Privacy Policy

1. Overview

This Privacy Policy explains how TapStory inc. ("TapStory", "we") handles personal information when you use https://tapstory.ai and the TapStory Service. TapStory inc. is the data controller for that information. Contact: support@tapstory.ai.

TapStory is built for families with young children. Information about children is covered in more detail in our Children's Privacy Notice, which forms part of this Policy.

Effective date: 2026-10-08.

2. Information we collect

Account information. When you sign in with Google or Apple we receive your name, e-mail address, profile picture (if provided), e-mail verification status and a provider identifier. Google sign-in requests only the openid, email and profile permissions to create your account, authenticate you and show your account identity; it does not request access to Gmail, Drive, contacts or your Google Photos library. We do not receive your Google or Apple password.

Content you create. Story ideas, character names and descriptions, images you choose to upload, and the stories, illustrations and narration generated for you. This may include information about a child in your care that you choose to provide.

Photos and voice recordings of real people. You can give a story character the appearance or the voice of a real person, for example your child or a grandparent. To do so you upload a photo of that person and record a short sample of their voice. The photo is used as the reference for drawing the character; the recording is used as the reference for synthesising the voice. We treat both as sensitive data. We collect them only after you, as the adult account holder, have read a notice in the app and confirmed that you are the person's parent or legal guardian or have their consent. Location and other metadata are removed from the photo in your browser before upload. Both are deleted when you delete the character.

Spoken story ideas. In the children's interface a child can say a story idea out loud. The recording is sent to a speech-recognition provider to be turned into text and is deleted once the transcription is complete. Only the text is kept with the story.

Payment information. Purchases are processed by Creem. We receive your customer identifier, plan, subscription status and billing history; Creem holds your payment card details under its own privacy policy.

Technical information. IP address, browser and device type, language, pages visited, timestamps and error logs, collected automatically by our hosting provider and our servers to run and secure the Service.

Preferences. Your interface language, stored in a cookie, and small settings stored in your browser: the child's nickname and gender you enter in the children's interface, the chosen art style and whether sound is muted.

Communications. Messages you send to us, for example a support or content report.

3. How we use information

• To provide the Service: create and store your stories, play them back, and share them through the links you create.
• To generate content: send your inputs to the AI model providers we use for text, image and speech generation, and receive the results.
• To manage your account and plan: sign-in, credits, billing status, membership changes.
• To keep TapStory safe: automated moderation of prompts and outputs, abuse and fraud prevention, security logging.
• To communicate with you: service, billing and security notices, and replies to your requests.
• To improve the Service: aggregated, de-identified usage statistics and quality review of failures.

We do not sell personal information, we do not show advertising, and we do not use personal information for behavioural advertising or profiling.

Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you (providing the Service and your plan); our legitimate interests (security, abuse prevention, service improvement) balanced against your rights; your explicit consent for photos and voice recordings of real people (Article 9(2)(a)), which you give in the app before they are collected and can withdraw at any time by deleting the character; and compliance with legal obligations (tax and accounting records).

4. AI processing

To create stories we send the relevant inputs to third-party AI model providers that generate text, images and speech on our behalf. Specifically:

• Story text is written by a large language model operated by a provider in China. It receives the story idea, character names and descriptions.
• Illustrations are generated by an image model operated by a provider in China. It receives the scene descriptions and, for personalised characters, the reference photos you uploaded.
• Narration and dialogue are synthesised by a speech provider in Singapore. It receives the story text and, for personalised voices, the voice recordings you provided.
• Spoken story ideas are transcribed by a speech-recognition provider in China. It receives the recording and returns text.

These providers act as our processors under contracts that restrict their use of the data to providing the service to us. We send only what is needed for the specific generation step, and we do not send your account details. See section 8 on international transfers.

We do not use your content to train AI models. We require our providers to process your content only to return the requested result and not to use it to train their models, and we review each provider's terms on this point before using it.

5. Who we share information with

• Hosting and infrastructure: Cloudflare (application hosting, database, file storage, network security).
• Sign-in: Google and Apple, when you choose to sign in with them.
• Payments: Creem, our merchant of record.
• AI model providers for text, image and speech generation, as processors.
• People you share with: anyone who opens a share link you create can see that story.

We may also disclose information when required by law, to protect the rights and safety of children and other users, or as part of a merger, acquisition or sale of assets, in which case this Policy will continue to apply to your information.

6. Cookies and similar technologies

TapStory uses only strictly necessary cookies and browser storage: a session cookie that keeps you signed in, a cookie that remembers your interface language, and browser storage for small interface preferences. We do not use analytics, advertising or tracking cookies. Because these are essential to the Service, no cookie banner is shown. If we add optional cookies in the future we will update this Policy and ask for your consent where the law requires it.

7. How long we keep information

• Sign-in data: account identity and any OAuth credentials returned by your sign-in provider are stored in our Cloudflare-hosted database to authenticate and manage your account. They are not sent to our AI model providers or used for model training. They are retained with your account and deleted through the account-deletion process below. You can also revoke TapStory access in your Google Account third-party connections settings; revoking access does not itself delete your TapStory account or stories.
• Account and stories: for as long as your account exists. Removing a story from your bookshelf hides it immediately and disables its share link; the generated files are deleted together with your account.
• Photos and voice recordings of real people: until you delete the character, then deleted.
• Spoken story ideas: deleted as soon as they have been transcribed.
• Generation records (the prompts we sent, the model responses and diagnostics): kept with the story and deleted together with your account.
• After account deletion: we delete your account, stories and files within 30 days, except as noted below. Copies may persist in encrypted backups for up to 30 further days.
• Payment and billing records: kept for the period required by tax and accounting law (typically 7 to 10 years).
• Security and error logs: up to 90 days.

8. International transfers

TapStory runs on a global hosting network and our providers process information in countries other than yours, including the United States (hosting), Singapore (speech synthesis) and China (text, image and speech-recognition models), as described in section 4. Where required, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with contractual limits on what each provider may do with the data.

9. Your rights and choices

Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with your data protection authority. We apply these rights to all users, regardless of where they live.

Deleting your account. Send a message from the e-mail address on your account to support@tapstory.ai with the subject "Delete my account". We will verify the request, cancel any active plan, and delete your account, stories and files as described in section 7 within 30 days. You can also remove individual stories from your bookshelf, and delete personalised characters together with their photos and voice recordings, at any time.

Other requests. E-mail support@tapstory.ai. We reply within 30 days. Exercising your rights does not affect how we treat you as a customer.

10. Security

We protect information with encryption in transit, access controls that tie every stored file to the account that created it, and monitoring. No system is completely secure; if we become aware of a breach that affects you we will notify you and the relevant authorities as the law requires.

11. Changes to this Policy

We will post any changes here and update the effective date. For material changes we will also notify you by e-mail or in the Service before they take effect.

12. Contact

TapStory inc. · support@tapstory.ai. Please include the e-mail address on your TapStory account so we can find your information.