Privacy Policy

Younify Tech Limited is the data controller responsible for your personal data. Our registered office is in the United Kingdom (company number 15449518). You can contact us at: hello@tinystories.ai.

We may collect and process the following types of personal data:

• Account Information: email address, name (where provided via social login), profile picture, authentication provider, and password (stored in hashed format only for email/password accounts).
• Character & Story Data: character names, descriptions, visual attributes, age-group preferences, story topics, and AI-generated story content (text and images).
• Image Data: original photos you upload and AI-styled images generated from them. These images may depict children and are processed solely for the purpose of creating personalised stories and products.
• Payment Information: processed securely by Stripe. We do not store your full card details. Stripe collects your email, name, phone number, billing address, and shipping address on our behalf during checkout.
• Order & Shipping Data: shipping name, email, phone number, and full delivery address when you order physical products (books, mugs, posters, puzzles, cushions, T-shirts and phone cases).
• Usage & Analytics Data: we operate a first-party analytics system. We collect device type, browser or app platform, operating system, screen dimensions, approximate location (country and city derived from network headers), pages or app features used, session duration, and referrer information. If you accept optional advertising cookies on the website, we also send a limited set of product-funnel and purchase events to Google and Meta as described below.
• Mobile Device & Notification Data: if you choose to enable mobile notifications, we process a random app installation identifier, device platform, app version, notification permission status, and a push notification token. We do not use this information for advertising.
• Shopping Preferences: your selected country and currency, and items in your shopping cart (persisted to your account).
• Support Communications: inquiries, complaints, or feedback you send us.
• Error & Diagnostic Data: client-side errors including page context and browser information, used solely to fix bugs and improve the Platform.

We use your data to:

• Create and manage your account
• Generate personalised stories and AI-styled character images
• Generate product artwork and previews (mugs, posters, puzzles, cushions, T-shirts and phone cases) featuring your characters
• Process payments and manage purchases via Stripe
• Fulfil and deliver physical product orders through our printing partners
• Send transactional emails (welcome, story ready, order confirmation, shipping updates)
• Offer an optional Google Customer Reviews survey after a completed physical-product order
• Send creation-ready notifications when you choose to enable them in the mobile app
• Analyse Platform usage to improve our services (using first-party analytics)
• Measure the effectiveness of Google Shopping, Instagram and Facebook activity where you have accepted optional advertising cookies
• Diagnose and fix technical issues
• Detect and prevent fraud or misuse
• Comply with legal and tax obligations

We process your personal data under the following legal bases:

• Contract: to provide the services you have signed up for, including story generation, product creation, payment processing, and order fulfilment.
• Legitimate Interests: to improve our Platform, analyse usage patterns, diagnose errors, and maintain security. We balance our interests against your rights and only process data where the impact on you is minimal.
• Legal Obligation: to comply with tax, accounting, and other legal requirements.
• Consent: where required for optional features and advertising measurement. You can withdraw advertising consent at any time through Cookie settings in the site menu or footer.

We share your data with the following categories of third parties, only to the extent necessary to provide our services:

Advertising measurement

• Google Merchant Center uses the Google tag to measure UK purchases. After you accept optional cookies, a purchase event may include our order reference, value, currency, generic product type, feed product identifier and quantity, plus standard browser, device and network information. We do not send uploaded photos, character names, story prompts, story text, generated images, payment card details, email addresses or shipping details for this measurement. Before you make a choice, Google Consent Mode keeps advertising and analytics storage denied and may send limited cookieless consent and device signals.
• If you accept optional advertising cookies, Meta Platforms receives a limited set of website funnel events through Meta Pixel and the Conversions API: page view, product view, preview started, preview completed, checkout started, and purchase. Events may include generic product type, value, currency, browser and device information, IP address, a hashed first-party visitor identifier, and Meta's advertising cookie identifiers. We do not send uploaded photos, character names, story prompts, story text, generated images, story, product or order identifiers, payment card details, email addresses, or shipping details to Meta for advertising measurement.

Payment Processing

• Stripe processes all payments. When you check out, Stripe collects your email, name, phone number, shipping address, billing address, and payment card details directly. We receive a confirmation and your shipping details but never see your full card number. Stripe's privacy policy governs their handling of your payment data.

Customer Reviews

• On a physical-order confirmation page, Google Customer Reviews may offer you an optional post-purchase survey. Its opt-in module receives the order reference, confirmation email address, delivery country, and estimated delivery date. Google sends the survey after delivery only if you choose to participate.

AI Content Generation

• OpenAI and Google Gemini receive story prompts, character descriptions, and uploaded images to generate AI illustrations and product mockups. These providers process data under their respective privacy policies and data processing agreements. We do not send your name, email, or payment details to AI providers.

Print Fulfilment

• Specialist fulfilment partners produce and ship made-to-order books, mugs, posters, puzzles, cushions, T-shirts and phone cases. We share only the shipping details and print-ready files needed to manufacture and deliver your order.

Authentication

• If you choose social login, your authentication provider (Google, Apple, or Facebook) processes your login credentials. We receive only your email, name, and profile picture from these providers.

Email Communications

• Transactional emails (order confirmations, shipping updates, story notifications) are sent via SMTP. We share your email address and relevant order details for this purpose.

Mobile Notifications

• Firebase Cloud Messaging and the operating system's push notification service process your push token and basic device information when you choose to enable mobile notifications. You can turn notifications off in the app or your device settings at any time.

Cloud Infrastructure

• Google Cloud Platform (GCP) hosts our Platform, database, file storage, and background processing services. All data is stored within GCP infrastructure. Our primary database is hosted by Neon (PostgreSQL).

Legal Authorities

• We may disclose your data if required by law, regulation, or legal process.

We do not sell your personal data. All third-party processors are contractually required to protect your data and process it in accordance with UK GDPR.

Your data may be transferred outside the United Kingdom for processing. Specifically:

• AI providers (OpenAI and Google) may process story prompts and images in the United States.
• Stripe processes payment data in the United States and other jurisdictions.
• Meta Platforms may process optional advertising-measurement data outside the United Kingdom where you have consented to that processing.
• Google Merchant Center may process the limited conversion-measurement data described in section 5 outside the United Kingdom. Advertising and analytics storage remains denied unless you accept optional cookies.
• Google Firebase may process mobile push notification tokens and related device information outside the United Kingdom when notifications are enabled.
• Google Customer Reviews may process the limited order details described in section 5 outside the United Kingdom when you opt in to a post-purchase survey.
• Fulfilment partners operate manufacturing facilities in multiple countries to produce and ship your orders.

Where data is transferred outside the UK, we rely on appropriate safeguards including standard contractual clauses, adequacy decisions, or equivalent protections recognised under UK GDPR.

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Account, character, and story data: retained while your account is active. You can delete individual characters and stories at any time. Deleting your account removes all associated data.
• Images (uploaded and generated): stored until you delete them or close your account. AI-styled images and product mockups are deleted alongside the associated character or story.
• Payment and order records: retained for up to 7 years after the transaction to comply with tax and legal requirements.
• Analytics data: session and event data is retained for up to 12 months and then automatically purged.
• Mobile notification identifiers: retained while notifications are enabled and removed when you opt out, sign out, or delete your account.
• Error and diagnostic logs: retained for up to 90 days.
• Support communications: retained for up to 3 years after resolution.

You may request deletion of your account and all associated data at any time through the Platform's account settings or by contacting us. When you delete your account, we permanently remove your profile, stories, characters, and images. Order records are anonymised (your user ID is removed) but retained for legal compliance. Learn more about data deletion.

You have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data (subject to legal retention requirements).
• Restriction: request that we limit how we process your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Portability: request your data in a structured, machine-readable format.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at: hello@tinystories.ai. We will respond within one month.

Tiny Stories is designed for adults — parents, guardians, and teachers — to create personalised stories and products for children. The Platform is not intended for use by children directly.

Data about children: When you create a story, you may provide character names, descriptions, and photos that relate to a child. This information is treated as personal data under UK GDPR. We process it solely for the purpose of generating your personalised story and products, and it is stored within your account under your control.

Character names and descriptions are sent to our AI providers (OpenAI, Google Gemini) to generate illustrations. Uploaded photos are used to create AI-styled character images. We do not use children's data for marketing, profiling, or any purpose beyond creating the content you requested.

You can delete any character (and all associated images) at any time through the Platform. Deleting your account permanently removes all character data.

We do not knowingly collect personal data directly from children under the age of 13. If we become aware that a child has provided us with personal data without parental consent, we will take steps to delete that data promptly.

On the website and web app, we use essential first-party cookies and browser storage. With your consent, we also use optional Google and Meta advertising-measurement cookies:

• Authentication cookie (token): a secure, HTTP-only cookie containing your session token. Expires after 30 days. Essential for keeping you logged in.
• Shopping context cookie (shop_ctx): stores your selected country and currency. Expires after 30 days. Essential for displaying correct pricing.
• Visitor identifier (localStorage): a randomly generated ID used for anonymous usage analytics. Contains no personal information.
• Session identifier (sessionStorage): a temporary ID for grouping analytics events within a single browser session. Cleared when you close the tab.
• Advertising consent (tt_marketing_consent): records whether optional Google and Meta measurement is permitted. It lasts up to 180 days and is removed if you decline or withdraw consent.
• Google advertising cookies (including cookies whose names begin with _gcl_): used only after consent to attribute visits and UK purchases to Google Shopping activity. Google Consent Mode keeps advertising and analytics storage denied before consent.
• Meta advertising cookies (including _fbp and, where applicable, _fbc): used only after consent to attribute visits and conversions to Instagram and Facebook ads.
• Google Customer Reviews: the physical-order confirmation page loads Google's survey opt-in module and transmits the limited order details described in section 5. Google sends a review survey only if you choose to participate.

Our first-party analytics continues to help us operate and improve the Platform. Google purchase events, Meta Pixel events and Meta Conversions API events are sent only after you choose “Accept optional”. Google's tag starts with advertising and analytics storage denied and automatic page-view measurement disabled. Browser and server Meta events use the same event identifier so Meta can deduplicate them. We disable Meta's automatic event inference and send only the event types listed in section 5.

The native mobile app stores authentication tokens and preferences in secure device storage and local app storage. It does not use Google or Meta advertising cookies, collect advertising identifiers, or track you across other companies' apps and websites.

Geolocation: We determine your approximate country and city from network headers provided by our hosting infrastructure. This is used to display appropriate pricing and shipping options. We do not use GPS or precise location data.

You can change your optional choice through Cookie settings in the site menu or footer, or manage cookies through your browser settings. Disabling essential cookies (authentication, shopping context) may prevent the Platform from functioning correctly.

We implement appropriate technical and organisational measures to protect your data, including:

• Passwords stored using bcrypt hashing (we cannot read your password)
• HTTPS encryption for all data in transit
• Secure, HTTP-only cookies for authentication
• Database hosted on managed infrastructure with encryption at rest
• Mobile authentication tokens stored using the operating system's secure credential storage
• Access controls limiting who can access production systems
• Stripe PCI-DSS compliance for all payment processing (card details never touch our servers)

Some user-generated images are stored with URLs that may be accessible if the link is known. Avoid sharing image links if you wish to keep content private.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated via email or a notice on the Platform. We encourage you to review this page periodically.

If you have concerns about how we handle your data, please contact us first at hello@tinystories.ai. We take all complaints seriously and will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk.