This document has not had legal review. It was written alongside the code it describes and checked against the tests that verify it, which makes it accurate about what the software does — not a substitute for a lawyer reading it. It is published in that state deliberately.
Tuck & Tales — Data Policy
Effective date: 2026-08-17 (draft — see “Status” below).
This is the longer, more detailed version of the privacy one-pager.
It exists for the legal requirement to have a complete data policy, not to
say anything different from the one-pager — every claim below traces to the
same code and the same tests documented in
claim-map.md, and nothing here contradicts the one-pager.
If you find a place where it seems to, that is a bug in this document, not a
second, looser standard of truth.
Status
This is engineering-grade honest writing, produced alongside the code it
describes and checked against the tests that verify it
(tests/privacy/, services/api/tests/test_deletion_end_to_end.py,
services/api/tests/test_inventory_coverage.py,
services/api/tests/test_voice_expiry.py). It has not received legal
review. A lawyer reviewing this document before it is published anywhere
public is required, not optional — this document is not a substitute for
that review, only a true starting point for it.
1. Who this applies to
Parents (or legal guardians) who create an account, and the child profiles they add under that account. A child never has their own account, login, or credentials — see §6.
2. What we collect and why
| What | When | Why |
|---|---|---|
| Account email | Sign-up / sign-in | Passwordless magic-link authentication (no password is ever stored) and account recovery. |
| Data region selection | Account creation | Determines which storage region (us or eu today) your data is stored in — see §5. |
| Parent voice recording | Enrollment screen, live capture only | The source material for your synthetic voice. Encrypted in your browser before it ever leaves your device — see §4. |
| Spoken consent line | Captured inside the same enrollment recording | Verified by an on-device speech-recognition check before any voice is derived; the transcript is retained as evidence — see §3. |
| Short greeting recording | Bookend screen, live capture only | An unprocessed recording of your own voice, played back to your child as a bookend to a generated story. |
| Child’s first name and a small profile | Child profile creation | Used to personalize story text (slot-filling) and to address your child by name. No login credential, no additional PII, is ever attached to a child profile. |
| Story selections, render requests | Normal use of the product | Operating the core product feature — turning a story and a voice into an audio file. |
We do not, and structurally cannot, collect your child’s voice. No screen, feature, or server endpoint in this product accepts child audio — see §6.
3. Consent
The enrollment recording begins with you speaking a consent line, in your own words, naming the permission you are granting. Before any voice profile is derived from your recording, an on-device speech-recognition check (never a hosted third-party transcription service — sending your recording off-device for this check would make our core privacy claim false) confirms the consent line was actually spoken, fuzzy-matched to tolerate a natural reading (a dropped word, a stumble, a paraphrase) rather than requiring a word-perfect recitation.
The matched transcript is written to storage before your original recording ciphertext is deleted, specifically so that if you later delete a voice profile yourself, evidence that consent was given survives even though the recording does not. This transcript-survives-deletion guarantee applies to voice profiles you delete yourself. It does not apply to the automatic 12-month inactivity expiry described in §7 below, where the transcript is removed at the same time as the voice profile itself — the same reasoning that makes the recording no longer needed applies to its evidence record once the voice profile is gone entirely. This is a genuine, known asymmetry between the two deletion paths, not an oversight papered over here.
4. Encryption
Your enrollment recording is encrypted in your browser, before it ever leaves your device, using an ephemeral key exchange (ECDH P-256) against a public key belonging to our rendering hardware, followed by AES-256-GCM encryption. The private half of that key exists only on our rendering hardware — never in our application servers, never in our cloud storage account, never in a shared password manager. This means our servers and our cloud storage provider hold only ciphertext they cannot open, including during the period your recording may be waiting for our rendering hardware to come online.
The derived voice profile (a compact set of model parameters, not the recording itself) is retained and deleted on the same schedule as your original recording, and benefits from our cloud storage provider’s own automatic storage-level encryption. It does not yet receive the same browser-side encryption layer your original recording does. Independent testing found that this derived profile can currently be used, together with the underlying voice model’s own publicly available components, to reconstruct audio closely resembling your original recording — which is exactly why we protect it under the same policy as raw audio rather than as a lower-sensitivity artifact, even though its stronger encryption is not yet built. This is real, ongoing engineering work, stated here rather than implied to already be finished.
Rendered story audio and story bundles receive our cloud storage provider’s automatic storage-level encryption; they were never designed to carry the same reconstruction risk as the voice profile above, since they are the intended output of the product, not source material.
5. Storage location and jurisdiction
You select a data region when you create your account (currently us or
eu). Every storage operation is routed through a lookup that has no
default or fallback bucket — an unrecognized region fails loudly rather than
silently writing to the wrong jurisdiction. Your cloud storage provider’s
own jurisdictional bucket restrictions provide the actual enforcement at the
storage layer, in addition to this application-level check.
One point of honest nuance: our cloud storage provider is a United States
company. Choosing the eu region places your data in a bucket physically
and contractually restricted to the EU, but it does not remove the
possibility that the provider, as a US entity, could be compelled by a US
legal request (the CLOUD Act) regardless of where the bucket is located. If
this distinction matters for your situation, contact us — an EU-operated
storage provider is a real option we can evaluate, and nothing about our
storage interface design would make that a rewrite if it becomes necessary.
6. Children’s privacy
This product is intentionally designed so that a child’s voice never reaches our servers. There is no login, account, or credential associated with a child profile — only a first name and a small set of profile fields used to personalize story text. We treat voiceprints (including a parent’s) as personal information under the amended COPPA rule, which is precisely why no server-side path exists for a child’s voice specifically: the product’s only voice-capture surfaces are the parent-facing enrollment and bookend screens, both requiring an authenticated parent account.
7. Retention and deletion
| Artifact | Retained until | Deleted by |
|---|---|---|
| Encrypted enrollment recording | Minutes to hours — deleted once your voice profile is derived, with a storage-provider lifecycle rule (default 2 days) as a backstop regardless | Automatic, on successful derivation, or the lifecycle backstop |
| Voice profile (derived, not the recording) | 12 months from last use, refreshed each time it’s used | You, on request, or automatic 12-month inactivity expiry |
| Consent transcript | Same as the voice profile it belongs to, except: survives an on-request voice-profile deletion; does not survive automatic 12-month expiry (§3) | Same triggers as above |
| Rendered story audio and bundle | Until you delete it, or the associated child profile, or your account | You, on request |
| Deletion record (evidence a deletion happened) | Permanent — this record is never itself deleted | Never |
Deletion is a tracked job, not a flag. Requesting deletion of a voice profile, a child profile, a rendered story, or your whole account creates a job with a real, verifiable completion state — Postgres rows, cloud storage objects, our rendering hardware’s local cache, and a status-cache entry are each independently confirmed removed, not merely marked. If our rendering hardware happens to be offline when you request deletion of a voice profile or your account, the parts of that deletion that depend on it complete as soon as it is next reachable — you are told plainly that deletion is in progress, not shown a false “done.” Closing your account triggers a full purge of everything above within 30 days.
8. Watermarking
Every voice our product generates carries an inaudible digital watermark embedded by the underlying voice model at generation time. Nothing in our own audio pipeline is watermark-aware or capable of removing it, even unintentionally — independent testing confirmed the watermark survives our full production pipeline (fades, loudness normalization, true-peak limiting, and MP3 encoding at the bitrate we ship) with only a marginal, expected confidence decline, well above the threshold that would indicate loss of signal. This claim covers accidental or pipeline-related degradation for the encoding settings we currently ship; it does not cover deliberate, adversarial attempts to strip the watermark, which have not been tested.
9. Third parties
We do not include third-party analytics or advertising code on the screen where your child listens to a story. Any product-usage data we collect is collected directly by us. We do not sell personal information.
10. Your rights
You may, at any time:
- Delete a voice profile — retains only the consent transcript as evidence (§3), per §7’s table.
- Delete a child profile — removes that child’s rendered stories and profile data.
- Delete a rendered story.
- Close your account entirely — triggers a full purge within 30 days.
11. Contact
[Placeholder — a real contact channel for privacy questions and deletion requests goes here before this document is published anywhere public. Not filled in by this task: T037 is engineering-grade honest writing, not the operational/legal step of standing up that channel.]