A thoughtful start
to privacy.

01. A portal for adults, not children

Taleyo's creation portal is for parents, guardians, and other authorized adults aged 18 or older. Children must not create accounts, submit information, operate the editor, or interact with its AI features. Adults may export a PDF and read it with a child offline.

An adult checkbox alone does not establish compliance. The audience, access controls, OpenAI's under-18 guidance, and child-related processing require provider and legal review before a wider release.

02. What you provide and what Taleyo stores

• Adult account information: Google sign-in supplies verified account details used for authentication and book ownership. A derived identifier links an account to its books; it is pseudonymous, not anonymous.
• Story details: a nickname, age band, pronouns, broad interests, story choices, and any dedication or instructions you add.
• Character reference: live character creation requires an authorized photo. Supply it only with the necessary rights and permission. Avoid full names, addresses, schools, medical information, and other unnecessary details. Taleyo keeps a sanitized private copy for no longer than the character-creation period or the 24-hour raw-photo window. The Local test-book mode does not accept real photos.
• Previously saved family photos: the removed family-page feature may have left private photos in older books. They are excluded from AI input and new PDF exports but remain stored until explicitly removed or the book is deleted.
• Books and activity: story text, generated images, layouts, revisions, generation jobs, account AI-credit balances, ledger entries, and technical records needed to operate and secure the service.
• Credit purchases: a purchase reference, account binding, pack, price, currency, payment mode, order reference, timestamps, and credit grants or reversals. Taleyo does not store card details or raw payment webhook payloads. Checkout links are temporary and are not analytics events.
• Feedback and bug reports: the report type, subject, message, adult confirmation, and optional book ID that you explicitly choose to include. Reports are linked to your pseudonymous account identifier and stored in MongoDB with a request reference, payload hash, status, and timestamps. No screenshots, logs, photos, story text, prompts, or full page URLs are automatically attached. Please do not put sensitive or child-identifying information in your message. Feedback drafts stay in page memory, not browser local storage.

03. AI processing and other service providers

OpenAI writes story drafts and illustrations. Story requests include the relevant brief, narrative, and instructions and usestore: false. Illustration requests include the relevant story material and visual references. The temporary child photo is sent to OpenAI during character creation; approved character art and continuity artwork are used for later scenes.

Separate OpenAI model calls review story and illustration inputs and outputs. References submitted to image generation, including the temporary photo during character creation, are also sent to OpenAI for review. Generated words and images are returned to Taleyo. Do not upload information you are not authorized to share with this processor.

Family photos saved through the earlier family-page feature are not sent to AI, including for the ending. Photo sanitization removes metadata such as EXIF/GPS; it does not anonymize a face or remove the need for permission.

Other intended processors include Google for authentication, MongoDB for account and book records, Cloudflare R2 for private media, Upstash QStash for background jobs, and the deployment host for application and operational traffic. Image preparation happens inside Taleyo's server process. Final agreements, locations, transfer safeguards, and log retention require operator review.

When credit checkout is enabled, Lemon Squeezy hosts checkout and processes payment and tax information under its own terms. Taleyo sends the chosen pack and a random purchase binding, not story content, child information, photos, or your Google account identifier. Information you enter on the hosted checkout goes directly to the payment provider.

Vercel Web Analytics and PostHog may receive restricted, cookieless page-view and device information when enabled by the operator. Taleyo disables PostHog interaction autocapture, session replay, exception capture, and person profiles. Query strings and URL fragments are removed, and book identifiers in paths are replaced before analytics events are sent. This integration does not intentionally send story text, form values, photos, or generated images.

Source reference: OpenAI API data controls. Provider policies may change and must be rechecked before deployment.

04. Deleting our copy is not the whole picture

Raw reference photos

A 24-hour raw-photo lifecycle in Cloudflare R2 is an intended configuration requirement. The operator must configure and verify the lifecycle rule, upload expiry, and cleanup behavior. A timestamp in the app is not proof that an object has been physically deleted, and lifecycle processing is not exact-to-the-second erasure.

Books, generated images, and operational records

Books and generated images are separate from raw photos and may still contain personal details or a likeness. They have no automatic expiry and stay saved until you delete the book or your account. Raw character references are removed when a character is approved or their temporary retention period ends. Book or account deletion must wait for active generation to finish; failed storage cleanup is retried by maintenance. Generated book media must not have an age-based storage lifecycle expiry.

Older saved family photos remain private with their book until explicitly removed or the book is deleted. In an older book's cover editor, open Words, choose Remove saved family page, then save. Removing the feature or omitting a photo from a PDF does not delete its stored copy.

Minimal pseudonymous account/book identifiers remain for 30 days after cleanup to prevent replay. Rate-limit buckets remain until their minute or daily enforcement windows and TTL cleanup complete, for up to about two days. Sessions last up to seven days unless ended earlier. Backup, platform-log, and operational retention still require deployment-specific review.

Feedback and bug reports

Reports help the team investigate problems and improve Taleyo. They are scheduled for deletion 180 days after submission using MongoDB TTL cleanup, which is asynchronous rather than exact-to-the-second erasure. Deleting your account removes its reports as part of the account-deletion transaction. A book ID is included only with your permission; deleting just the book does not delete a separately submitted report. Backup retention still requires operator review. Submission does not guarantee an individual reply or email.

Independent processor retention

Account deletion detaches the account identifier and removes checkout links and binding secrets from Taleyo purchase records. Minimal purchase records and financial credit-journal entries remain for payment reconciliation, refund handling, and replay prevention; provider order references may still be linkable to provider records. They are not anonymous. A lawful retention period and deletion procedure must be set and reviewed before live sales; no automatic financial-record expiry is currently configured.

Deleting Taleyo's copy does not automatically delete a processor's independent records. OpenAI abuse-monitoring retention may continue for up to 30 days. Other processors may have their own schedules and legal obligations. Downloaded or shared PDFs are separate copies under the recipient's control.

05. Small choices that help protect privacy

Pending book edits are backed up in this browser's local storage for recovery after a refresh or interrupted save. These drafts contain editable story details and appearance settings, not photos or illustration files. They are cleared once the matching edits are saved online. Drafts older than seven days are discarded when read. Clearing this site's browser data also removes them; avoid editing private books on shared devices.

• Prefer a nickname and broad interests. Leave out locations, schools, exact birth dates, and sensitive family details.
• Check older books for saved family photos and remove any you no longer want stored.
• Review text and images before exporting, and choose carefully where you share a PDF.
• Use account settings to sign out or delete the account and its books.

Applicable law may provide rights to access, correct, delete, restrict, object to processing, or obtain a copy of personal data. The operator must publish a working contact channel and explain identity checks and lawful exceptions before launch.

06. What must be settled before launch

Operator identity and contact, permitted audience and use case, consent and lawful basis, security measures, processor contracts, transfer safeguards, retention schedules, and a tested rights-request and deletion process all require review. Child-related data and photographs require particular care even when an adult submits them.

If those conditions cannot be met, real-data processing should remain unavailable. This page must describe the verified deployment rather than presenting intended safeguards as completed work.