Privacy Policy

Nighty Night is a tool for parents and guardians to create personalized bedtime stories for their children. Accounts are created and controlled entirely by an adult — there is no way for a child to sign up, sign in, or interact with our systems directly. Everywhere below where we describe "your child's information," that information is entered by you, the account holder, not collected from your child.

Account information. When you create an account, we (through our authentication provider, Supabase) store your email address, and if you sign in with Apple or Google, the name and email those providers share with us. If you type in a display name, we store that too.

Child profile information. To personalize a story, you tell us your child's nickname, age, and a chosen avatar. We deliberately only ask for a nickname — not their full legal first name — since that's all a story needs. You may optionally add gender, a short appearance description (like hair color or a favorite outfit), and details about an imaginary companion character. We only collect what you choose to enter — none of these fields require a photo, a full legal name, or any government ID.

Story content. Any prompt you write (for example, "she didn't want to brush her teeth tonight"), plus the story text, illustrations, and narration audio we generate in response.

Billing information. Which plan you're subscribed to and its status. We never see or store your card number, expiration date, or CVC — that's handled entirely by Stripe (on the web) or Apple (in the iOS app). See Section 4.

What we don't collect. We don't run any analytics, advertising, or tracking SDKs in this product — no ad networks, no behavioral profiling tools, no cross-app tracking. We don't use cookies; your session is kept on your own device (browser local storage on the web, secure on-device storage in the mobile app), not in a tracking cookie.

• To generate a story, illustrations, and narration personalized to the child profile you created.
• To operate your account: authentication, billing, customer support, and bedtime-reminder notifications you turn on.
• To keep the service reliable and secure (for example, diagnosing a failed story generation).
• To communicate with you about your account, such as a receipt or a reply to a support request.

We do not use your or your child's information to build advertising profiles, and we do not sell personal information to anyone, ever.

We use a small number of service providers ("sub-processors") to run Nighty Night. We don't sell data to any of them — we send only what each one needs to do its specific job:

• OpenAI — writes the story text and narrates it as audio. To do this, the child's nickname, age, and the appearance/companion details you provided are included in the request we send, along with your prompt.
• Replicate — generates the story's illustrations from a visual description our system writes (derived from your child's avatar/appearance choices, not their nickname or your prompt verbatim).
• Stripe — processes web subscription payments. Stripe collects and stores your card details directly; we only ever receive back a subscription status, never your card number.
• Apple — processes iOS subscription payments (StoreKit) and powers Sign in with Apple, if you use it. Same as Stripe: card details never reach us.
• Google — powers Google Sign-In if you choose that option on Android.
• Supabase — our database, authentication, and file storage provider. It hosts essentially all of the information described in Section 2.

We don't share your family's information with data brokers, advertisers, or any other third party outside this list, and we don't use it to train any AI model beyond what our providers above do to deliver the story back to you (see their own policies for their default data handling terms).

Stories are private by default — visible only to your account. You can choose to generate a private "gift link" to share a specific story with a specific person; we don't publish stories anywhere public, and there's no public feed or listing where a stranger could come across your family's stories. If you generate a gift link, the story's content — including any names or personal details you included in your prompt — becomes visible to whoever you send that link to. This is entirely your choice; nothing is shared automatically.

Nighty Night is built for parents and guardians to use on behalf of their children, and we take the Children's Online Privacy Protection Act (COPPA) seriously. In plain terms:

• We never collect information directly from a child — every field is entered by the verified adult account holder.
• There is no child-facing login, chat interface, or public profile of any kind.
• Child profile information is used solely to personalize your family's own stories — never for advertising, and never shared beyond the two AI providers named in Section 4, solely for that purpose.
• Creating a subscription requires a payment method, which itself serves as a verification step confirming an adult, not a child, controls the account.
• You can review, correct, or delete your child's profile information at any time — see Section 7.
• Every story is automatically screened for unsafe content — both what a parent types and what the AI generates, including every illustration — before it's ever shown; see our Security page for exactly how. On top of that, anyone — including a story's own creator — can report a story, which immediately hides it while a human reviewer looks into it and either reinstates or permanently removes it.

If you believe a child has provided us information other than through a parent-created profile as described above, please contact us immediately at [email protected] and we will investigate and delete it.

We keep your account and profile information for as long as your account is active. You can delete your account, a child's profile, or an individual story yourself at any time, directly in the app (look for "Delete" on the story or profile itself, or the "Danger zone" on your Account page) — this is a permanent, physical deletion with no way to recover the data, not a deactivation. If you'd rather we handle it for you, email us at [email protected] from the email address on your account. Either way, we delete the requested data except where we're required to keep limited records (for example, transaction records for tax and accounting purposes), and we aim to complete any request within 30 days.

Separately, internal logs we keep for debugging generation requests (which can include the child profile details used to generate a story) are automatically deleted after 30 days — we don't keep them any longer than that.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain uses of it (for example, residents of the EU/UK under GDPR, or California residents under the CCPA/CPRA). You can exercise any of these rights by emailing [email protected]. We will not discriminate against you for exercising any of these rights.

We take a number of concrete technical steps to protect your family's information — see our Security page for details.

Our service providers may process and store information in the United States and other countries. Wherever your information is processed, we require our providers to protect it consistently with this policy.

If we make a material change to this policy, we'll update the "Last updated" date above and, for significant changes, notify you by email or an in-app notice.

Questions, requests, or concerns about your privacy: [email protected]. This policy is issued by Overarching AI LLC.