1. Introduction
Fablespin ("Fablespin", "we", "us", "our") is an iOS app that creates personalised AI bedtime stories for children. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the choices and rights you have.
Fablespin is operated by Fablespin Ltd, based in England and Wales. If you have any questions about this policy, contact us at privacy@fablespin.app.
Fablespin is designed to be set up and managed by a parent or legal guardian. Children do not create accounts, enter contact details, or interact with anyone else through the app. Throughout this policy, "you" means the parent or guardian using the app, and "your child" means a child for whom you create a profile.
2. Our approach to children's privacy
Fablespin is built around a small number of firm commitments:
- We collect the minimum information needed to generate a personalised story, and nothing more.
- We do not show advertising, and we do not use any third-party advertising or analytics services.
- We do not sell, rent, or trade personal information, and we never share it for advertising or marketing purposes.
- We do not collect contact information, photos, precise location, or audio recordings from your child.
- A child's information is only ever provided by you, the parent, and only used to create stories for that child.
These commitments are designed to meet the requirements of the U.S. Children's Online Privacy Protection Act (COPPA) and the "children's data" provisions of the EU and UK General Data Protection Regulation (GDPR, sometimes referred to as GDPR-K).
3. Information we collect
3.1 Information you provide: your parent account
When you sign in, Fablespin uses Sign in with Apple. We receive a stable account identifier provided by Apple (the "Apple User ID"), which is not your Apple ID email or password. Optionally, and only the first time you sign in, you can also share your name and email address. You may use Apple's "Hide My Email" feature instead.
When you sign in, we also store an authorization token issued by Apple, used solely so that we can revoke your Sign in with Apple connection on Apple's servers when you delete your account. This token is linked only to your account identifier, is never used for any other purpose, and is deleted when you delete your account.
3.2 Information you provide: child profiles
To generate a story tailored to your child, you create one or more child profiles. For each profile you may provide your child's first name (a first name only, we ask you not to enter a surname), age, interests and things to avoid (for example, "dinosaurs" or "loud noises"), a reading level, and an optional avatar emoji. You provide this information; your child does not. You can edit or delete it at any time (see Section 10).
3.3 Information used to generate each story
When you create a story, the relevant profile details above, together with the story settings you choose (theme, setting, hero name, length, mood, and any lesson), are sent to our story service to generate the text, and (depending on your subscription) narration audio and illustrations. How this works, and which third parties are involved, is described in Section 5.
3.4 Information collected automatically
Fablespin collects very little automatically. If the app crashes or hits an error, we collect technical diagnostic data (device model, operating system version, and a technical stack trace) through a third-party crash-reporting service, which we have configured to not collect personal identifiers and not to capture the contents of network requests or story data. We also count certain events (such as the number of stories generated) in an aggregate form that is not linked to your child. For subscription tiers with a monthly narration limit, we keep a running count linked only to a one-way cryptographic hash of your Apple User ID, so we can enforce the limit; this hash cannot be reversed to identify you.
3.5 Information we do NOT collect
We do not collect, and the app does not ask for: your child's surname or full name, your child's email address, phone number, or any other contact details for your child; photographs or videos; precise or background location; contacts; microphone recordings; biometric data; or any persistent advertising identifier. Fablespin contains no advertising and no social, chat, or messaging features.
4. How we use information
We use the information described above only to: provide the core service (generate personalised stories, narration, and illustrations); personalise stories to your child's name, age, interests, and reading level; sync your library of saved stories across your own Apple devices (see Section 6); manage subscriptions and entitlements, including enforcing usage limits where they apply; keep the app reliable and safe, by diagnosing crashes and errors; and comply with our legal obligations. We do not use any information to build advertising profiles, to train our own models, or for any purpose unrelated to providing the service.
5. How story generation works, and the providers involved
Fablespin generates stories with the help of trusted service providers ("subprocessors"). It is important to be precise here: to generate a story, some of your child's profile details (first name, age, interests, things to avoid, and reading level) are transmitted off the device. Here is exactly what happens:
- Our story service (the "proxy"). Your story request is sent over an encrypted (HTTPS) connection to a server we operate, hosted by a third-party cloud provider. This server validates the request and forwards it to the AI providers below. Our server processes your request to fulfil it and does not store your child's profile information after the story is generated.
- An AI provider generates the story text. The profile and story settings are sent to that provider's API solely to produce the story.
- An AI provider generates narration audio (text-to-speech) and, on the Family and Premium tiers, illustrations. The story text and prompts are sent to that provider's API solely to produce that audio and those images.
These providers process the information only to perform the requested task on our behalf. They act as our service providers / processors; they are contractually restricted in how they may use the data, and we do not permit them to use it for advertising or to build profiles of your child. Generated stories, audio, and images are then stored on your device and in your iCloud account (Section 6).
6. Data storage and iCloud sync
Your child profiles and saved stories (including any narration audio and illustration files) are stored on your device and synced through Apple's iCloud / CloudKit to your other Apple devices that are signed in to the same Apple ID. This data lives in your own iCloud account and is governed by Apple's privacy policy and your iCloud settings. We do not have a copy of your story library on our servers.
7. Legal bases and parental consent
7.1 COPPA (United States)
Fablespin is intended to be used by parents and guardians. We collect a child's first name, age, and interests from the parent, who provides this information knowingly when setting up a profile. Setting up Fablespin requires signing in with an adult's Apple ID and actively creating a profile, which serves as the parent's consent to the limited collection and use described in this policy. A parent can review, change, or delete their child's information at any time, and can stop any further collection by deleting the profile or the account (Section 10).
7.2 GDPR / UK GDPR (Europe and the United Kingdom)
Where GDPR or UK GDPR applies, our legal basis for processing is the performance of a contract with you (providing the app you have asked for) and, for crash diagnostics, our legitimate interest in keeping the app reliable. Because the service is for children, the parent or guardian provides and authorises all processing of the child's data. The age below which parental authorisation is required varies by country (between 13 and 16); Fablespin treats every child profile as requiring parental authorisation regardless of age.
8. Data sharing
We do not sell personal information, and we do not share it for advertising, marketing, or any cross-context behavioural purpose. We share information only with a small number of vetted third-party service providers needed to run the app, and only so they can perform their function for us. By category, these are a cloud hosting provider (runs our story service), AI providers (generate the story text, narration, and illustrations), a crash-reporting provider (technical diagnostics only), and Apple (Sign in with Apple and iCloud/CloudKit sync). Each acts as our processor, is contractually restricted in how it may use the data, and is not permitted to use it for advertising or to build a profile of your child.
Our current sub-processors, which we may update from time to time, are:
| Provider | Purpose | What it receives |
|---|---|---|
| Apple (Sign in with Apple, iCloud/CloudKit) | Sign-in and cross-device sync | Account identifier; your synced library lives in your own iCloud |
| Vercel | Hosts our story service | Story requests, transiently, while a story is generated |
| Anthropic | Generates story text | Child profile details and story settings, transiently |
| OpenAI | Generates narration audio and illustrations | Story text and image prompts, transiently |
| Sentry | Crash and error reporting | Technical diagnostics only, configured to exclude personal data |
We may also disclose information if required by law, or to protect the rights, safety, or property of our users or others.
9. Data retention
We keep information only as long as needed for the purposes above. Child profiles and saved stories remain until you delete them or delete your account. Our story service does not retain your child's profile information after a story is generated. Crash diagnostics are retained for a limited period by our crash-reporting provider and then deleted. Aggregate counts contain no personal identifiers. When you delete your account, associated data is deleted as described in Section 10.
10. Your rights and choices
You can, at any time: review and edit any child profile or saved story directly in the app; delete an individual child profile, which removes that child's information and stories; delete your entire account and all associated data from within the app, under Settings → Account → Delete Account, which permanently removes your profiles and stories; refuse further collection by deleting a profile or your account, or by not creating a story; and contact us at privacy@fablespin.app to ask about, access, correct, or delete information, or to exercise any right you have under COPPA, GDPR, UK GDPR, or other applicable law. We will respond within the time required by law.
Depending on where you live, you may also have rights to data portability, to object to or restrict processing, and to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).
11. Security
All communication between the app and our services uses encrypted HTTPS connections. Requests to our story service are validated using Apple's App Attest technology to confirm they come from a genuine, unmodified copy of the Fablespin app. API keys and secrets are stored securely and are never included in the app itself. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the limited and sensitive nature of the data involved.
12. International data transfers
Our service providers may process data in countries outside your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.
13. Changes to this policy
We may update this policy from time to time. If we make a material change, we will update the "Last updated" date and, where appropriate, notify you in the app. Your continued use of Fablespin after a change means you accept the updated policy.
14. Contact us
If you have any questions, concerns, or requests regarding this policy or your child's information, contact Fablespin Ltd at privacy@fablespin.app · support@fablespin.app.