NightStory Privacy Policy
Version 1 · Effective November 11, 2026 · The current version is always at https://starrybedtime.com/privacy.
NightStory is a bedtime-story app. A parent or guardian signs in, adds their children and chooses what to read or play. This page explains what information the app handles, why, where it is kept, for how long, and how you can see it, get a copy of it, or delete it.
Who we are
NightStory ("we", "us") decides how the information described here is used. Under EU and UK law, that makes us its "controller". For any privacy question or request, write to privacy@starrybedtime.com.
In short
- You sign in with Apple, Google or a code we email you. There is no password. We keep the email address you sign in with, to sign you in and to find the same family on your other devices. You can also add your first and last name, if you want to.
- Before you sign in, you confirm you are a parent or guardian, agree to our Terms of Use and confirm you have read this policy.
- For each child you add, we store:
- a first name or nickname;
- a birth month and year (never the day);
- an avatar picked from six coloured circles.
- We also store what each child has listened to or read, and how far they got.
- The stories are written before anyone opens the app. Nothing about you or your child is used to write them.
- No advertising, no third-party analytics, no tracking. We never sell or share your information.
- You can delete a child, or everything, at any time in the app. It is erased from our servers at once, and from our backups within 7 days. Accounts nobody has used for 12 months are deleted automatically, without a warning.
- Our servers are in the United States.
What we store on our servers
About your account
- Your email address: the one you sign in with. It is the address you type to get a code, or the one Apple or Google shares with us when you continue with them. If you use Apple's "Hide My Email", it is the address Apple creates for us, which forwards to yours. We store it in lower case. We use it to sign you in, and to keep one account per email address, so the same family appears on every device where you sign in with it.
- The ways you sign in. For each way you have used (Apple, Google or an emailed code): which one it is; the identifier Apple or Google gives us for your account with them (for an emailed code, your email address); the email address it last reported; and when it was first and last used.
- Apple's sign-in token, only if you sign in with Apple. We keep it for one reason: when your account is deleted, we use it to tell Apple to disconnect NightStory from your Apple ID.
- An account ID our server assigns, the date the account was created, and the last day the app signed in (updated at most once a day). We use that date to delete accounts nobody uses any more.
- Your first and last name, if you add them in Settings › Manage account (the first row in Settings, which shows your name or email). Both are optional, and you type them yourself: we never receive a name from Apple or Google. We use your name only:
- to show it back to you in the app;
- to address you in service emails about your account. Today the only email we send is the sign-in code, and the sign-in code email never contains your name. We will only send you marketing or customer-care messages if you opt in, and you will be able to turn them off in the app.
- Sign-in records. These are fingerprints of the short-lived tokens the app uses to stay signed in, with the dates they were issued and expire.
- Sign-in codes. When you ask for a code by email, we store a fingerprint of the code and a fingerprint of your email address (SHA-256 hashes), never the code or the address itself. We also store when the code was sent, when it expires (10 minutes later), how many wrong tries were made, and whether it was used. These records are deleted once they are more than 24 hours old (the clean-up runs whenever anyone asks for a code), and when you delete your account.
- Your agreement. Which version of our Terms of Use and of this policy you agreed to, when (as your device reported it, and as our server received it), and the version of the app you agreed in.
About each child you add
- A first name or nickname (up to 20 characters), so the app can greet them and you can tell profiles apart.
- Their birth month and year. The app needs them to work out the child's age, which grows by itself, and to suggest stories that fit that age. The "Heard" list also uses them to group stories by the age the child was when they heard them. We never ask for the day. When the app asks our server for stories, it sends the child's current age as a whole number (for example "5"). The server uses it to choose stories and does not store it.
- An avatar picked from six coloured circles. They depict nobody.
What each child has listened to or read
- For each story a child opens: whether they are in the middle of it, finished it, or removed it from their "Reading" list; how far they got; when this last changed; and when they first finished it. This powers "Continue", the "Heard" list, and putting stories the child hasn't heard yet first.
What stays on your device
Sign out and Delete account both erase everything in this section, downloads included. If your sign-in simply expires, the app keeps it all until you sign in again. If a different account then signs in on the same device, the app erases it all first.
- Your sign-in, in your device's keychain: the tokens that keep the app signed in, your account ID, your email address, which way this device signed in, and a copy of your first and last name if you added them, so Settings can show them without a connection. The keychain is not synced to iCloud. The app also notes which account the data on the device belongs to.
- Downloaded stories (their text, narration and pictures). They are the same for every family. They are left out of your iCloud and computer backups. Deleting a child keeps them.
- Reading progress the app could not send yet while you were offline, and the story each child was last in the middle of. The progress is sent when the connection returns. Both are also erased when you delete that child.
- Your last five searches. They are shown in Search, and you can clear them there.
- That you agreed to our Terms of Use and this policy, and to which versions. Continuing on the sign-in screen is your agreement. The next sign-in records it again.
- A copy of your children's profiles and your app settings, so the app works without a connection. The settings are text size, the sleep-timer default, picture-book auto-play and the last child you chose. Like other app data, these are part of your device's own iCloud or computer backup, which Apple or you hold, not us.
What we use only for a moment, and never store
- What you search for: sent to our server to find matching stories, then discarded.
- Which stories are downloaded on your device (story numbers only): checked against our library so the app knows whether they are still available.
- The sign-in token Apple or Google gives the app when you continue with them. Our server checks it against Apple's or Google's public keys, keeps the identifier and email address described above, and discards the token.
- Your device's IP address. Every internet connection reveals one. Our server keeps it in memory only, to stop a single address from sending too many requests, including too many requests for sign-in codes. It is not written to our database or our logs. Our hosting and delivery providers (below) handle it to deliver data to you.
Technical logs
Our server writes a small amount of operational logging: start-ups, errors, and the result of a deletion clean-up (which may include the account ID). It never logs your name or email address, a child's name, or a child's birth month and year, and we check for this. Our hosting provider keeps server logs for about 7 days, then deletes them.
What we do not collect or do
- We do not collect your phone number, a password, a full date of birth, gender or pronouns, photos, voice, location, or contacts.
- We do not show advertising. The app contains no third-party analytics, advertising or crash-reporting code, and does not track you across other companies' apps or websites.
- We do not sell or share your information, and we do not use it for advertising.
- The app has no in-app purchases, no chat or social features, and no way for users to contact each other. The screens a child sees contain no links to websites or other apps.
How the stories are made
Every story in NightStory is written, narrated and illustrated before anyone opens the app, and reviewed before it is published. It is the same for every family. We use AI services to make them: Anthropic (Claude) for the text, Google Cloud Text-to-Speech for the narration, and Google (Gemini) for the pictures. Nothing about you or your child is sent to these services.
Who processes information for us
These companies run parts of NightStory on our behalf, under contract, only on our instructions:
| Company | What it does | Information it handles |
|---|---|---|
| Fly.io (USA) | runs our server, in the United States (Virginia) | everything the app sends to our server, while it is processed |
| Neon (USA) | hosts our database, in the United States (Virginia) | everything in "What we store on our servers" |
| Cloudflare (USA) | stores and delivers the stories' audio and pictures, and hosts this website | no information about you; it sees your IP address when it delivers a file or a page |
| Resend (USA) | sends the emails that carry your sign-in codes, and keeps a record of each one for 30 days | your email address and the code in each email |
Apple and Google are the sign-in providers, not our processors. If you continue with Apple or Google, they sign you in under their own privacy policies, and they tell us an identifier for your account with them and your email address (with Apple's "Hide My Email", an address Apple creates instead). We never receive your password from them. If you sign in with Apple, our server also contacts Apple to complete the sign-in, and again to disconnect NightStory from your Apple ID when your account is deleted.
The App Store and your device's backups are run by Apple under Apple's own privacy policy.
Where your information is processed
Our servers and database are in the United States. If you use NightStory from the European Union, the European Economic Area or the United Kingdom, your information is therefore processed in the United States, where data-protection law differs from yours.
When our service providers handle it, the transfer is protected by the EU-U.S. Data Privacy Framework (and its UK Extension) where the provider is certified under it, and otherwise by the European Commission's Standard Contractual Clauses (with the UK Addendum) in that provider's data processing terms. You can ask us for a copy of these safeguards at privacy@starrybedtime.com.
Why we use it (for people in the EU and the UK)
- To provide the app you asked for: your account, your email address and the ways you sign in, your name if you add it, the children's profiles, their ages, and their reading progress. Without them the app cannot sign you in, pick stories for a child or remember where they were. (UK/EU GDPR Art. 6(1)(b).)
- To keep the service secure and working: the IP address held briefly in memory, the sign-in code records, the technical logs, and the last sign-in date that lets us delete unused accounts. (Our legitimate interest, Art. 6(1)(f).)
- To show that you agreed to our Terms: the agreement record. (Our legitimate interest in being able to show which terms apply, Art. 6(1)(f).)
How long we keep it
| Information | Kept until |
|---|---|
| Your account, including your name and email, the ways you sign in, Apple's token, your sign-in records and agreement record | you delete the account, or it is deleted for not being used (below) |
| Sign-in code records | the first clean-up after they are 24 hours old, or when you delete the account |
| A child's profile (name, birth month and year, avatar) | you delete the child, or the account is deleted |
| A child's reading history | you delete the child, or the account is deleted |
| An account nobody has used for 12 months, with everything in it | deleted automatically, within 30 days after those 12 months, without a warning |
| Copies in our database backups | at most 7 days after any deletion above |
| Technical logs | about 7 days (kept by our hosting provider) |
| Our email provider's record of each sign-in email it sends, including your email address | 30 days (kept by Resend; deleting your account does not shorten it) |
| Emails you send us about your privacy | as long as we need to answer you and keep a record that we did |
If you delete the app without deleting your account, your information stays on our server. Sign in again the way you signed in before to find it, or to delete it. An account nobody has signed in to or used for 12 months is deleted automatically, and we don't send a warning first. To delete it at once, use Settings › Manage account › Delete account before you delete the app.
Your choices and rights
- See and correct. Everything we store about a child is shown in the app (Settings › Children), and you can change the name, birth month and year, and avatar there at any time. Your name and the email you sign in with are shown in Settings › Manage account, where you can change or remove your name.
- Delete one child. In Settings › Children, delete the child. Their profile and reading history are erased from our server at once (and from our backups within 7 days), along with the progress waiting to be sent from your device.
- Delete everything. In Settings, tap your name or email at the top (Manage account), then Delete account. The app asks "Delete everything?" and explains: "Your account, including your name and email, your children's profiles, their reading history and all downloads are deleted from this device and from our server. This can't be undone." On our server they are erased at once, with the ways you sign in, your agreement record and all sign-in records, and from our backups within 7 days. If you signed in with Apple, we also ask Apple to disconnect NightStory from your Apple ID. The app erases everything else it stored on your device and returns to the sign-in screen.
- Sign out. Settings › Sign out (the last row in Settings) ends the sign-in on the device you are using and erases everything the app stored on it, as Delete account does. Your account stays on our server, and signing in again brings it back.
- Get a copy of your information. Email privacy@starrybedtime.com from the email address you sign in with (it is shown in Settings › Manage account). We only accept a request from that address, and we only send the copy to that address. If you write from any other address, we will ask you to write from the one you sign in with. If you use Apple's "Hide My Email", tell us the address shown in Settings › Manage account: we will write to it (Apple forwards the email to you), and you confirm by replying. We send the copy within one month: a file containing everything we hold about your account, including your name if you added it.
- Other requests. If you are in the EU or the UK, you can also ask us to restrict or stop using your information, or object to how we use it. Write to privacy@starrybedtime.com. You can also complain to your national data protection authority.
Children
NightStory is set up and controlled by a parent or guardian. Before signing in, the adult confirms they are a parent or guardian and agrees to our Terms of Use, which require them to be 18 or over. Children do not create accounts, and the app asks them for nothing. The information about a child (their first name or nickname, birth month and year, avatar, and what they have heard) is entered by the parent. It is the minimum the app needs to greet the child and suggest stories for their age. It is never used for advertising, never sold, and never shared with anyone except the service providers listed above, who handle it for us. A parent can review, change or delete it at any time, as described in "Your choices and rights".
Security
The app talks to our server only over encrypted connections (HTTPS). Your sign-in is kept in your device's keychain and is sent only over an encrypted connection. There are no passwords. Our server keeps only fingerprints of the tokens that keep the app signed in and of the sign-in codes, never the tokens or codes themselves. Downloaded stories are stored with iOS file protection. Access to our servers and database is limited to the people who run NightStory.
Changes to this policy
When we change this policy in a way that matters to you (what we collect, why, who receives it, or your rights), we publish the new version here with a new version number and date, before the app version that makes the change reaches you. That app version asks you to read the new policy and agree again before you continue, and lets you delete your account instead. Smaller edits that change no meaning (typos, layout) are published without asking again.