Privacy Policy

Sections to be written by counsel

1. Who we are ([LEGAL ENTITY NAME: TBD]) and how to contact us [to be written]
2. What we collect from adults with accounts [to be written]
3. What we do not collect, including anything about children [to be written]
4. Information kept only on your device [to be written]
5. How we use information [to be written]
6. Service providers we share data with [to be written]
7. How long we keep data (see the retention policy) [to be written]
8. Deleting your account [to be written]
9. Legal holds and preservation obligations [to be written]
10. Children's privacy (COPPA) [to be written]
11. State privacy rights [to be written]
12. Security [to be written]
13. Changes to this policy [to be written]

Facts about how the app works today (for counsel)

• Accounts are for adults only, one person per account. Children never have accounts or profiles.
• We store for each account: email address, a one-way password hash (if a password is set), when the email was confirmed, plan and subscription status from Stripe, Stripe customer and subscription IDs, any partner-code access end date, and whether a legal hold is set.
• We never collect children's names, ages, birthdates, photos, recordings, custody or placement information, or emotional assessments. The age filter is chosen on the page and not stored.
• We keep no server-side listening or reading history. Resume positions, read-along positions, the last ending choice, display preferences and offline stories are stored only in the browser.
• Free stories need no account and set no cookies. The only cookie is the sign-in cookie, set after an adult signs in.
• No ads, no analytics, no third-party trackers.
• Service providers: Stripe (payments, hosted checkout; we never see card numbers), Resend (sign-in and account emails), Vercel (hosting and file storage), Neon (database).
• Partner codes record only how many uses remain, not which account used them.
• Subscribers can opt in (off by default) to have one preferred closing tradition (which may be a faith tradition) and one narrator voice kept on their account, so other devices start with them. No history or dates are kept; turning it off clears them; they are cleared when subscriber access ends. A faith tradition may be sensitive religious-belief data under some state laws.
• Temporary data (email link tokens, expired sessions, rate-limit counters) is deleted daily. Unconfirmed signups are deleted after 7 days by default.
• Deleting an account cancels any subscription immediately and removes the account at once, unless a legal hold applies; then it is deleted within 24 hours of the hold being cleared. The database host keeps point-in-time history for 6 hours, so deleted data is fully gone within 6 hours.
• Legal hold records keep the date, the admin and the reason, and are deleted with the account.