StoryTimeZZZ Privacy Policy
Effective 23 September 2026
1. Summary
- StoryTimeZZZ is for parents and carers. The account holder is an adult. Children do not sign in and have no account of their own; a grown-up adds a child's details, and can change or delete them at any time.
- We collect what is needed to write, illustrate, narrate and keep your child's stories — and nothing else. There are no third-party analytics, no advertising profiles and no tracking of what your family reads.
- Names are kept away from the writing and picture services. The wording and the artwork are produced from a brief in which every name is replaced by a placeholder. The one exception is the optional storyteller voice, which has to read the finished page aloud — so it receives the text with the names in it. See section 6.
- Adverts (free version only) come from Google AdMob and are marked child-directed. They are non-personalised, they appear only on the grown-up's screens — a banner on the shelf, and occasionally a full-screen advert at a natural break once a book is finished — never inside a story, and they are gone entirely with StoryTimeZZZ Pro.
- Purchases go through Google Play. We never see your card or bank details.
- You can delete everything yourself, from inside the app — one child, one story, or the whole account. See section 10.
2. Who we are
StoryTimeZZZ is published and operated by Perlicom Systems Limited, a company registered in Ireland under company number 546999 ("we", "us"). We are the data controller for the personal data described here. Contact: support@perlicom.com.
Google acts as an independent controller for the data its advertising and Google Play services collect, under Google's own privacy policy (policies.google.com/privacy). The AI providers in section 6 act as our processors.
3. Your account
Signing in is done with Google Sign-In only — there is no password to choose, and we never see or store one. From the Google account you use we receive and store your name, e-mail address, the link to your Google profile picture and Google's stable account identifier. Google tells us whether the e-mail address is verified; an unverified one is refused.
Staying signed in uses a random session token. Only a one-way hash of that token is stored, alongside the device type you signed in from and the dates it was created and last used. Sessions expire after 180 days, and signing out deletes ours immediately.
4. Your children's profiles
A child card is created by you, in the app, and holds only what a story needs:
- A first name or nickname — whatever you want the story to call them. Never a full name.
- An age, which selects the reading level and the safety rules the story is written under.
- How the story should refer to them (pronouns), and optional notes for yourself.
- Anything to reflect in their stories (optional) — a short list you pick from, such as using a wheelchair, hearing aids or glasses. This is health information, and it is sensitive. It is entirely optional, you choose it yourself, and it is used only so the child is drawn and described as themselves. See the lawful basis in section 8.
- How they look (optional): skin tone, heritage, hair, eyes, glasses, freckles and similar. Heritage is also sensitive information. It is optional, it is never put into the words of a story, and it exists only so the pictures look like your child.
- Family cards (optional): who somebody is to the child, what the child calls them, and how they look, so a grandparent or a best friend can appear in a story.
We do not ask for, and the app has no way to send us, a child's surname, address, school, date of birth, phone number or photograph. There is no photo upload anywhere in StoryTimeZZZ.
5. The stories themselves
- What you ask for. The choices you make in the story wizard, and any idea you type, are sent to our server, which writes the story. The app never writes a story itself.
- What is kept. The finished words, the illustrations, the page layout and any storyteller recording you paid for are stored on our servers so the book is on your shelf the next night and on your next phone. Your shelf holds up to 300 books.
- How long. Until you delete the book, or your account. There is no automatic expiry, and we do not read your family's books.
- Re-usable templates. To make later books faster and cheaper, we keep the words and artwork in a name-stripped form — every character is a placeholder such as
HERO, with no names and no personal details. These templates belong to no family and are shared across the service. Because they contain nothing identifying, they are not deleted with your account; if artwork was painted from how your child looks and you want it removed, e-mail support@perlicom.com and we will delete it. - Interactive pages. "Search & Find" and "Tap & Hear" pages are worked out from the picture alone. The sounds are bundled inside the app; nothing your child taps is reported to us.
6. The AI services we use
Each provider is given only what it needs for its one job, and is contractually a processor acting on our instructions. None of them is allowed to use your family's data for its own purposes, for advertising, or to train models on it under the terms we use.
| Job | Provider | What it receives |
|---|---|---|
| Writing the story | Google (Gemini), with DeepSeek as a fall-back | The story brief — world, theme, lesson, reading level, any aid to show, and your typed idea — with every name replaced by a placeholder |
| Painting the pictures | OpenAI, Replicate and fal.ai (running the Nano Banana image models) | A description of each scene and of how each character looks, including skin tone and heritage if you added them, and any aid such as a wheelchair or glasses. No names. |
| Checking a picture and finding the tap targets | Google (Gemini), then fal.ai, then OpenAI | The painted picture only — never the words of the story, and never a name |
| Storyteller voices (optional, paid per book) | fal.ai (running ElevenLabs and MiniMax), with OpenAI, Google and Microsoft as fall-backs | The finished text of each page, which contains the names in the story — it cannot be read aloud otherwise. This is the only point at which a child's first name leaves our servers. The recording comes back to us and is stored with the book. Choosing the phone's own built-in voice instead sends nothing anywhere: it is read on the device. |
Some of these providers process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses, and by the EU–U.S. Data Privacy Framework where the provider is certified under it.
7. Adverts, purchases, updates and error reports
7.1 Google AdMob (free version only)
The free version shows adverts in two places, both of them on the screens a grown-up uses: a small banner at the bottom of the shelf, and occasionally a full-screen advert at a natural break — after a book has been finished and saved, when you return to the shelf. There is never an advert inside a story, on a reading page, between the pages of a book, or while a story is being read aloud, and no advert is shown before you have used the app. The full-screen advert is rate-limited so it cannot become a recurring interruption, and it is not shown while a child is reading.
Because StoryTimeZZZ's content is for children, every advert request is marked child-directed and as coming from a user below the age of consent. Google therefore serves non-personalised, family-safe adverts from its families-policy inventory: no advertising profile is built from this app, and your or your child's details are never used to target anything. To deliver, cap and measure those adverts and to prevent ad fraud, Google's Mobile Ads SDK still receives your IP address (from which an approximate, city-level location is derived), basic device and app information (model, Android version, app version, language), whether an advert was shown, seen or tapped, and diagnostics from the SDK itself. Where Google shows a consent message in your region, your choice is recorded on the device.
You can reset or delete your advertising ID, or opt out of personalised advertising generally, in Android Settings (on most phones: Settings > Security & privacy > Privacy > Ads, or Settings > Google > Ads), and manage Google ad settings at myadcenter.google.com. More detail is in Google's How Google uses information from sites or apps that use our services. StoryTimeZZZ Pro removes all advertising — both the banner and the full-screen advert — after which no advert is requested for your device at all.
7.2 Google Play purchases
Token packs and the StoryTimeZZZ Pro subscription are bought and paid for entirely through Google Play. We never receive your card, bank or billing details. When a purchase completes, the app sends the receipt to our server, which checks it with Google's Play Developer API and then stores: the product bought, the tokens or subscription time it granted, when it was granted, and a one-way hash of the purchase token (so the same receipt cannot be used twice). Your token balance and the history of what tokens were spent on — a book, a narration — are kept with your account.
Refunds are handled by Google Play under Google Play's refund policy; you can also write to support@perlicom.com and we will help.
7.3 Update check
The app asks our update server whether a newer version exists. The request carries no account, no identifier and nothing about your family; like any web request, the server sees the IP address and a standard user-agent, which appear only in short-lived logs kept for security and troubleshooting. (Installed from Google Play, updates come from Play itself.)
7.4 Error reports
When something in the app goes wrong, it sends us a report so it can be fixed: the app version and build, the device model and Android version, the screen it happened on, the error message and the developer stack trace, and a hashed install identifier. If you are signed in, your account is attached so we can tell one person's repeated problem from a widespread one. A report never contains a child's name, a story, a picture or any text you typed — the app blanks name- and title-shaped values and quoted text before sending, and our server scrubs them again. Reports are queued on the device when there is no signal, so one can arrive later than the problem it describes.
7.5 Usage counts stay on the phone
Settings contains an opt-in counter of which features get used. It is off by default, and when it is on the counts are kept only on your device and are never sent to us or to anyone else — the app has no transport wired for them and our service has no endpoint to receive them. Switching the option off erases them.
8. What we hold, why, and our lawful bases
| Processing | Who | Lawful basis (GDPR Art. 6, and Art. 9 where sensitive) |
|---|---|---|
| Your account (name, e-mail, profile picture link), sessions | Us; Google for sign-in | Performance of a contract (Art. 6(1)(b)) |
| Child and family cards, story choices, the stories, pictures and recordings | Us, and the processors in section 6 | Performance of a contract (Art. 6(1)(b)) |
| A child's listed needs (health data) and heritage | Us, and the picture providers in section 6 | Your explicit consent (Art. 6(1)(a) with Art. 9(2)(a)), given by choosing to add them. Clearing the field withdraws it; everything else keeps working |
| Non-personalised, child-directed adverts, ad measurement and fraud prevention | Google AdMob | Legitimate interests (Art. 6(1)(f)) in funding the free version and keeping it secure; where local ePrivacy rules require consent for storing or reading anything on the device, that consent is asked for first |
| Purchases, token balances and receipt records | Google Play; a limited record to us | Performance of a contract (Art. 6(1)(b)) and legal obligations for tax and accounting (Art. 6(1)(c)) |
| Error reports | Us | Legitimate interests (Art. 6(1)(f)) in a working, non-crashing app |
| E-mails you send us | Us | Legitimate interests (Art. 6(1)(f)) in answering you |
Where it is stored. Accounts, child and family cards, stories, pictures, recordings and token records are held on our own servers in the European Union. The providers in section 6 process data as described there.
Retention. Everything above is kept while your account exists and is erased when you delete it (section 10). Purchase records are kept as long as Irish tax law requires (currently six years), with your account identifier removed. Error reports are kept while the fault is being fixed. Name-stripped story templates, which identify nobody, are kept for re-use.
Security. Every connection the app makes is encrypted (HTTPS/TLS). Session tokens, purchase tokens and install identifiers are stored only as one-way hashes.
We do not sell your personal data, we do not build advertising or behavioural profiles, and we do not use your child's details for anything except making and keeping their stories.
9. Children
StoryTimeZZZ is designed to be used by a parent or carer with a child. The account holder must be an adult: only they can sign in, add a child, buy anything or change a setting. A child never has an account, never signs in and cannot make a purchase.
- A child's details are provided by the adult account holder, who can see, change or delete them at any time.
- They are used only to write, illustrate, narrate and store that child's stories — never for advertising, profiling or any other purpose.
- Every advert request is marked child-directed and under the age of consent, so adverts are non-personalised.
- There is no chat, no messaging, no user-to-user content, no social feature and no way for anybody outside your account to see a child's profile or their books.
If you believe a child's information was added to StoryTimeZZZ without the consent of their parent or guardian, write to support@perlicom.com and we will remove it.
10. Deleting your data
You can delete any of this yourself, in the app, without asking us:
- One story — open the shelf, and delete the book.
- One child or family card — Children > the card > delete.
- Your whole account — Settings > Delete my account. After you confirm, we immediately and permanently erase your account record, every child and family card, every story, every picture and every storyteller recording made for you, your token wallet and its history, and all of your sessions. It cannot be undone, and unused tokens are not refundable.
Two things deliberately survive an account deletion, and neither identifies you:
- Purchase records, with your account identifier removed. Tax law requires us to keep the record of a sale, and keeping the receipt's hash is what stops the same receipt being replayed to mint free tokens.
- Name-stripped story templates, as described in section 5. They contain no names and no personal details. If you want artwork painted from your child's appearance removed as well, e-mail support@perlicom.com.
The same steps, in the short form Google Play links to, are on the account deletion page.
You can also request deletion by e-mailing support@perlicom.com from the address your account uses, with the subject "Delete my account". We act within 30 days and confirm when it is done.
11. Your rights (GDPR)
If you are in the EU, EEA or UK you have the right to access your personal data and to have a copy of it, to correct it, to delete it, to restrict or object to processing, to data portability, and to withdraw a consent at any time without affecting what was done before the withdrawal. Most of these you can exercise directly in the app; for anything else write to support@perlicom.com and we will answer within one month. We do not use automated decision-making that produces legal or similarly significant effects.
You also have the right to complain to the Irish Data Protection Commission (www.dataprotection.ie) or to the supervisory authority where you live or work.
12. California privacy rights (CCPA / CPRA)
In the last 12 months the following categories of personal information were collected through StoryTimeZZZ: identifiers (your name, e-mail address, account and session identifiers, a hashed install id, and, through Google's ads SDK, device identifiers and IP address); commercial information (what you bought and your token balance); internet or other electronic network activity (advert views and taps, error diagnostics); approximate geolocation derived from IP address by Google's ads SDK; and the information you choose to add about a child, which may include health information and ethnicity.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Advert requests from this app are marked child-directed and non-personalised, which is the opposite of behavioural targeting. We do not use or disclose sensitive personal information for any purpose other than providing the service you asked for.
You have the right to know and access, to delete, and to correct your personal information, and not to be discriminated against for exercising those rights. Use the in-app deletion in section 10, or write to support@perlicom.com. An authorised agent may make a request on your behalf; we may ask for proof of authorisation.
13. Changes to this policy
We will update this page if the app or the law changes, and change the effective date above. If a change materially affects how your family's data is used, we will also tell you in the app or on the Google Play listing.
14. Contact
Perlicom Systems Limited (company number 546999, Ireland)
E-mail: support@perlicom.com