Privacy Notice
Last updated: June 2026.
Who we are, and who's in control
kidtold is a generative storytelling service for children (ages 3–10). The account is created and controlled by a parent or guardian. A child never enters payment details, sees ads, or interacts with anyone outside their own stories.
What we collect
- Parent account: name, email, and payment details (payment is handled by Stripe — card numbers go directly to Stripe and we never receive or store them).
- Child profile: a first name or nickname, an avatar, and an age band — the minimum needed to personalize and age-appropriately level stories.
- Your child's hero and its memory: the special thing about kidtold is that your child's made-up hero remembers what happened in earlier stories. We call that memory the hero's “canon.” It can include traits your child picks, the hero's likes, hopes, fears, and friends, skills the hero “learns,” and the history of stories created. Much of this comes from your child's choices and the stories themselves, so it can reflect things about your child — and we protect it as your child's personal information.
- Stories & activity: the stories created, reading progress, and basic, security-related usage needed to run the service.
We do not ask for a child's full name, home or precise location, phone number, or contacts, and we do not capture a child's voice or photos.
How we use it
To create and narrate personalized stories, keep story continuity (the “remembering hero”), keep content age-appropriate and safe, and operate your subscription. We do not show advertising, we do not sell or share personal information for advertising, and we do not build advertising profiles of children.
How you give consent — and how to decline
Completing a paid subscription is how you give verifiable parental consent, and we obtain it before your child's information is collected or used: setting up a child profile, creating a hero, and saving stories all require an active subscription. If you choose not to subscribe, your child cannot use kidtold and we do not collect their information. You can withdraw consent at any time by deleting your account (see “Your rights”).
How long we keep it (retention)
We keep your child's hero and stories for as long as you keep the profile — that's what lets the hero remember. When you delete a hero, a child profile, or your whole account, we delete that data from our live systems right away, including the hero's memory. Any copy that remains in our encrypted backups is purged on our normal backup cycle, within 30 days. The only thing we keep is a basic billing record (for example, that a payment was made), because tax and accounting law requires it.
Children's privacy (COPPA)
We designed kidtold around the U.S. Children's Online Privacy Protection Act (COPPA): we seek verifiable parental consent before collecting a child's personal information, collect only what's needed to provide the service, never require a child to share more than is reasonably necessary to participate, and give parents the right to review and delete their child's information and to revoke consent at any time.
The vendors we use
A small set of vendors help us run kidtold. Each processes data only on our behalf, under contract, and none uses your child's data for its own purposes:
- Anthropic (Claude) — generates, adds memory to, and safety-checks stories. Before any text is sent, we strip out personal details like names, so it works on de-identified text. We require our AI provider to operate under no-training, no-retention terms — it may use this content only to create your child's stories for us, must not keep it afterward, and must not use it to train or improve its AI. We are finalizing the formal agreement that commits the provider to this before any children's data is processed.
- Neon and Qdrant — store your child's profile, stories, and the hero's long-term memory in our database and search index.
- Render and Vercel — host the app and website.
- Stripe — processes payment and the parental-consent checkout; card details go directly to Stripe and we never receive or store them.
- Resend — sends you safety-alert emails (your email plus a de-identified snippet of a blocked attempt).
Because these vendors act on our behalf under contract, this is not “selling” or “sharing” your child's information — and we never share it for advertising.
Safety, and what happens if a child seems upset
Every story passes content-safety checks before your child sees it. Separately, if your child types something that reads like a real cry for help (for example, about being hurt or wanting to hurt themselves), kidtold replies with a calm, supportive message encouraging them to talk to a grown-up they trust. It does not turn that message into a story and does not save it to the hero. Because the safest grown-up isn't always nearby, we show this gentle message to your child rather than automatically forwarding their words to anyone. This is a supportive feature, not medical or crisis care.
Your rights and choices (parents)
From the app's grown-up area, or by emailing us, a parent can at any time:
- Review the information associated with a child profile and its heroes.
- Delete a single hero (removing that hero's stories and memory), an entire child profile, or the whole account.
- Revoke consent — which means we delete the child's data.
Deleting the child's profile or your account also removes our safety log of any blocked attempts. In every case we delete the data — including the hero's long-term memory held in our database and search index — not just hide it from view.
Security & privacy by design
We encrypt data in transit and at rest, restrict access to authorized personnel, and design the service so a child can never contact, or be contacted by, anyone outside their own account. Reading aloud happens on your child's device — their voice is never recorded and no audio is sent to us or anyone else. The app contains no advertising, analytics, or tracking software of any kind.
Changes to this notice
If we make material changes to how we handle children's data, we'll notify the parent account and, where required, obtain renewed consent.
Contact
Questions, or want to review or delete your child's data? Email privacy@kidtold.com.