Privacy policy

Updated: July 2026

1. Who is the data controller

Controller: TaleBud, España. Privacy contact: hola@talebud.com.

2. What we process, why, and on what legal basis

• Child data on the device (first name, age, avatar, progress, stories and settings): stored in your browser's local storage. Purpose: to run the app and adapt to their level. Legal basis: performance of the service requested by the adult.
• Adult account (email and hashed password): only if you choose to create one. Purpose: to identify you and sync profiles across devices. Legal basis: performance of a contract.
• Content sent to AI (see section 3). Purpose: to generate the story and its illustrations. Legal basis: performance of the service, with the consent of the adult who accepts the initial screen.
• Technical data (IP, browser type) and cookieless aggregated analytics. Purpose: security, abuse prevention and understanding usage. Legal basis: legitimate interest.
• Story shared by link: if an adult with an account shares it, we store the story title and pages, without the child's name or personal data. Legal basis: consent.

3. What is sent to AI providers (important)

Creating a story requires third-party AI services. Here is exactly what leaves your device:

• The idea the child speaks, types or draws.
• Their first name, only if you enable “Be the hero!” (so the main character shares their name).
• Their age and language, to tune the difficulty.
• The drawing, if uploaded, to interpret it as the story idea.
• The description of each illustration, sent to the image generator.

We never send surnames, a child's email, location, contacts or photos of people.If you prefer not to share their name, leave “Be the hero!” off and use a made-up name in the profile — the app works exactly the same.

4. Who we share with, and international transfers

We do not sell data or share it for advertising. We work with these providers (sub-processors), each receiving only the minimum needed:

Several are based in the United States, so an international data transfer takes place. It relies on the European Commission's Standard Contractual Clauses or equivalent adequacy frameworks, depending on the provider.

5. How long we keep data

• On the device: until you delete it (app or browser).
• Account and sync: while the account exists. Deleting it removes the data.
• Shared stories: until you ask us to remove them or delete your account.
• Technical and daily usage logs: 12 months maximum.
• AI requests: we do not store them; each provider applies its own policy.

6. Children

TaleBud is designed to be used by a child with adult supervision. The account always belongs to the adult (minimum 18 years old); children do not create accounts and cannot sign in. Before using the app, an adult confirms consent on a dedicated screen, and the parents' area is protected by a challenge question.

We do not profile children for advertising, we show no ads, and children cannot contact strangers: there is no open chat, no comments and no user-generated content from others.

If you are a parent or guardian and believe your child's data was processed without your consent, email hola@talebud.com and we will delete it. For users in the United States, this approach aims to align with COPPA: we do not knowingly collect personal information from children under 13 without parental consent.

7. Your rights

You may exercise the rights of:

• Access: know what data we hold (the app also has an export button).
• Rectification: correct it (editable in the app).
• Erasure: delete it (account deletion button, see section 8).
• Portability: download it as JSON from the parents' area.
• Objection and restriction of processing.
• Withdraw consent where processing relies on it.

Email hola@talebud.com and we will reply within 30 days. If you believe we did not handle your request properly, you can complain to your country's supervisory authority (in Spain, the Spanish Data Protection Agency, aepd.es).

8. How to delete everything

• Just the child's progress: parents' area → “Reset progress”.
• A whole profile: parents' area → Profiles → delete.
• Your account and all cloud data: parents' area → Account → “Delete my account and data”. Immediate and irreversible.
• Everything local: clear site data in your browser.

9. Cookies and storage

No advertising or tracking cookies. We use: one functional cookie to remember your language, local storage for profile and progress, and cookieless analytics. If you create an account, your browser stores the session token.

10. Security

Everything is encrypted over HTTPS. Passwords are handled by our authentication provider (we never see them). Each family's data is isolated by row-level access rules, so one account cannot read another's. We also filter content going into and out of the AI to keep it child-appropriate; no filter is perfect, which is why we recommend adult supervision.

11. Changes

If something material changes we will update this page and the date above. If the change affects how we handle your family's data, we will notify you in the app.

12. Contact

Questions or to exercise your rights: hola@talebud.com.