Last updated: 2026-06-22
Summary
This summary is for quick reference only and does not replace the full policy below; in case of any discrepancy, the full policy prevails.
- Bedtime Story is a bedtime co-reading tool for parents. Accounts, payments, and child profiles are all operated by the parent; children do not register, log in, or use the Service directly. - We collect only the minimum data necessary to provide the Service: the child's nickname (not a real full name); we do not collect photos, voice, or any biometric data. - We do not run behavioral advertising, do not track you for marketing or behavioral-analytics purposes, and do not sell or share your personal data for marketing purposes; we keep only the technical and error logs necessary to operate and secure the Service. - Stories and illustrations are generated by third-party AI models; under each provider's data-processing terms applicable to its service, the content we send is not used to train AI models. - You may view, edit, or delete child profiles and stories in the app at any time; you may also request deletion of your entire account. - The Service is currently offered to users in Taiwan and the United States; we do not actively offer it to other regions.
1. About This Policy and the Service
Bedtime Story (the "Service") is a bedtime co-reading tool for parents. Account registration, payment, and the creation of child profiles are all carried out by the parent. Children do not register accounts, do not log in, and do not interact directly with the Service; information about children is provided by the parent on their behalf. This Policy explains what data we collect, how we use and protect it, and the rights you may exercise.
The Service is provided by Vilymoo Studio (the "we" or "us"). For data protection matters, you may contact us via the "Contact Us" section at the end of this Policy.
The Service is currently offered to users in Taiwan and the United States. We do not actively offer the Service to residents of other countries or regions.
2. Who May Use the Service
You must have reached the age of majority under the laws of your jurisdiction and be the child's parent or legal guardian in order to register for and use the Service. An account must be created with the parent's valid email address. When you provide information about a child in the Service, you confirm that you are authorized to provide such information on that child's behalf and consent to our processing of it in accordance with this Policy. Children do not register or log in to the Service themselves.
3. Data We Collect
For each category below, we indicate whether it is required or optional:
- Account data (required): email address, login identifier, and your subscription status and trial-credit balance. - Child profile (required): the child's nickname (not a real full name) and age range, used to generate personalized stories. - Child profile (optional): gender, preferred story themes, companion settings, and the cartoon appearance features you select (skin tone, hairstyle, hair color, whether glasses are worn, signature color). We use these to produce a cartoon avatar reference image. Leaving them blank does not affect the basic service. - Story content: the story text and illustrations generated for you, and the story options you choose for each story (for example, the character to meet and the story's purpose, all selected from preset options). - Payment and subscription records: the subscription identifier, plan, billing period, and transaction event records returned by our payment provider, Paddle. We do not store your full credit card number; card information is handled by Paddle. - Preferences: your time zone and interface language, used to determine when each night's themes refresh and the display language. - Technically necessary data: the session cookie required to keep you logged in, and the verification used to prevent bot abuse at registration (Cloudflare Turnstile). Our infrastructure providers (such as the hosting platform) also process technical data such as IP addresses and access logs for operating and securing the Service.
4. Data We Do Not Collect
- We do not collect, request, or allow the upload of a child's real photo; avatars are always generated from the cartoon features you select. - We do not collect a child's voice or any biometric data. - We do not require a child's real full name.
5. How We Collect Data
- Directly from your input: the data you provide when creating an account, filling in a child profile, or choosing story options. - Generated automatically by the system: cookies that keep you logged in and remember your preferences, anti-bot verification, and the technical records needed to generate stories. - From the payment provider: when you subscribe, Paddle returns subscription and transaction event data.
6. How We Use Data
- To generate personalized bedtime stories and illustrations for you and your child. - To maintain your account, login status, trial credits, and subscription entitlements. - To process payments and prevent duplicate charges and abuse. - To provide the correct interface and nightly themes in the language and time zone you set. - To send necessary service-related emails (such as account verification, password reset, and payment and subscription notifications). - To comply with legal obligations (such as tax and accounting record-keeping).
We do not use your or your child's personal data for behavioral advertising, nor do we sell or share personal data with third parties for marketing purposes. Marketing emails are sent only with your consent, and you may unsubscribe or withdraw that consent at any time.
7. Children's Personal Data
The Service is a tool for parents and is not directed to or aimed at children, nor are children direct users of it: children do not register, do not log in, and do not interact directly with the Service, and information about children is provided by the parent and limited to what the Service requires to operate. By design we avoid collecting information that identifies a specific child, and we obtain the parent's consent through the parent's completion of a paid subscription transaction (see the points below). We apply the following protections to children's data:
- The Service is available for registration and use only by parents or legal guardians who have reached the age of majority; children do not create accounts and do not use the Service directly. We do not knowingly collect personal information provided directly by a child under 13; if we become aware that a child has provided information directly, rather than through a parent, we will delete it. - The Service is designed on the principle of not collecting information that identifies a specific child. With respect to a child, we obtain only a nickname (not a real full name), an age range, and the cartoon appearance options you select; the foregoing information, even in combination, is generally insufficient to identify a specific child. We do not collect a child's real full name, photograph, voice or other biometric data, contact details, precise location, or any persistent identifier that could be used to track the child over time. - Children's data is used only to generate personalized stories and illustrations for you; it is not used for advertising or shared for marketing. - During the free trial, the Service demonstrates with default characters; we do not request, nor allow you to enter, real child data. Only after you complete a paid subscription is the creation and editing of real child profiles enabled. - Through the credit card transaction when you complete a paid subscription, we confirm that you are an adult parent or legal guardian with the capacity to consent, on which basis you consent to the provision and processing of the child's data and to its transmission to the AI providers as needed to generate stories. - You (the parent) may view, edit, or delete child profiles in settings at any time; for deletion, see "Your Rights". - You (the parent) may at any time refuse to permit our further collection or use of your child's information and withdraw any consent you previously gave; you may do so by deleting the child profile in settings or requesting account deletion, or by contacting us via "Contact Us". After you withdraw consent, we will stop the further collection and processing based on it (except data we are required by law to retain).
8. AI-Generated Content and Data Processing
Stories and illustrations are generated by third-party AI models. When generating, we send the child settings needed to produce that content (including the appearance-feature description and the story options you chose) to the AI service provider for processing, limited to what is needed for generation. The AI service providers currently used are Google (Gemini) and OpenAI.
We use the AI models through the services our providers offer. Under each provider's data-processing terms applicable to those services, the providers do not use the content we send to train or improve their AI models; this depends on the providers' applicable terms as in effect from time to time, and if those terms change we will review and update this Policy accordingly. Providers may retain processing records for a short period for abuse detection and legal compliance, after which they are deleted.
The story options you choose, and any text you enter in free-text fields (such as names), are also sent to the AI provider for processing; please do not enter the child's real full name, or other identifying or sensitive personal information, in any free-text field.
These providers may process data outside your country (including in the United States); see the "Cross-Border Transfers" section. AI-generated content differs every time, and although we apply a post-generation safety check (stories must end in a calming manner), AI content cannot by its nature be guaranteed to be entirely accurate.
9. Data We Share with Third Parties
We share data only with the providers necessary to deliver the Service, and only to the extent needed for them to perform their services. These providers are our data processors and may not use the data for their own purposes:
- Supabase: hosting and storage of accounts, the database, and files (illustrations, avatars), and the sending of service emails such as account verification and password reset. - Google (Gemini) / OpenAI: AI generation processing of story text and illustrations. - Paddle: processing payments and subscriptions as the Merchant of Record. - Cloudflare (Turnstile): anti-bot verification at registration. - Vercel: the cloud hosting environment for the application; it processes technical data such as IP addresses and access/error logs for operating and securing the Service.
Other than the providers necessary to deliver the Service as described above, we do not sell or share personal data with other third parties, except with your consent or as required by law.
10. Links to Third-Party Websites or Services
The Service may contain or direct you to third-party websites or services (for example, Paddle's checkout page). These third parties have their own privacy policies, to which this Policy does not apply; we recommend that you read their policies before providing personal data.
11. Cross-Border Transfers
Our hosting and AI processing may be located outside your country or region (including in the United States). When data is transferred across borders, we take appropriate safeguards in accordance with applicable law.
12. Cookies and Tracking
We use the session cookie necessary to keep you logged in, and the preference cookie that remembers your language/time-zone preferences. We do not use behavioral analytics or marketing-tracking tools of the Google Analytics kind, and we do not serve behavioral advertising. To operate, secure, debug, and maintain the reliability of the Service, we retain the technical, diagnostic, and error logs necessary for those purposes (limited to route, identifiers, device/browser technical information, and error information, and not used for behavioral analytics or marketing tracking). The registration page uses Cloudflare Turnstile for human verification.
13. Data Retention
- Accounts, child profiles, and story content: retained while your account is active, in order to provide ongoing personalized service. - When you request deletion of your entire account, we will purge your account and related personal data within 45 days (except data we are required to retain by law, see below). - Payment and transaction records: retained for the current year plus 5 years, based on tax and accounting legal obligations.
14. Your Rights
You may exercise the following rights regarding your and your child's personal data:
- To inquire and request access. - To request a copy. - To request supplementation or correction. - To request that collection, processing, or use cease. - To request deletion.
You may edit or delete child profiles and stories directly in the app, or request deletion of your entire account in settings; to exercise other rights, please contact us via "Contact Us", and we will respond within the period prescribed by applicable law.
15. Consistent Standards for Personal Data
The following practices apply to all users:
- We do not sell personal data, nor do we share it for cross-context behavioral advertising. - We do not serve behavioral advertising; information about children is not used for any advertising purpose. - For children we collect only a nickname, not photos or voiceprints; information about children is provided and consented to by the parent. - We do not discriminate against users for exercising the rights set out in this Policy.
16. Data Security
We take reasonable technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, and the principle of least privilege for processors. If a data breach affecting your personal data occurs, we will notify affected users and the competent authorities within a reasonable period in accordance with applicable law. However, no transmission or storage over a network can be guaranteed to be absolutely secure.
17. Changes to This Policy
We may update this Policy due to changes in features or law. For material changes, we will update the "Last updated" date on this page and provide additional notice where necessary.
18. Governing Language
This Policy is provided in Traditional Chinese (zh-TW); other language versions are for reference only, and in case of any discrepancy, the Traditional Chinese version prevails.
19. Contact Us
If you have any questions about this Policy or your personal data, please contact: bedtimestory.service@vilymoo.com.