Privacy

Who we are

Stanislav Steinberg operates TaleSprouts at talesprouts.steinberg-tech.com, and is the data controller for everything described here.

Questions about anything below: privacy@steinberg-tech.com.

Accounts belong to grown-ups

A TaleSprouts account belongs to a parent or carer. Children do not sign in and have no account of their own.

The app does not ask about children at all: there are no child profiles, and no names or ages of real children. Nothing is collected from a child directly, and nothing is used to build a profile for advertising or any other purpose outside the app.

What we keep

From Google Sign-In: your email address, the name on your Google account, and the account identifier Google gives us. We never see your Google password, and we ask Google for nothing else.

Favorites: a label you choose, a reading language, a narrator, and an age between two and six that the stories are pitched at. A favorite describes how you like to listen, not who is listening, so please do not use a child's name as its label.

Favorite stories: the stories you mark with a heart, so they wait for you under Favorites.

Stories you ask us to make: what you wrote to describe the story, the story written from it, and its pictures and narration. They are yours alone - no other family can open them - and they stay until you delete the story or your account.

Reading activity: which story was opened, which choices were taken, when a scene started, the narrator and language in use, and the rating at the end of a story. This is how we learn which stories work.

Notes: whatever a grown-up writes in the note box at the end of a story.

Problem reports: what you write when you report a problem with a page, and which page and story it was about. We read them to fix things, and they go when they have been dealt with or when you delete your account.

Membership: while paid membership is available, the payment itself is handled by our payment provider. We store the status of a subscription, its tier and its renewal date. Card numbers never reach us.

Server records: ordinary web-server logs of requests, kept by Google Cloud for a short period and used for security and for fixing things that break.

What we do not do

No advertising, and no advertising or analytics trackers of any kind - there are no third-party scripts in this app.

We do not sell or rent anything about you or your family, and we do not hand it to anyone else for their marketing.

We do not send marketing email. Email from us is about your account.

Cookies, and what your browser keeps

One cookie, named __session. It holds a random sign-in token and nothing else. It is HttpOnly, Secure and SameSite=Lax, it lasts seven days, and signing out deletes it immediately.

Your browser also remembers your language, your narrator and your reading mode locally, so that a family does not pick them again every night. That stays in your browser and is never sent to us.

Where it is kept

TaleSprouts runs on Google Cloud, in us-central1. The database, the audio and the artwork all live there, encrypted at rest by Google.

If you are in the EEA, the UK or Switzerland, that means your data is transferred to the United States. Google Cloud is engaged under terms that include the European Commission's standard contractual clauses, which is the legal basis for the transfer.

How long we keep it

Your account and its favorites stay until you delete them.

Deleting a favorite removes only that saved setting. Deleting your account removes the account, its favorites, your reading history, notes and ratings, and everything attached to them.

The sign-in cookie and its session last seven days. Daily usage counters expire after two days. Deleted data can survive in Google Cloud's encrypted backups for a short period before it ages out.

Records of a payment are kept for as long as tax law requires, which is the one thing deleting an account does not erase.

Why we are allowed to keep it

To give you the service you asked for: your account, your favorites and your reading history exist because the app cannot work without them. In GDPR terms, performance of a contract.

Our legitimate interests: keeping the service secure, stopping abuse, and understanding which stories families finish.

A legal obligation: records of payments.

Your rights

You can ask for a copy of what we hold, correct it, or have it deleted. Deletion does not need to go through us: the account page deletes everything, immediately.

You can also object to processing based on our legitimate interests, and ask for your data in a portable form.

Write to privacy@steinberg-tech.com and we will answer within one month.

If you are in the EEA or the UK and you think we have got this wrong, you can complain to your national data protection authority.

Who else is involved

Google Cloud hosts the app, the database and the files. It is a processor: it holds the data on our instructions and does not use it for anything of its own.

Google Sign-In identifies you when you sign in.

Our payment provider handles checkout and subscriptions as merchant of record when paid membership is available, and holds the payment details we never see.

Narration and artwork are generated using Google Cloud AI services (Vertex AI and Text-to-Speech). For our own stories they work from text we wrote. When you ask us to make a story, or change one, what you wrote is sent to them to write, check, illustrate and narrate it, with the language, narrator and age of the favorite you chose. Nothing else about your family - no reading history - is sent, and none of it is used to train a model.

Our email provider, Resend, sends the invitation when a parent is invited: it receives the invited address and the text of the invitation, and nothing else.

Nobody else. We have no analytics provider, no advertising network and no data broker.

Security

The site is served over HTTPS only. Sign-in tokens are stored hashed, so a copy of the database is not a set of working sessions. Secrets are held in Google Secret Manager rather than in the code or in a file on the server.

No system is perfect. If something goes wrong that affects you, we will tell you.

Changes

If this policy changes in a way that matters, we will say so in the app rather than quietly editing the page. The date at the top is when the wording last changed.