Privacy policy

Who is the data controller

The controller of personal data is the seller of Hug a Story (“we”): the seller's details at the top of this page. For anything about your data, write to [email protected].

We have not appointed a data protection officer: at our scale and with the data we process, the law does not require one (art. 37 GDPR).

This policy covers the Hug a Story website and the iOS and Android apps. Cookies and browser storage are described separately in the cookie policy.

Whose data we process

• Parents and guardians who have an account (adults only).
• Children whose details a parent enters in a child profile. Children do not create accounts or give us data themselves.
• People a parent invites to record a story (for example grandparents), including people without an account.
• People who subscribe to the newsletter, write to us or report content.
• Website visitors.

What data we collect and where it comes from

• Account data (from you): name, email address and password stored as a secure hash (bcrypt). When you sign in with Apple or Google, they give us an account identifier, an email address (with Apple this may be a relay address) and your name.
• Devices with the app: device name, system, app version and a hash of the session token.
• Use of the service: settings (emails, default age, narration), favourites, stories you create and the ideas (prompts) you enter.
• Where your account came from: the platform (website, iOS, Android) and how the account was created and, if you accepted analytics cookies, also the campaign and the site of your first visit (e.g. utm_source).
• Child profiles (from the parent): the child's first name, age group and interests. We do not collect a child's date of birth, photos or surname.
• Family recordings: your voice in story recordings, and the voice of an invited person with the reader name the parent gives them (for example “Grandma Ela”).
• Parent's AI voice (Premium): the recording of the consent sentence, which is also the voice sample, the voice name, and stories read in that voice.
• Payments: plan, amount, currency, status, payment method and order numbers. PayU, Polar, Apple and Google tell us whether a payment succeeded. We never receive card or bank details.
• Consents and withdrawals: when you asked for the service to start, when you accepted the AI limitations, and withdrawal statements.
• Gift cards: the recipient's name and e-mail and the wish, if the buyer gives them (from the buyer, not from you, when you receive the gift).
• Contact: name, email and message from the contact form or an email; the email address subscribed to the newsletter (on the launch list also your child's age group, if you give it).
• Reading statistics: which story was opened and when, with the IP address anonymised before it is stored.
• Technical logs: errors and server requests; email addresses, IP addresses, identifiers and secrets are masked before they are written.
• Anonymous counters: how many times a day someone read a story to the end, created an account or a child profile or started a payment, separately for the website and the app. No identifiers, IP addresses or cookies, so nobody can be recognised from them.
• Analytics (only with your consent to analytics cookies): visit data collected by Google Analytics.

Why, on what basis and for how long

Each purpose has its own legal basis under art. 6 GDPR and its own retention period. After that we delete the data or anonymise it permanently. Deleted data may remain for up to 30 days in backups, which overwrite themselves automatically.

• Your account and the service (account data, devices, settings, favourites, your stories and ideas): performance of the contract (art. 6(1)(b)). Until you delete your account.
• Stories about your child (child profile, ideas): our and your legitimate interest in making stories about your child when you ask for them (art. 6(1)(f)). Until you delete the child profile or your account.
• Family recordings: performance of the contract with you (art. 6(1)(b)); an invited person's voice: their consent, given before recording starts (art. 6(1)(a)). Until the recording is deleted, consent is withdrawn or the account is deleted.
• Parent's AI voice: your explicit consent, recorded in your voice (art. 6(1)(a), and, should the voice sample be treated as special-category data, also art. 9(2)(a)). Until you withdraw consent (“Delete voice”) or delete your account. A voice blocked after an abuse report: we delete the sample and the recordings at once and keep the voice name, the consent sentence and the reason for a year after the decision (art. 6(1)(c) and (f)), so the same voice does not return to the account.
• Payments, invoices and tax: performance of the contract (art. 6(1)(b)) and a legal obligation under tax law (art. 6(1)(c)). We keep tax records for 5 years from the end of the year in which the tax payment deadline passed. After an account is deleted only the payment record remains (amount, date, method, order number), no longer linked to the account.
• Referral programme: who referred whom (a link between the accounts) and the free days given: performance of the contract (art. 6(1)(b)). Until you delete your account.
• Launch list reward: we match the confirmed address on the launch list with your account address and add the promised 30 days of Premium; this keeps the promise of the launch list (art. 6(1)(b)). We note the date of the reward with the address on the list, so the reward goes to one account. As long as the list entry.
• Sharing a story with family: when you create a link to a story made to order, anyone who gets it can read it (with the child's name), see the illustrations and listen to the narration. We never show the idea, the account or the child's other details, and the page is kept out of search engines. Basis: your instruction under the contract (Art. 6(1)(b)). You can turn the link off in the reader with one button; it also stops working when the story or the account is deleted.
• Sending a gift card to its recipient: our and the buyer's legitimate interest in delivering the gift (art. 6(1)(f)). Until the code is used or expires (24 months); the sale record as for payments.
• Records of consents, withdrawals, complaints and protection against claims: legal obligation (art. 6(1)(c)) and our legitimate interest in showing we acted lawfully (art. 6(1)(f)). Until claims become time-barred, at most 6 years after the contract ends.
• Emails about your account and purchases (password reset, confirmations, reminders that access is ending, reminders before a trial ends, a failed card payment, the cancellation confirmation with a question about the reason): performance of the contract (art. 6(1)(b)). For as long as the account exists.
• Newsletter: your consent (art. 6(1)(a) and art. 398 of the Polish Electronic Communications Law). You confirm the sign-up with the link we e-mail you; an address not confirmed within 30 days is deleted. Until you withdraw consent (a link in every e-mail) or delete the account with the same address; after that only the address and the date you left stay, so nobody can sign it up again without new consent. We keep proof of consent (the dates of sign-up and confirmation) until claims become time-barred.
• Tips and offers by e-mail (the welcome series, a survey asking whether you would recommend us, an offer a month after a plan ended): your consent, ticked at sign-up or in the settings (art. 6(1)(a) and art. 398 of the Polish Electronic Communications Law). Until you withdraw it (the link in every e-mail or the account settings).
• Survey answers (a 0-10 score, the reason for cancelling, a comment): our legitimate interest in improving the service (art. 6(1)(f)). Until you delete your account; after that without a link to it.
• Replies to messages and content reports: our legitimate interest in answering correspondence (art. 6(1)(f)) and duties under the Digital Services Act (art. 6(1)(c)). One year after the matter is closed.
• Reading statistics: our legitimate interest in developing the catalogue (art. 6(1)(f)). Until you delete your account; entries without an account for up to 24 months.
• Where your account came from: the platform and the sign-up method are our legitimate interest in knowing where customers come from (art. 6(1)(f)); the campaign and referring site: your consent to analytics cookies (art. 6(1)(a) and art. 399 of the Polish Electronic Communications Law). Until you delete your account.
• Security, logs and content moderation: our legitimate interest in protecting the service, users and children (art. 6(1)(f)). Logs rotate automatically (the oldest entries disappear once five 5 MB files are full, usually within a few weeks). We do not keep rejected ideas.
• Website analytics: your consent to analytics cookies (art. 6(1)(a) and art. 399 of the Polish Electronic Communications Law). Google Analytics keeps the data for 2 months.
• Ad measurement (Meta pixel, Google Ads): your consent to marketing cookies (art. 6(1)(a) and art. 399 of the Polish Electronic Communications Law). Until you withdraw it; cookies up to 3 months.

Who receives data

We do not sell data or share it with advertisers. We pass data only to those without whom the service cannot work:

• OpenAI Ireland Ltd (Dublin, Ireland), processor: writes stories, draws illustrations, narrates and moderates content based on ideas and child-profile details. OpenAI does not train models on data sent through the API and keeps it for up to 30 days to detect abuse. Data may reach OpenAI in the USA under standard contractual clauses.
• Cloudflare, Inc. (USA), processor: content delivery network, protection against attacks and file storage (video and audio).
• The provider of the server the service runs on, and the email provider that sends account and purchase emails: processors.
• RevenueCat, Inc. (USA), processor: links App Store and Google Play purchases to your account (account identifier and purchase history).
• Google Ireland Ltd (Ireland), processor: Google Analytics, only if you consent to analytics cookies.
• Meta Platforms Ireland Ltd (Ireland) and Google Ireland Ltd (Google Ads), joint controllers for ad measurement: only if you accept marketing cookies while we run campaigns.
• Polar Software, Inc. (USA), separate controller: sells card subscriptions as the seller (Merchant of Record) and processes payment data under its own privacy policy (polar.sh/legal/privacy). We pass it your email and account identifier to open the payment.
• PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań, Poland, separate controller: processes BLIK payments. We pass it your email, the amount and the order description. See PayU's privacy policy (payu.pl).
• Apple and Google, separate controllers: sign-in with Apple or Google and purchases in the App Store and Google Play, under their own rules.
• Your family and the people you invite: only the recordings and stories you share with them.
• Public authorities and courts: only when the law requires it.

Transfers outside the European Economic Area

Some providers are based in the USA or transfer data there. We protect it as follows:

• Cloudflare, Inc. and Google LLC take part in the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision (Decision 2023/1795, art. 45 GDPR). Cloudflare also uses standard contractual clauses.
• OpenAI (onward transfer to the USA), RevenueCat, Inc. and Polar Software, Inc.: standard contractual clauses adopted by the European Commission (Decision 2021/914, art. 46(2)(c) GDPR).
• You can get a copy of the safeguards by writing to [email protected].

Children's data

• Only adults may create an account. Children listen to and read stories under a parent's care.
• A child profile holds only a first name, age group and interests. We address information about what we do with this data to the parent as the child's legal representative.
• The child's name and interests go to OpenAI only when you create a story for that child; they are not used to train models.
• We do not profile children, do not direct advertising or marketing at them and do not show them other users' content.
• You can delete a child profile at any time; it is also deleted with the account.

Voice recordings and the parent's AI voice

• “Record how you read” recordings are private: only the family they belong to hears them. We do not train artificial intelligence on them and share them with no one.
• We create the parent's AI voice from a recording of a consent sentence with a one-time code. The voice sample may count as biometric data, but we never use it to recognise or authenticate anyone: it is used only to read stories in your voice to your family.
• We process the sample and recordings on our server and our studio computer in Poland, without outside artificial intelligence providers. We do not train models on them.
• Recordings read in the AI voice are labelled “AI voice”.
• You can withdraw consent as easily as you gave it: with the “Delete voice” button. We then delete the sample and every recording in that voice; they disappear from backups within 30 days.
• We carried out a data protection impact assessment (DPIA) before launching this feature.

Information for people invited to record

If a parent invited you to read a story, we are the controller of your data (details at the top of this page). We received from the parent the name they gave you (for example “Grandma Ela”), and from you the voice recording.

• Purpose: storing the recording and making it available to the family that invited you, so the child can listen to it.
• Basis: your consent, given before you start recording (the “Start” button) (art. 6(1)(a) GDPR). You can withdraw it at any time by writing to [email protected]; this does not affect the lawfulness of earlier processing.
• Recipients: the family that invited you and our server providers. The recording does not go to artificial intelligence providers.
• Period: until the family deletes the recording, you withdraw consent, or the family's account is deleted.
• You have the same rights described below, including the right to have the recording deleted and to complain to the Polish data protection authority (UODO).

Automated decisions

Story ideas and finished stories are checked by an automated safety filter (OpenAI's moderation model). Rejecting an idea only means that this story will not be created; it has no legal effect and does not significantly affect you in any other way, so it is not a decision under art. 22 GDPR. If you think the filter made a mistake, write to [email protected] and a person will check. We do not profile users.

Do you have to give us data

• An email address and password (or sign-in with Apple or Google) are needed to make the account contract; without them you cannot create an account.
• Payment data is needed to buy, and tax law requires it.
• Child profiles, recordings, the parent's AI voice, the newsletter and the contact form are optional; without them you can use the rest of the service.

Your rights

• You have the right to access your data, rectify it, erase it, restrict its processing and port it, and to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Download your data and delete your account in Settings → Data and privacy on the website or in the Account tab of the app. You can also write to [email protected].
• We answer every request within one month.
• You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland (uodo.gov.pl).

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on our legitimate interest (art. 6(1)(f) GDPR), including processing of child-profile data and reading statistics. Write to [email protected]; we will stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, or grounds for establishing, exercising or defending legal claims. On request we will explain how we assessed our interest.

Security

Connections are encrypted (HTTPS), passwords are stored as bcrypt hashes, payment webhooks are verified by signature, and access to paid content is checked on the server. Recordings and voice samples are kept outside the public directory and are reachable only through signed, expiring links.

Changes

If we change this policy, we will update the date at the top of this page and tell you about significant changes by email.