Privacy Policy

myownstory.ai ("we", "us") is a service where kids create their own illustrated books with the help of AI, under a parent's account. This policy explains what information we collect, how we use it, who we share it with, and the choices parents have. It is operated by CybrIT GmbH.

1. Who uses myownstory.ai

The service is designed for children ages 6–12, used together with a parent or guardian. Only adults can create an account. A parent creates the account and then adds profiles for their kids; kids use the app inside that parent's account. Some features (sharing, ordering printed books, billing, account settings) are locked behind a grown-up PIN.

2. Information we collect

From parents

• Account details: email address and password (stored only as a secure hash), or, if you sign in with Google, the name, email address and profile picture Google shares with us.
• Optional display name and a 4-digit grown-up PIN (stored only as a secure hash).
• Subscription details: your plan and its status. Payments are handled by Stripe; we never see or store your full card number.

About and from children (entered under the parent's account)

• Profile: a first name or nickname, a cartoon avatar, and an optional birth year (used to pitch stories at the right reading level).
• Story content: the ideas, choices and text a kid types or speaks while building a book, and the finished stories, characters, illustrations, covers, dedications and "about the author" pages.
• Voice recordings: if a kid records themselves reading their book aloud, we store those audio recordings.
• Memory book conversations: in memory mode, a kid talks with our AI interviewer ("Inky") about a real memory. We store the conversation transcript to turn it into a book.

We ask kids not to share personal details like their full name, address, school, or phone number in their stories, and our AI is instructed not to ask for them.

From people who order a printed book

When someone orders a printed copy (for example, a relative using a share link), we receive their name, email and shipping address so the book can be printed and delivered. Their first name and city may be shown to the kid's family as "Aunt Linda just ordered your book!".

Collected automatically

• Basic technical and usage records needed to run the service: log-in sessions, error logs, and a record of which AI operations were run for an account (so we can track costs and prevent abuse).
• Cookies: we use only the cookies needed to keep you logged in, plus a small setting stored in your browser (for example, that you dismissed the "install this app" prompt). We do not use advertising or third-party tracking cookies.

Speech-to-text in the browser

When a kid taps the microphone to speak instead of type, the app uses the speech recognition built into your browser. Depending on the browser, the audio may be processed by its maker (for example, Google for Chrome or Apple for Safari) under their privacy terms. We receive only the resulting text.

3. How we use information

• To create, store and display your kids' books.
• To check kids' text inputs for unsafe content before it's used in a story.
• In memory mode, if a conversation suggests a child may be unsafe, to flag it for the parent on their dashboard.
• To print and ship books that are ordered.
• To manage subscriptions, prevent abuse, and keep costs in check.
• To send account emails (like confirming your email address).

We do not sell personal information, show ads, build advertising profiles, or use kids' information for marketing.

4. Who we share information with

We share information only with service providers that help us run myownstory.ai, and only what each one needs:

• Anthropic (Claude) — writes stories, plans and memory-book text from the kid's inputs and conversations.
• Google (Gemini) — draws characters, comic panels and covers from text descriptions of the story.
• OpenAI — reads the finished story aloud (AI narration, Premium only).
• Supabase — our database and login system.
• Cloudflare — stores images, PDFs and audio files.
• Vercel — hosts the website.
• Stripe — processes payments for subscriptions and printed books.
• Lulu — prints and ships ordered books (receives the book PDF and the shipping address).

We use these providers' business services, under terms that limit how they may use the data we send. We may also disclose information if required by law, or to protect the safety of a child or others.

Share links

A parent can create a share link for a finished book (this requires the grown-up PIN). Anyone with the link can view the book and order a printed copy. Share links are not listed by search engines. Only share them with people you trust.

5. Children's privacy (COPPA)

We comply with the U.S. Children's Online Privacy Protection Act (COPPA), and with the GDPR's rules for children's data. A parent or guardian creates the account and adds their child's profile, which is how we obtain the parent's consent before collecting information from the child. We collect only the information reasonably necessary for a child to make their books.

As a parent, you can at any time:

• review the information we have about your child;
• ask us to delete it;
• refuse to let us collect more of it — in which case your child won't be able to keep making books.

To do any of these, email privacy@myownstory.ai from the email address on your account. We'll verify the request and respond within 30 days.

6. How long we keep information

We keep your account and your kids' books until you delete them or ask us to. When you ask us to delete your account or a child's information, we delete it from our systems within 30 days, except where we must keep limited records (for example, payment records) to meet legal obligations. Copies held by our service providers are deleted under their own retention schedules.

7. Security

We protect information with access controls that keep each family's data private to their account, encrypted connections, hashed passwords and PINs, and private file storage. No system is perfectly secure, but we work to protect your family's information and will notify you if a breach affects it, as required by law.

8. Where information is processed

myownstory.ai is operated by CybrIT GmbH in Liechtenstein (part of the European Economic Area). Several of our providers are based in the United States and process information there. Where information is transferred outside the EEA, we rely on the safeguards the GDPR provides for this, such as the European Commission's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

9. Your rights under the GDPR

CybrIT GmbH is the controller of the personal data described in this policy. We process it to provide the Service you signed up for (performance of a contract), to meet legal obligations (for example, keeping payment records), for our legitimate interests in keeping the Service safe and preventing abuse, and, for children's data, on the basis of the parent's consent given when they add their child's profile.

You have the right to access, correct, delete or export your personal data and your child's, to restrict or object to its processing, and to withdraw consent at any time (this doesn't affect processing that already happened). To use these rights, email privacy@myownstory.ai. You also have the right to complain to a data protection authority — in Liechtenstein, the Datenschutzstelle (www.datenschutzstelle.li) — or the authority where you live.

10. Changes to this policy

If we change this policy, we'll update the date at the top. If a change materially affects how we handle children's information, we'll notify parents by email and ask for consent where required.

11. Contact us

CybrIT GmbH
Garnis 4, 9495 Triesen, Liechtenstein
privacy@myownstory.ai