Notice to parents
Version 3, in effect since 15 September 2026.
This is the notice we are required to give you directly, before we collect anything at all about your child. It is separate from the privacy notice on purpose: that one covers everybody, and this one is about your child and is put in front of you rather than left on a page to be found.
Who we are
TaleTykes is the operator of this service and the party responsible for everything in this notice. Write to privacy@taletykes.com about anything here, or about anything your child has made. Our contact page lists the addresses we answer on. A postal address and telephone number are available on request.
Why you are reading this
We have your email address because you opened an account. We are asking for your consent before collecting anything about a child. Until you give it, we hold nothing about a child, because there is no child on the account yet.
If you do not give consent within a reasonable time, we delete the contact details we collected in order to ask.
What we collect about a child, and what we do with it
| What | Why |
|---|---|
| A first name, or whatever you call them | So a story can have them in it, and so their shelf has their name on it. There is no field for a surname. |
| An age group, such as five to seven | To write at the right reading level and the right length. We ask for a group rather than a birthday because a group is the smallest thing that answers the question. |
| An avatar they picked from a fixed set | So they can find their own shelf. |
| A hashed PIN or picture sequence | So they can open their own shelf on your device. It is a way of choosing a profile, not a password: everything that matters needs yours. |
| The choices they made from the picture menus | These are what the story is made from. |
| The books they made, the pages they reached, and their favourites | So a book opens where it was left, and so their shelf is theirs. |
| Optionally, what they enjoyed | Only if you turn it on. It suggests what to read next. It is off unless you choose it, and turning it off deletes what was learned. |
We do not collect an email address, a surname, a date of birth, a location, a photograph, a voice recording, or any identifier that would follow your child anywhere else. There is no advertising in this product, no third-party analytics, and nothing about your child is used to build a profile for anybody outside it.
Who else sees it
These companies process it on our behalf, under contract, each for the purpose named and for nothing else. None may sell it or use it for advertising.
| Who | What they do | What reaches them |
|---|---|---|
| xAI | Writes the stories, draws the pictures and reads them aloud | The story instructions a child chose, the text of their book, and the pictures made from it. A first name only when the child asked for themselves to be in the story. Using it to train their models is forbidden by contract. |
| Stripe | Takes payment and checks that an adult is holding the card | A parent's email address and card details, which go to Stripe directly and never through us. We keep a one-way fingerprint of the card and no card number. |
| Vercel | Runs the site and stores the pictures | Everything the site holds, as the place it runs. |
| Neon | Runs the database | Everything the site holds, as the place it is stored. |
| Upstash | Holds short-lived counters and passes each step of book-making to the next | Identifiers and counts. No story text, no names. A book's identifier passes through it; the book does not. |
| SendGrid (Twilio) | Delivers email to parents and staff | A parent's email address and the message itself. Nothing is ever addressed to a child. Open and click tracking are turned off. |
We do not otherwise disclose anything about a child. We would disclose something if the law required it, and we would tell you unless we were forbidden to.
Your consent is required, and it is yours to withdraw
- We cannot collect anything about your child unless you consent. You may refuse.
- You may review everything we hold about your child at any time, by downloading a copy from your settings.
- You may delete it, by removing that reader from your settings.
- You may refuse to permit any further collection while keeping what already exists: removing a reader stops collection about that child and does not close your account.
Withdrawing consent means we can no longer make books for that child, because there would be nothing left to make them from.
How we check that you are an adult
You start a subscription, which means a real card is charged. That is how we know an adult is holding the card, and it is the method the rule contemplates. We never see the card number; our payment provider tells us only that it worked, and we keep a one-way fingerprint of the card so that one card cannot quietly open many accounts.
We record which method was used, which version of this notice you read, the date, and a one-way hash of the address and browser you used. We keep that record for as long as the account exists, because it is the evidence that we asked.
How long any of this is kept
| What | How long | From when |
|---|---|---|
| A removed reader's books and pictures | 30 days | the reader is removed. The delay is so a parent who changes their mind can undo it. |
| A removed reader's profile | 30 days | the reader is removed. |
| A closed account, its sign-in and everything under it | 30 days | the account is closed. |
| A child's sign-in sessions | 30 days | the session expires. |
| Records of books being made, and what they cost | 90 days | the record is written. Long enough to reconcile a bill or explain a failure. |
| Payment events from our payment provider | 90 days | the event arrives. |
| A record of mail we sent you | 90 days | the message is sent. The row holds the address it went to, so it is not kept longer than a delivery question would take. |
| Safety decisions that have been dealt with | 90 days | the decision is resolved. An unresolved one is kept until somebody has looked at it. |
| An account nobody has signed in to | 365 days, then a 14-day warning | the last sign-in. Written to first and removed a fortnight later. Signing in stops the clock. |
| Consent records and the audit trail | kept while the account exists | never, while the account exists. They are the evidence that consent was obtained and what was done with it. They go when the account goes. |
| Card details | not held by us | held by our payment provider, never by us. We keep a one-way fingerprint of the card and nothing else. |