Privacy Policy

Last updated: February 8, 2026

This Privacy Policy for StoryBloom ("we," "us," or "our") describes how and why we collect, use, and share your personal information when you use our mobile application and related services (collectively, the "Services").

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at storybloom.app@gmail.com.

Important: StoryBloom is a children's application. We are committed to protecting children's privacy and comply with applicable children's privacy laws, including COPPA. Please read Section 8 carefully.

Summary of Key Points

No accounts required. We identify your device using a device identifier. We do not collect names, emails, passwords, or phone numbers.
AI-powered service. Story text, images, and audio are generated using third-party AI services (OpenAI, ElevenLabs). Story generation parameters are shared with these providers.
Children's data. If you use the personalization feature, child profile information (name, age, gender, interests) is used solely for story generation and is not shared for advertising or profiling purposes.
No advertising. We do not display ads or sell your personal information.
Payments. Subscriptions are processed entirely by Google Play. We do not collect or store payment card information.
Data location. Our servers are in Germany (EU). Some data is processed in the United States by our AI service providers.

What Information Do We Collect?
How Do We Use Your Information?
Third-Party Services and Data Sharing
International Data Transfers
How Long Do We Keep Your Information?
How Do We Protect Your Information?
Your Privacy Rights
Children's Privacy
AI-Generated Content
Do-Not-Track Signals
Updates to This Policy
How to Contact Us

1. What Information Do We Collect?

Information collected automatically

When you use our Services, we automatically collect:

Device identifier — a unique ID assigned to your device, used to identify your session, enforce usage limits, and manage your subscription status.
Usage data — number of stories generated, subscription tier, story generation timestamps, and feature usage patterns.
Log data — IP address, device type, operating system version, app version, and error logs for diagnostic purposes.

Information you provide

When you use personalization features, you may provide:

Child profile data — child's first name, age, gender, interests, favorite colors, favorite animals, friends' names, and pets' names.
Story preferences — language, age group, theme, mood, and safety settings.

This information is used exclusively to generate personalized stories and is stored as part of the story specification on our servers.

Information we do NOT collect

Real names, email addresses, or phone numbers of parents or guardians
Precise geolocation data
Photos, videos, or biometric data
Payment card numbers (handled entirely by Google Play)
Contacts, call logs, or SMS data

2. How Do We Use Your Information?

We use the collected information for the following purposes:

Purpose	Legal Basis (GDPR)
Generate AI-powered stories, images, and audio based on your preferences	Performance of a contract
Manage subscription status and enforce usage limits	Performance of a contract
Prevent abuse and enforce rate limits	Legitimate interest
Monitor service performance and fix bugs	Legitimate interest
Analyze usage trends to improve the service	Legitimate interest
Cache previously generated stories to avoid duplicate AI calls	Legitimate interest

We do not use your information for advertising, profiling, automated decision-making, or marketing communications.

3. Third-Party Services and Data Sharing

We share limited information with the following third-party service providers, solely to operate our Services:

Provider	Purpose	Data Shared	Location	Privacy Policy
OpenAI	AI text and image generation	Story preferences, child's first name, age, gender, interests (as part of generation prompts)	United States	openai.com/privacy
ElevenLabs	Text-to-speech audio generation	Generated story text	United States	elevenlabs.io/privacy-policy
Google Play	Subscription and payment processing	Purchase tokens for subscription verification	United States	policies.google.com/privacy

We do not sell, rent, or trade your personal information to any third party. We do not share data with advertisers, data brokers, or analytics companies.

We may also disclose your information if required by law, legal process, or to protect the rights, safety, or property of StoryBloom, our users, or the public. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. International Data Transfers

Our servers are located in Germany (EU). However, some of your data is processed by third-party providers located in the United States (OpenAI, ElevenLabs, Google).

When personal information is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure appropriate safeguards are in place, including the European Commission's Standard Contractual Clauses (SCCs), as adopted by our third-party service providers in their data processing agreements.

5. How Long Do We Keep Your Information?

Device identifier and usage data — retained as long as the device remains active. If a device has not been used for 12 months, associated data may be deleted.
Generated stories and child profile data — retained as long as the story exists on our servers. Free-tier stories are not persisted beyond the session.
Subscription data — retained for the duration of the subscription and up to 12 months after cancellation for accounting and legal purposes.
Log data — retained for up to 90 days for diagnostic purposes.

When data is no longer needed, it is securely deleted or anonymized.

6. How Do We Protect Your Information?

We implement appropriate technical and organizational security measures, including:

Encrypted data transmission (HTTPS/TLS)
Parameterized database queries to prevent injection attacks
Rate limiting to prevent abuse
Input validation and content safety filtering
Access controls on servers and databases

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

Right of access — request a copy of the personal information we hold about you.
Right to rectification — request correction of inaccurate personal information.
Right to erasure — request deletion of your personal information.
Right to restrict processing — request that we limit how we use your information.
Right to data portability — request your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

For California residents (CCPA/CPRA): You have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise your rights, please contact us at storybloom.app@gmail.com. We will respond within 30 days (or within the timeframe required by applicable law).

8. Children's Privacy

StoryBloom is designed for use by families with children. The app is intended to be used by children under the supervision of a parent or guardian.

We comply with the Children's Online Privacy Protection Act (COPPA) and other applicable children's privacy laws:

We do not require children to provide personal information beyond what is necessary to generate stories.
Child profile information (first name, age, interests) is used solely for story personalization and is not used for advertising, profiling, or shared with third parties for their own purposes.
We do not collect contact information from children.
A parent or guardian may request to review, delete, or stop the collection of their child's personal information at any time by contacting us at storybloom.app@gmail.com.

If we become aware that we have collected personal information from a child without parental consent, we will take steps to promptly delete that information.

9. AI-Generated Content

StoryBloom uses artificial intelligence to generate story text, illustrations, and audio narration. When you use these features:

Your story preferences and personalization data are sent to our AI providers (OpenAI for text and images, ElevenLabs for audio) to generate content.
AI-generated content is provided "as-is." While we implement safety filters and content validation, we cannot guarantee that all generated content will be perfectly suitable.
You may opt out of AI-based processing by discontinuing use of the Services. To request deletion of data already processed, contact us at storybloom.app@gmail.com.

10. Do-Not-Track Signals

Our app does not track your browsing activity across other websites or services. We do not currently respond to Do-Not-Track (DNT) browser signals, as there is no uniform standard for interpreting them. We do not engage in cross-site tracking.

11. Updates to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. If we make material changes, we will notify users through the app. We encourage you to review this Privacy Policy periodically.

12. How to Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: storybloom.app@gmail.com

If you are a resident of the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.