Effective date: March 13, 2026 · Last updated: March 13, 2026

1) Who the Service is for

Moontales is designed for children ages 0-11. Accounts, purchases, and optional features that involve personal information should be created, managed, and supervised by a parent or legal guardian. Children should not submit personal information to us on their own.

If you provide information, a photo, or a voice recording for a child, you confirm that you are the child’s parent/legal guardian or that you otherwise have the legal authority and consent required to do so.

2) Information we collect

We collect information needed to operate the Service. Depending on how you use it, we may collect:

A) Parent/guardian account information

• Apple Sign-In identifier (an identifier provided by Apple for your account)
• Email address (if you sign up with email; optional for Apple Sign-In)
• Password (hashed) — if you use email/password; we never store plaintext passwords

B) Child profile information you provide (optional)

• Child first name or nickname (optional)
• Preferences (optional)
• Preferred app language and preferred story language

C) Face Upload (optional)

If you choose to upload a face photo for personalized story illustrations:

• The photo is stored in our private cloud storage (Amazon S3) and linked to your account until you remove it or delete your account
• Uploaded photos stored in our cloud storage are not publicly accessible
• We store a reference (such as an object key/identifier) in our database so we can reuse the photo for future story illustrations until you remove it
• When enabled, the photo is retrieved server-side and sent to our AI processing partners (Google/Gemini) to generate personalized illustrations
• For convenience, the app may also store a copy of the uploaded photo locally on your device so it can be displayed without downloading
• This feature is entirely optional — you can use Moontales without uploading any photos
• You can remove the uploaded photo at any time through the app settings (if available)

D) Usage and progress information

• Story interaction and progress data, such as:
  • which stories were opened
  • completion status
  • last page read
  • stories created, opened, saved, or shared
  • library state
  • quotas/limits usage counters (stories used/remaining)

E) Subscription and purchase information (Apple In-App Purchases)

If you subscribe through Apple:

• Subscription state (active/expired), renewal status, expiration date
• Transaction IDs and original transaction IDs
• Receipt/receipt verification data used to validate your entitlement
• Plan identifiers and billing cycle (monthly/yearly)

F) Diagnostics, security, and service integrity

We do not use third-party analytics SDKs, third-party advertising SDKs, or cross-app tracking in Moontales.

To operate, secure, and troubleshoot the Service, we may keep limited first-party technical records such as request timestamps, subscription verification results, crash/error details, and abuse-prevention signals.

We use these records only for internal operations like security, reliability, debugging, and entitlement management. We do not use them to build advertising profiles or to track users across apps, websites, or devices.

G) Push notification data

If you opt into notifications:

• APNs device token (push token) to deliver notifications

3) Personal Voice feature (ElevenLabs)

Personal Voice is an optional feature available to Plus/Premium users (for example, a parent, guardian, or narrator voice).

If you choose to use Personal Voice:

• Your voice recording is sent to ElevenLabs to create a voice model and generate narration.
• We do not store the raw audio recording on our servers.
• We store only an ElevenLabs voice identifier (voice ID) in our database so you can reuse Personal Voice without re-recording.
• You can delete your Personal Voice in the app. Deleting it removes the stored voice ID and disables reuse. Where supported, we will also request deletion on the provider side.

4) How we use information

We use information to:

• Operate the Service (authentication, story delivery, saving reading progress)
• Personalize stories based on preferences you provide
• Validate subscriptions and enforce plan limits
• Maintain performance, reliability, and security
• Respond to support requests
• Prevent fraud and abuse and enforce our Terms

AI-generated content & personalization

When you use features that generate stories or illustrations:

• Your story prompts and preferences are sent to AI providers (Google/Gemini) to generate text and images
• If you upload a photo, we retrieve it server-side and transmit it to our AI provider during image generation to create personalized illustrations
• Personalized image generation is entirely optional — you control whether to upload a photo
• You can remove your uploaded photo at any time through the app settings (if available)

5) Sharing and third parties (service providers)

We share data with third parties only as needed to run the Service. These providers act as "service providers" or "processors" and process data on our behalf:

Provider	Purpose
Amazon Web Services (AWS/S3)	Cloud hosting, file storage (including uploaded photos), content delivery
Google / Gemini	AI story text generation and image generation. Uploaded photos are transmitted to generate personalized illustrations.
Apple (App Store / StoreKit)	Subscription billing, payment processing, restore purchases
ElevenLabs	Personal Voice cloning and text-to-speech narration
Google Cloud TTS	Standard text-to-speech narration for stories

We do not sell your personal information. We do not share data for advertising purposes, and we do not use third-party analytics or cross-app tracking in the children’s version of the Service.

6) International transfers

We are based in the United Kingdom. Some of our service providers (such as AWS, Google, and Apple) may process data in other countries, including the United States. When data is transferred outside the UK or European Economic Area, we rely on appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by relevant authorities
• Adequacy decisions where applicable
• Contractual commitments from our service providers

By using the Service, you acknowledge that your data may be transferred to and processed in countries with different data protection laws than your own.

7) Data retention

• We keep account, progress, and history data while your account remains active so you can access your progress.
• We retain subscription verification data as needed to validate entitlements and prevent fraud.

Specific retention periods

• Uploaded photos: Stored in cloud storage and linked to your account until you remove it or delete your account — then permanently deleted from our systems
• Account data: Retained while your account is active
• Personal Voice: Voice ID retained until you delete it; we request deletion from ElevenLabs when you remove it
• Security/fraud logs: Limited metadata may be retained up to 90 days for security and fraud prevention
• Subscription records: Retained to validate entitlements and enable restore purchases

Deletion and purge

• If you request account deletion, we will delete or anonymize personal data and unlink progress/history within 30 days, except where retention is required for legal or fraud-prevention reasons.
• Uploaded photos are permanently deleted from our cloud storage (S3) when you delete your account.
• You can also delete your uploaded photo at any time without deleting your account (Settings → Face Upload → Remove, if available).
• Backups, if any, may persist briefly before being overwritten.

Post-deletion retention

After account deletion, we may retain:

• Limited identifiers: Certain account identifiers may be retained solely for fraud prevention and to prevent abuse (e.g., to ensure deleted accounts cannot re-claim promotional offers). We retain limited identifiers only as long as necessary for fraud prevention and enforcement.

8) Your rights and choices

Depending on your location, you may have the right to access, correct, or delete your information and object to certain processing.

In-app controls

• Remove uploaded photo: You can delete the uploaded photo at any time in Settings (if available). This removes the photo from our cloud storage (S3) and our database.
• Delete Personal Voice: available in Settings (if enabled)
• Push notifications: can be disabled in iOS Settings
• Parent/guardian requests: A parent or legal guardian can contact us to review or delete a child’s information.

Account deletion

Account deletion may be available:

• In-app (Settings → Account → Delete Account), if your version includes it, and/or
• By emailing support@moontales.app from the address associated with your account

9) Security

We use reasonable safeguards to protect information, including:

• Encryption in transit: All data transmitted between the app and our servers uses HTTPS/TLS encryption
• Encryption at rest: Cloud storage (AWS S3) encrypts stored files
• Access controls: Uploaded photos are stored in private cloud storage with access controls. The Service retrieves the photo server-side when needed to generate personalized illustrations. The app may also keep a local copy on your device for display.
• Secure authentication: Passwords are hashed, and we support Apple Sign-In for enhanced security

No system is 100% secure, but we take reasonable precautions to protect your data.

10) Children's privacy

Moontales is directed to children ages 0-11. We design our privacy practices to support children’s privacy requirements, including COPPA and similar laws where they apply.

Accounts, purchases, photo uploads, and other optional features that involve personal information must be handled by a parent or legal guardian. We collect child personal information only when it is provided by a parent/legal guardian, submitted under their supervision, or otherwise authorized by them as required by law.

We do not use third-party analytics, third-party advertising, or cross-app tracking in the Service. Parents and legal guardians may contact us at support@moontales.app to request access to, correction of, or deletion of a child’s information, or to stop further collection where applicable.

If you believe a child has provided personal information without appropriate parent/legal guardian authorization, please contact us and we will investigate and take appropriate action.

11) Changes

We may update this Policy. We will revise the "Last updated" date and may provide notice in the app.