Security

Every story goes through multiple layers of automated safety checks before it's ever generated or shown, on top of the access controls described below:

• The AI that writes each story is explicitly instructed to write only content appropriate for a young child at bedtime, and to disregard — never act on, repeat, or acknowledge — any unsafe or manipulative request hidden in what a parent types.
• Before a story is even generated, everything a parent enters (the story's theme and details, and a child's profile description) is automatically screened for unsafe content. Anything flagged is rejected before it ever costs a story credit.
• After a story is written, its text and every individual illustration are automatically screened again — separately, after the fact — before the story is ever shown. If the text doesn't pass, we try writing it again once; if it still doesn't, or if a picture doesn't pass, the story is rejected outright and never delivered, and the credit is refunded.
• If something inappropriate is ever generated anyway, anyone — including the story's own creator — can report it, which immediately hides it while a reviewer looks into it. See our Privacy Policy for more on how reported stories are reviewed.

All traffic between your device and Nighty Night — the web app, the mobile app, and our API — is encrypted in transit over HTTPS/TLS. There is no unencrypted path anywhere in the product. Your data at rest (our database and file storage, both hosted on Supabase) is encrypted at rest by our infrastructure provider as a platform-level default.

Every request to our API carries a signed session token, and our servers independently re-verify that token against our authentication provider on every request — we never trust an identity a client merely claims to have. This means one account genuinely cannot read or modify another account's data by tampering with a request.

Beyond application-level checks, our database itself enforces row-level security policies on every table that holds personal information — profiles, stories, subscriptions, and account settings. In practice, this means even a bug in our application code can't leak one family's data to another, because the database refuses the query at a lower level regardless of what the application asks for.

We never handle, transmit, or store raw payment card data. Web subscriptions are processed entirely by Stripe (a PCI-DSS Level 1 certified payment processor) through its own hosted checkout; iOS subscriptions are processed entirely by Apple through StoreKit. Our servers only ever receive a subscription status back — never a card number.

The elevated database credentials our backend services use to generate and deliver stories are held only by our own server-side infrastructure — never shipped inside the mobile app or exposed to a browser. Background story-generation logs used for debugging are similarly restricted to internal service access and are not exposed through any public or user-facing endpoint.

We don't run third-party analytics, advertising, or tracking SDKs in this product. Fewer integrations means a smaller attack surface and fewer parties your family's data could possibly flow to.

The service providers we rely on — Supabase, Stripe, Apple, Google, OpenAI, and Replicate — are established providers that maintain their own security and compliance programs. See our Privacy Policy for exactly what each one receives and why.

If you believe you've found a security issue in Nighty Night, we want to hear from you before anyone else does. Email [email protected] with details — we ask that you not access or modify data that isn't yours while investigating, and we'll respond as quickly as we can.

As our infrastructure evolves, we'll update this page to reflect it. See our Privacy Policy for how we handle the data these measures protect.