Privacy Policy

We built MoonLoom for families, and that means we treat your data — especially anything to do with your child — with real care. This policy explains, in plain language, what we collect, why we collect it, and the choices you have.

1. What We Collect

We only collect what we need to make your storybook and run your account:

• Account information: your email address and an optional display name.
• Story details: your child's name, interests, and the choices you make in the wizard. We use these only to write and illustrate the story.
• Payment information: processed by Stripe, our payment provider. Card numbers never touch our servers.
• Usage data: privacy-friendly analytics about how the product is used (page views, button clicks). No cross-site tracking, no advertising profiles.

2. How We Use Your Data

We use your information for these purposes — and nothing else:

• To generate your personalised storybook.
• To process payments, manage your credit balance, and deliver your downloads.
• To send transactional emails (order receipts, password resets, story-ready notifications). Marketing emails are opt-in only.
• To monitor service quality and fix bugs using aggregated, anonymised data.

3. Photos and Your Child

Children's photos are the most sensitive data we ever touch. Here is exactly how we handle them:

• Ephemeral processing only: when you upload a photo, it is held in memory just long enough to generate the illustrated character. It is then deleted from our servers automatically.
• Nothing is saved by default: original photos are never stored long-term unless you explicitly opt in by saving the character to your reusable library. Even then, we keep the AI-generated illustration — not the photograph itself.
• Never shared, never sold: we never share, sell, or transfer photos to any third party. We do not use photos to train any AI models, ours or anyone else's.
• Encrypted in transit and at rest: every photo upload is protected with TLS 1.3 during transfer and during the brief processing window.

4. Credits, Purchases, and Story History

MoonLoom runs on a credit balance — no subscriptions. We keep a record of credits you receive, purchase, or spend, plus a list of the stories you generate. This lets you re-download your books, see your purchase history, and check your balance. We retain this information for as long as your account is open. When you delete your account, we delete it within 30 days.

5. AI Generation Logs

Each time we generate a story, we keep a short record of the prompt and the resulting text and images. We use these logs for two things only: investigating quality or safety issues, and debugging failures. Logs are retained for up to 90 days, then deleted automatically. They are never used for advertising, never shared, and never used to train external AI providers.

6. Data Retention

Your account and the stories you have generated stay available for as long as your account is active, so you can come back and re-download them whenever you like. AI generation logs are kept for up to 90 days. When you delete your account, every piece of personal data — generated books included — is permanently deleted within 30 days.

7. Your Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, you have the following rights:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to fix anything that is inaccurate.
• Erasure: ask us to delete your personal data (the right to be forgotten).
• Portability: receive your data in a structured, machine-readable file.
• Objection: object to certain types of processing.
• Withdraw consent: change your mind about anything you previously opted into.

To exercise any of these rights, just email [email protected]. We will respond within 30 days, and there is no charge.

8. Cookies and Analytics

We use a small number of essential cookies so the service can work — keeping you signed in and remembering your language preference. For product analytics we use PostHog with first-party cookies; this helps us understand which features people use and where the experience needs work. PostHog is configured without cross-site tracking and without advertising integrations. We do not use advertising cookies, retargeting pixels, or third-party trackers of any kind.

9. Security

We protect your data with industry-standard measures: TLS encryption everywhere, secure authentication via Supabase Auth, scoped database access controls, and regular security reviews. Our infrastructure is hosted on servers based in the European Union.

10. Children's Privacy

MoonLoom is a tool for parents and guardians to create books for the children in their lives. We do not knowingly collect personal data directly from anyone under 16. The adult who creates the account is the one providing all child details. If you believe a child has somehow created an account or shared data without a parent's consent, please contact us right away and we will remove it.

11. Changes to This Policy

We update this policy occasionally as the product evolves. The date at the top of the page always shows the most recent revision. We will email registered users about meaningful changes before they take effect.

12. Contact Us

Questions about privacy or want to exercise a data right? Reach out anytime:

Email: [email protected]

MoonLoom · Kyiv, Ukraine