Our Commitment to Children's Privacy

Shorty Tales is built for children, so we collect as little as we can and we are specific about what we keep. This policy explains exactly what is stored, who it is shared with, and how to have it deleted. We aim to comply with the Children's Online Privacy Protection Act (COPPA) and other applicable privacy laws.

Using Shorty Tales Without an Account

The story generator works without signing in, and we encourage children to use it that way. When you write a story without an account:

• We do not ask for a name, an email address, or any other personal detail.
• The story and the words you typed to make it are not stored on our servers after the story is returned to your browser.
• Your work in progress is kept in your own browser's local storage so it survives a refresh. It never leaves your device unless you press Save.

Accounts

An account exists for one purpose: to keep stories so you can open them again later. Accounts are intended for parents, guardians and teachers. A child under 13 should only use an account created by a parent or guardian who has read this policy.

What an account stores

• Email address, used to identify the account and to contact you about it.
• Display name, which is whatever you type when signing up. A nickname is fine; it is only shown back to you.
• Password, stored only as a bcrypt hash. We never store, log, or have any way to read the password itself.
• Sign-in sessions, so you stay signed in. Your browser holds a random token; our database stores only a one-way digest of it. Sessions expire after 30 days.

If You Sign In With Google

Choosing "Continue with Google" sends you to Google to sign in. Google then tells us three things: your Google account identifier, your email address and whether Google has verified it, and the name on the account. We store those to recognise you on your next visit.

We do not receive your Google password. We do not ask for access to Gmail, Contacts, Drive, or anything else in your Google account, and we do not keep the tokens Google issues during sign-in. Google's own privacy policy covers what Google records about the sign-in itself.

If you already had a Shorty Tales password account with the same verified address, signing in with Google attaches to that same account rather than making a second one.

Saved Stories

When you press Save, we store the story and the elements that produced it — the character, setting, situation and any theme, tone, challenge, word count and reading level you chose — against your account, along with the date. Saved stories are private to your account. Nobody else can read them through the app, and we do not publish, share or sell them.

You can delete any saved story from the "My Library" panel at any time. Deleting removes it from our database.

Information Collected Automatically

• Server logs record the page or endpoint requested, the response, and how long it took. These are used to keep the service running and secure.
• IP address is used in memory to limit how many stories can be generated per hour, so the service cannot be run up as a bill by automated traffic.
• A session cookie is set once you sign in. It exists to keep you signed in and for nothing else.

We do not use advertising cookies, third-party analytics, tracking pixels, or any form of behavioural profiling.

Third-Party Services

Two outside services are involved, and only these two:

• OpenAI writes the stories and reads them aloud. The story elements you type are sent to OpenAI to generate a story, and the story text is sent to OpenAI when you press Listen. We do not send your name, email address, or account identifier with those requests. Audio is played to you and is not stored on our servers.
• Google is involved only if you choose to sign in with Google, as described above.

How We Use Information

Information is used only to:

• Generate and narrate the stories you ask for
• Keep the stories you chose to save, and show them back to you
• Keep you signed in, and keep accounts secure
• Keep the service running and protect it from abuse
• Comply with legal obligations

We do not sell personal information, and we do not use it for advertising or to train AI models of our own.

Data Retention

• Saved stories are kept until you delete them or the account is closed.
• Account details are kept until the account is closed.
• Sessions expire after 30 days and are then deleted automatically.
• Server logs are kept only as long as needed for security and troubleshooting.
• Stories written without an account are never stored on our servers at all.

Parental Rights and Controls

Parents and guardians have the right to:

• Review the personal information held about their child
• Have their child's account and all of its saved stories deleted
• Refuse to allow any further collection of their child's information
• Ask us anything about how this works

Saved stories can be deleted at any time from within the app. To close an account entirely, open the account menu, choose Settings and use "Delete my account": this removes the account and every story saved in it immediately. You can also email us at the address below and we will do it for you.

Data Security

Passwords are hashed with bcrypt and are never stored in a readable form. Session tokens are stored only as one-way digests, so a copy of our database does not hand anyone a working session. Traffic between your browser and Shorty Tales is served over HTTPS. Access to the database is restricted to the service itself.

No method of transmission or storage is completely secure, and we will not pretend otherwise. If we ever discover a breach affecting personal information, we will notify affected accounts.

International Users

Our service is primarily intended for users in the United States. If you are accessing our service from outside the US, please be aware that your information may be transferred to and processed in the United States.

Changes to This Policy

We may update this privacy policy from time to time. We will notify users of any material changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this privacy policy, or want an account and its stories deleted, contact us at: