Privacy Policy

1. Information We Collect

Information Stored on Your Device & iCloud

The following information is stored on your device and, where noted, in your private iCloud database via Apple CloudKit. We cannot see it:

• Child profiles:story nickname, age (3–8), and an emoji avatar — entered by a parent or guardian, never by the child (synced to iCloud)
• Stories: title, text, illustrations, and audio narration (synced to iCloud)
• Reading activity: read counts and story ratings are synced to your own iCloud, never to our servers; reading streaks stay on your device only
• App preferences:bedtime reminder settings, display preferences, and whether a parent has agreed to personalized stories — stored locally on your device

Information Sent When You Create a Personalized Story

Creating a personalized story is a Fablito+ feature. Before the first one, the app shows a one-time consent screen behind a parental gate. It tells the parent that the story nickname, age band, story idea and any toy photo are sent to xAI to make the story, and asks them to agree. Each time a parent creates a story, the following is sent to our server and passed to xAI to generate the story:

• Your story idea (the prompt you write)
• Story nickname and age band (to personalize the story)
• Selected art style and story length
• For sequels, a short summary of the earlier parts so the new story follows on
• Toy photo(only if you choose to include one) — used to describe and draw the toy in the story. Please photograph just the toy and avoid including people.

The app also sends a signed App Store transaction so our server can check that you have Fablito+ (see “Subscription usage records” below), and a random request ID so that retrying a request after a dropped connection does not create or charge for the same story twice. Neither is passed to xAI.

While a story is being made, our server links it to your subscription’s purchase identifier (the original transaction ID described below) so that only your device can collect it. Your story idea and toy photo are held in memory only while the story is being made and are not stored. The finished story (its text, which may include the nickname, illustrations and narration) is kept in Google Cloud Storage in the UK (London, region europe-west2), labelled with a one-way scrambled (hashed) form of that identifier, so your device can still collect it if the app was closed. It is deleted as soon as the app confirms the story is saved on your device; otherwise it is deleted automatically after about 48 hours (and no later than 72 hours).

Subscription Usage Records

Fablito+ includes up to 75 scenes of new stories each month. To keep count, our server stores in a database:

• the original transaction ID Apple assigns to your subscription (a number, not your name, Apple ID or email), and
• for each month, how many scenes have been used or are currently being generated.

For each story request we also store the random request ID mentioned above, so a retried request is matched to the original rather than charged twice. If Apple notifies us that a purchase was refunded or revoked, we record the original transaction ID and the date and type of that notice, so a refunded subscription cannot keep creating stories.

These records are linked to your subscription’s purchase identifier, so they are not anonymous, but they contain no names, story ideas, story content or photos. We use them only to apply the scene allowance, honour refunds and look into problems with them, and never for tracking or advertising. You can ask us to delete them at any time (see Section 7).

Information Shared During Read Together (SharePlay)

When you use Read Together to share a story with another device, the story content (text, illustrations, and audio) is temporarily held on our server so the other device can download it. It is automatically deleted after about 1 hour. Toy photos are never included in shared data.

Information We Do Not Collect

Fablito does not collect:

• Email addresses, phone numbers, or physical addresses
• Last names or full names of children
• User account credentials (we do not have user accounts)
• Tracking cookies or advertising identifiers
• Behavioral or usage analytics
• Location data
• Payment details (Apple handles all payments)

There are no analytics SDKs, no advertising frameworks, no third-party tracking and no public sharing feed in the app.

2. How We Use Information

We use the information described above only to:

• Write a personalized story based on your idea, the story nickname and the age band
• Create illustrations in your chosen art style, including your toy if you add a photo
• Produce audio narration of the story
• Check your Fablito+ subscription and monthly scene count
• Let another device join a Read Together session

We do not use your information for advertising, we do not build profiles of children, and we do not use your stories, prompts or photos to train AI models.

3. Information Sharing & Third-Party Services

We do not sell, rent, or trade any personal information. We share data only with the following providers, and only to run the features you use:

4. Children’s Privacy

Fablito is designed for families with children aged 3–8 and is set up and run by a parent or guardian. We aim to follow the US Children’s Online Privacy Protection Act (COPPA), the UK GDPR and the UK Age Appropriate Design Code.

What we collect and why

• Story nickname and age band:used only to personalize stories (the nickname appears in the story text and narration, and the age band sets vocabulary and themes). We suggest using a nickname rather than a child’s full name.
• Toy photo (optional): used only to put the toy in the story.

Parental consent

Purchases, settings and adding child profiles sit behind a parental gate. Before the first personalized story, the app shows a one-time, parent-gated consent screen explaining that the story nickname, age band, story idea and any toy photo are sent to xAI to make the story, and asks the parent to agree. Children do not submit personal information on their own. The free story library can be read without sending any information about your child.

Our commitments

• Minimal data: we ask only for a story nickname and age band, plus a toy photo if you choose to add one.
• No behavioral tracking: no analytics, no advertising and no tracking SDKs.
• No selling or advertising: we never sell your data or use it for ads.
• Stories stay with you: finished stories are saved on your device and in your iCloud account, not on our servers.

5. Data Retention

• Stories and child profiles: stored on your device and in your iCloud account for as long as you keep them. You can delete them at any time.
• Story creation requests on our server: your story idea and toy photo are held in memory only while the story is being made. The finished story is kept in Google Cloud Storage (UK) until the app confirms it is saved on your device, and is otherwise deleted automatically after about 48 hours (and no later than 72 hours). Once deleted, no backup or recoverable copy of it is kept.
• Data sent to xAI: kept by xAI according to its API terms and privacy policy (see Section 3).
• Subscription usage records: the Apple original transaction ID, scene counts, request IDs and any refund/revocation notices are kept while they are needed to run the allowance and honour refunds, or until you ask us to delete them.
• Read Together (SharePlay) data: held in temporary server memory and automatically deleted after about 1 hour.
• Server logs: our servers keep short-lived operational logs (such as errors and timings) to keep the service working. They are not intended to include story nicknames, story ideas or photos.

6. Data Storage & Security

• On your device and iCloud: stories, child profiles and preferences are stored with SwiftData and synced to your private iCloud database. Apple encrypts this data in transit and at rest.
• On our servers: the only lasting record is the subscription usage record described in Section 1, stored in a managed Postgres database with restricted access. Finished stories awaiting collection are kept for about 48 hours (and no later than 72 hours) in a private Google Cloud Storage bucket in the UK with restricted access.
• Secure transmission: all communication between the app and our services uses encrypted connections (HTTPS/TLS).

7. Your Rights & Parental Controls

Most of your data lives on your device and in your iCloud account, so you are in control of it:

• Access and review: all stories and child profiles are visible in the app at any time.
• Edit:you can change a child’s nickname or age in their profile at any time.
• Deletion: you can delete individual stories or whole child profiles at any time. Deleting a child profile removes the stories that belong to it.
• Stop sharing: stop creating personalized stories at any time. Nothing about your child is sent unless a parent creates a story.
• Subscription usage records: email us and we will help you find and delete the records linked to your subscription. Deleting them may reset your monthly scene count.
• Complete removal:uninstall the app, remove its data from iCloud (Settings → your name → iCloud), and ask us to delete your subscription usage records.

If you are in the UK or EU you also have rights under data protection law, including to access, correct or erase your data and to complain to the Information Commissioner’s Office (ico.org.uk). Contact us at the address below and we will reply promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by updating the effective date at the top of this page. We encourage you to review this policy periodically.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our privacy practices, or your child’s data, please contact us at:

We actively monitor this address and will respond to parental inquiries as quickly as possible.