Privacy Policy

Accounts are for adults aged 18 or older. A parent or guardian creates the account and supplies all details about a child. Children do not create their own accounts, sign in, or submit personal information directly to Story Universe.

• The parent account email address and account details.
• A child's story name, age band, interests and personality traits, as chosen by the parent.
• Hero-builder choices, generated stories, illustrations and story memory used to keep adventures consistent.
• Story Credit balances, redemptions and purchase records, but not full payment-card details.
• Service, safety and error records needed to operate and protect the product.
• Anonymous usage events, such as a story being started, without child names, photographs or story text.

We use this information to create and maintain the parent's account, personalise a child's hero and stories, preserve story continuity, provide purchased Story Credits, prevent misuse, resolve faults, answer support requests and understand how the service performs. We collect it directly from the parent because it is needed to provide the features the parent requests.

Photo-based hero creation has been retired for new users. A small number of existing accounts may still have a photograph previously uploaded by a parent. Those photographs remain in private storage until the parent deletes the photo in Settings or asks us to delete the account. They are not public and are shown only through temporary access links to the signed-in family.

We disclose only what is reasonably needed to service providers that help us operate Story Universe. Google AI models, accessed through Lovable's AI service, generate story text and artwork. Prompts may include the child's story name, age band, interests, hero description and relevant story history. For legacy photo heroes, a photograph may have been sent to the image model when the parent requested the original hero drawing. We do not knowingly permit submitted names, story text or legacy photographs to be used to train external models.

Stripe processes card payments. Story Universe does not receive or store full card numbers. Lovable Cloud provides hosting, authentication, database and private-file storage services. These providers may process data in countries where they or their infrastructure operate. We do not sell personal information or share it for advertising.

Story Universe does not use third-party advertising trackers. The service stores a randomly generated, anonymous analytics identifier and basic return-visit information in the browser's local storage. This helps us count product events and understand whether the service is working. Analytics events do not contain child names, photographs or story text. Sign-in and essential service storage may also be used to keep the parent securely signed in.

We use encrypted web connections, signed-in account access, private media storage and database access rules that limit each family to its own profiles, stories and illustrations. Temporary links are used when private media needs to be displayed. No online service can guarantee absolute security, but we limit access and the information sent to providers to what is needed to operate the service.

We keep account and family information while the account is active so stories remain available. A parent can delete an individual child profile and its stories in Settings. Legacy photographs can also be deleted there. To request deletion of the whole account, email us from the account address. After we verify the request, we aim to delete active account data within 30 days. Residual copies may remain temporarily in protected backups until they expire through the hosting provider's normal backup cycle and are not used for ordinary service delivery.

You may ask for access to personal information we hold about you or your family, ask us to correct it, or ask us to delete it where applicable. You can manage child profiles and legacy photographs in Settings, or email us at hello@herotales.org. We may need to verify that the request comes from the account holder. If we cannot resolve a privacy concern, you may complain to New Zealand's Office of the Privacy Commissioner.

Story Universe is operated from New Zealand and personal information is managed under New Zealand law. If you use the service from another country, you acknowledge that your information will be processed in New Zealand and by the service providers described above. The service is intended for parents and guardians acting on their own initiative; it is not directed at soliciting information directly from children. We do not claim that the service is designed to meet every child-privacy law outside New Zealand.

Privacy questions and requests can be sent to hello@herotales.org.