Privacy Policy

We built MoonLoom for families, and that means we treat your data — especially anything to do with your child — with real care. This policy explains, in plain language, what we collect, why we collect it, and the choices you have.

1. What We Collect

We only collect what we need to make your storybook and run your account:

• Account information: your email address and an optional display name.
• Story details: your child's name, interests, and the choices you make in the wizard. We use these only to write and illustrate the story.
• Payment information: processed by Stripe, our payment provider. Card numbers never touch our servers.
• Usage data: privacy-friendly analytics about how the product is used (page views, button clicks). No cross-site tracking, no advertising profiles.

2. How We Use Your Data

We use your information for these purposes — and nothing else:

• To generate your personalised storybook.
• To process payments, manage your credit balance, and deliver your downloads.
• To send transactional emails (order receipts, password resets, story-ready notifications). Marketing emails are opt-in only.
• To monitor service quality and fix bugs using aggregated, anonymised data.

3. Photos and Your Child

Children's photos are the most sensitive data we ever touch. Here is exactly how we handle them:

• Purpose-limited provider processing: when you upload a photo, MoonLoom sends it to the configured image-generation provider only to create the illustrations for your requested story.
• Temporary generation copy: the working copy used for the current story is deleted after generation processing finishes.
• Optional private-library copy: after your explicit account permission, the original photo is stored privately with the reusable character until you remove it or withdraw permission.
• Protected and under your control: uploads are encrypted in transit and at rest. MoonLoom does not sell photos or use them to train AI models.

4. Credits, Purchases, and Story History

MoonLoom runs on a credit balance — no subscriptions. We keep a record of credits you receive, purchase, or spend, plus a list of the stories you generate. This lets you re-download your books, see your purchase history, and check your balance. We retain this information for as long as your account is open. When you delete your account, your credit history is deleted, except payment records (amount, date and payment reference), which we must keep for the period tax and accounting law requires. They are kept without your name, email or stories.

5. AI Generation Logs

Each time we generate a story, we keep a short record of the prompt and the resulting text and images. We use these logs for two things only: investigating quality or safety issues, and debugging failures. Logs are retained for up to 90 days, then deleted automatically. They are never used for advertising, never shared, and never used to train external AI providers.

6. Data Retention

Your account and the stories you have generated stay available for as long as your account is active, so you can come back and re-download them whenever you like. AI generation logs are kept for up to 90 days. When you delete your account in Settings, your personal data — generated books, illustrations, audio, characters and photos included — is deleted immediately, and in any case within 30 days. Only minimised payment records required by tax law are kept, without any link to you.

7. Your Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, you have the following rights:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to fix anything that is inaccurate.
• Erasure: ask us to delete your personal data (the right to be forgotten).
• Portability: receive your data in a structured, machine-readable file.
• Objection: object to certain types of processing.
• Withdraw consent: change your mind about anything you previously opted into.

You can download a copy of your data or delete your account yourself at any time in Settings → Data. For any other request, just email [email protected]. We will respond within 30 days, and there is no charge.

8. Cookies and Analytics

We use a small number of essential cookies so the service can work — keeping you signed in and remembering your language preference. For product analytics we use PostHog with first-party cookies; this helps us understand which features people use and where the experience needs work. PostHog is configured without cross-site tracking and without advertising integrations. We do not use advertising cookies, retargeting pixels, or third-party trackers of any kind. PostHog only runs after you accept analytics in the cookie banner, and you can change your choice at any time via “Cookie settings” in the footer.

9. Security

We protect your data with industry-standard measures: TLS encryption everywhere, secure authentication via Supabase Auth, scoped database access controls, and regular security reviews. Our infrastructure is hosted on servers based in the European Union.

10. Children's Privacy

MoonLoom is a tool for parents and guardians to create books for the children in their lives. We do not knowingly collect personal data directly from anyone under 16. The adult who creates the account is the one providing all child details. If you believe a child has somehow created an account or shared data without a parent's consent, please contact us right away and we will remove it.

11. Changes to This Policy

We update this policy occasionally as the product evolves. The date at the top of the page always shows the most recent revision. We will email registered users about meaningful changes before they take effect.

12. Contact Us

Questions about privacy or want to exercise a data right? Reach out anytime:

Email: [email protected]

MoonLoom · Kyiv, Ukraine