Privacy policy

Last updated 9 October 2026

Lori Tales is used by parents and guardians on behalf of their children. Children don't have accounts, and everything we know about a child is what their grown-up tells us. This policy explains what we collect, why, who helps us, and the choices you have.

What we collect

Your account: name, email, a password hash or Google sign-in ID, and when you confirmed you are 18 or older.
Child profiles you add: first name, age, optional gender, interests, life lessons, any notes you write, and settings such as reading aloud and daily screen-time limits.
Stories you create, and — on Premium — photos you upload and the avatars made from them (see how we handle your child's photo).
Payment and credit records: what you bought, when, and your credit balance. Card and bank details go straight to our payment providers; we never see them.
Progress for the child you pick under "Who's reading?": how long they spent on each story, game or lesson each day, what they finished, and their scores and stickers. This shows you their progress and gives them streaks and stickers; it's never used for ads. Delete a child's profile to delete their progress.
Name, address and phone number for printed book orders, only to deliver them.
Basic technical data, such as your IP address and when you signed in, to keep the service secure, stop abuse and work out which payment options apply in your country.

How we use it

To write, illustrate and read aloud the stories you ask for.
To run your account, credits, plan, gifts, invites and print orders.
To send emails about your account, such as sign-in, plan reminders and orders.
To keep the service safe, check content for children, and prevent fraud.

We don't sell your data or your children's data, and we don't profile children for ads.

Service providers

OpenAI — writes stories, draws pictures, records narration and checks content safety.
Google Gemini — draws a child's avatar only if OpenAI can't make one from the photo.
Paddle and Safepay — payments.
Cloudflare — private file storage.
Resend — sends our emails.
Google — sign-in with Google (if you choose it), and ads for families without a plan (see below).
Our hosting and database providers, which run the service for us.

Each provider gets only what its job needs. To write a story, our AI provider receives the child's first name and age, their interests and lessons, the story idea, and character pictures such as an avatar. We use our AI providers' paid business services, which don't use this data to train their models by default. Some providers are based outside your country, including in the United States.

Reading aloud ("I'll read")

This is off until you switch it on for a child. When the child taps the microphone, your browser listens and turns their voice into words using its own speech service (Google in Chrome and Edge, Apple in Safari) under that company's privacy terms. Lori Tales only sees whether the page was read; we never receive, record or store your child's voice. You can switch it off on the child's profile at any time.

Families without a plan see a few ads from Google, and a grown-up can choose to watch an ad to earn free credits. Families with a plan see no ads. Ads never appear while a story or poem is being read or listened to.

All ads are non-personalised: no interest-based ads, no remarketing and no profile of your family. Banner ads are always marked as being on a site for children. Google may still use cookies or similar storage to limit how often an ad is shown and to prevent fraud. We never share your name, email or children's details with Google. See how Google uses data from sites that use its services.

Cookies

We use one essential cookie to keep you signed in, and your browser remembers small preferences such as who's reading. Google's ads and sign-in, and Paddle's checkout, may set their own cookies when they are used. We don't use analytics or advertising trackers of our own.

Sharing a story

Stories are private unless you turn on a share link. Anyone with that link can read the story's title, words and pictures, but not your account or your child's profile. Turn the link off at any time and it stops working.

Storage and security

Passwords are stored as strong one-way hashes. Files are kept in private storage and shown only through short-lived links. Only you can see your children, and only you can see your stories unless you share one.

How long we keep it

Your account and stories are kept until you delete them or your account.
A child's original photo is deleted once you choose an avatar, or after 7 days, unless you choose to keep it.
When you delete your account, it is switched off straight away and erased for good after 7 days, in case it was a mistake. Paddle and Safepay keep their own payment records as the law requires.

Your choices and rights

Edit or delete child profiles, photos, avatars and stories at any time.
Download a copy of your data, including every story, from your account settings.
Delete your account from your settings.
Depending on where you live, you may have further rights, such as to object to how we use your data or to complain to your data protection authority. Write to us and we'll help.

Changes and contact

If we change this policy in a way that matters, we'll email you before it takes effect. Questions or requests about your family's data? Write to us at support@loritales.com.