WhisperTales is built for families. We take child privacy seriously and have designed the app to keep as much information as possible on your device. This policy explains exactly what we collect, why, and how we protect it.
1 Who We Are
WhisperTales is developed and operated by Uniquegem Visions. If you have any questions about this policy, please contact us at uniquegemvisions@gmail.com.
2 Children's Privacy
WhisperTales is designed for use by families and may be used to create content for children. We comply with:
- USA COPPA — Children's Online Privacy Protection Act
- EU/UK GDPR-K — General Data Protection Regulation (children)
- UK Age Appropriate Design Code
- Australia Privacy Act 1988 and the Online Privacy Bill
The only exception: when generating a personalised story, your child's first name only may be sent to our backend server to personalise the story narrative. This name is used in the moment and is never stored server-side. Our story generation API is stateless with respect to child data.
We never collect, store, or transmit photos of children. There is no camera access or image upload feature for child profiles.
3 What We Collect
| Data | Where stored | Purpose |
|---|---|---|
| Device IDOpaque UUID generated on install | On-device + our server | Rate-limiting daily story generation. No personal data attached. |
| Child profilesName, age, interests | On-device only | Personalising story generation. Never leaves your device. |
| Voice recordingsAudio captured via microphone | Processed transiently | Creating a voice clone. Raw audio deleted after processing. See §4. |
| Personalised stories | On-device only | Saved locally for re-listening. Automatically expire after 30 days. |
| Subscription status | RevenueCat (third party) | Verifying Pro subscription. No child data is shared. |
We do not collect: real names beyond first name for story generation, email addresses, location data, contact lists, browsing history, or advertising identifiers.
4 Voice Recording & Cloning
The voice cloning feature (Pro) lets a parent or guardian record their voice so stories can be narrated in that voice.
- You record a short voice sample in the app (microphone access required).
- The audio is sent securely to Cartesia, our third-party voice synthesis provider, to create a voice model.
- The raw audio recording is deleted immediately after the model is created.
- The voice model is stored by Cartesia under an opaque vendor ID — not linked to any personal identity.
You can delete your voice profile at any time from within the app, which removes the voice model from both the app and Cartesia's systems.
By recording your voice, you consent to this processing. Please do not record anyone else's voice without their explicit consent.
Cartesia's privacy policy: cartesia.ai/legal/privacy.html
5 Story Generation
Personalised stories are generated using Google Gemini. When generating a story, we send:
- Your child's first name only (optional, for personalisation)
- Selected story theme and age range
- Any custom story idea you type
We do not send full child profiles or any identifying information. Generated story text is returned to your device and stored locally — nothing is retained on any server after generation.
The generated story text is then sent to Microsoft Azure Cognitive Services (or Cartesia, depending on your selected voice) to produce audio narration. This text contains no personal data.
Google's privacy policy: policies.google.com/privacy
Microsoft's privacy policy: privacy.microsoft.com
6 Microphone Access
Microphone access is requested only when you choose to use the voice cloning feature. It is never accessed in the background and is not required for the app's core features (story library, playback, child profiles).
You can revoke microphone access at any time in your device settings.
7 Notifications
If you enable bedtime reminders, we schedule device-local notifications at your chosen time. These are generated entirely on your device — no notification server, no data transmitted. You can disable them at any time in the app or your device settings.
8 Analytics
We use Firebase Analytics (Google) to collect anonymous usage data, such as which features are used and how often. This data does not include any personal information, child profile data, or story content.
Analytics data is used solely to improve the app experience. It is never shared with third parties for advertising purposes. Ad storage and ad user-data consent are explicitly disabled.
Google's privacy policy: policies.google.com/privacy
9 Third-Party Services
| Service | Purpose | Child data? |
|---|---|---|
| Supabase | Public story library, rate-limit counters | No |
| Cartesia | Voice cloning and synthesis | No |
| Google Gemini | AI story generation | First name only, stateless |
| RevenueCat | Subscription management | No |
| Microsoft Azure Cognitive Services | AI voice narration (text-to-speech) | No |
| Firebase Analytics (Google) | Anonymous usage analytics | No |
| Google Cloud Run | Backend API hosting | No |
10 Data Retention & Deletion
- Child profiles — retained on your device until you delete them in the app.
- Personalised stories — automatically expire and are deleted from your device after 30 days.
- Voice models — retained until you delete your voice profile in the app.
- Device ID + counters — retained on our server for rate limiting. Contains no personal data. You can request deletion by contacting us.
Uninstalling the app removes all on-device data. To request deletion of any server-side data, contact us at uniquegemvisions@gmail.com.
11 Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data, or to withdraw consent at any time.
Because most data is stored on your own device, you have direct control over it. For any server-side data requests, contact us at uniquegemvisions@gmail.com and we will respond within 30 days.
Parents and guardians can delete a child's profile directly in the app at any time, which removes all associated on-device data immediately.
12 Security
All data transmitted between the app and our backend is encrypted in transit using HTTPS/TLS. On-device data is stored using platform-provided encrypted storage. Voice recordings are transmitted over encrypted connections and raw audio is deleted immediately after voice model creation.
13 Changes to This Policy
If we make material changes to this policy, we will update the "Last updated" date above and notify users within the app. Continued use of WhisperTales after changes constitutes acceptance of the updated policy.