficulty.
• If you fill in “What they look like”: a description of their looks (hair, skin, glasses, clothes), so the illustrations resemble them. We never ask for photos.
• If you add them: the first names and a short description of siblings, friends, grandparents or the pet who appear in the story.
• The drawing, if the child draws their story: it is sent to Groq only to see what it shows and turn it into the story idea. We don’t store it on any server, and neither does Groq (see below); on your device it becomes the story’s cover.
• The description of each illustration, sent to the image generator.
• If you ask for another chapter, the text of the previous chapter, to continue the story.
• Voice recordings are not sent: they stay on your device.

We never send surnames, a child's email, location, contacts or photos of people.If you prefer not to share their name, leave “Be the hero!” off and use a made-up name in the profile — the app works exactly the same.

Groq keeps nothing. Groq, which writes the stories, reviews them and reads the drawings, works for TaleBud with zero data retention turned on: it processes the request and does not store the idea, the drawing or the story. The backup and illustration providers listed below are only used for what is stated there.

4. Who we share with, and international transfers

We do not sell data or share it for advertising. We work with these providers (sub-processors), each receiving only the minimum needed:

Several are based in the United States, so an international data transfer takes place. It relies on the European Commission's Standard Contractual Clauses or equivalent adequacy frameworks, depending on the provider.

5. How long we keep data

• On the device: until you delete it (app or browser).
• Account and sync: while the account exists. Deleting it removes the data.
• Shared stories: until you ask us to remove them or delete your account.
• Technical and daily usage logs: 12 months maximum.
• AI requests: we do not store them; each provider applies its own policy.

6. Children

TaleBud is designed to be used by a child with adult supervision. The account always belongs to the adult (minimum 18 years old); children do not create accounts and cannot sign in. Before using the app, an adult confirms consent on a dedicated screen, and the parents' area is protected by a challenge question.

We do not profile children for advertising, we show no ads, and children cannot contact strangers: there is no open chat, no comments and no user-generated content from others.

If you are a parent or guardian and believe your child's data was processed without your consent, email hola@talebud.com and we will delete it. For users in the United States, this approach aims to align with COPPA: we do not knowingly collect personal information from children under 13 without parental consent.

7. Your rights

You may exercise the rights of:

• Access: know what data we hold (the app also has an export button).
• Rectification: correct it (editable in the app).
• Erasure: delete it (account deletion button, see section 8).
• Portability: download it as JSON from the parents' area.
• Objection and restriction of processing.
• Withdraw consent where processing relies on it.

Email hola@talebud.com and we will reply within 30 days. If you believe we did not handle your request properly, you can complain to your country's supervisory authority (in Spain, the Spanish Data Protection Agency, aepd.es).

8. How to delete everything

• Just the child's progress: parents' area → “Reset progress”.
• A whole profile: parents' area → Profiles → delete.
• Your account and all cloud data: parents' area → Account → “Delete my account and data”. Immediate and irreversible.
• Everything local: clear site data in your browser.

9. Cookies and storage

No advertising or tracking cookies. We use: one functional cookie to remember your language, local storage for profile and progress, and cookieless analytics. If you create an account, your browser stores the session token.

10. Security

Everything is encrypted over HTTPS. Passwords are handled by our authentication provider (we never see them). Each family's data is isolated by row-level access rules, so one account cannot read another's. We also filter content going into and out of the AI to keep it child-appropriate; no filter is perfect, which is why we recommend adult supervision.

11. Changes

If something material changes we will update this page and the date above. If the change affects how we handle your family's data, we will notify you in the app.

12. Contact

Questions or to exercise your rights: hola@talebud.com.