Privacy Policy

Last Updated: March 25, 2026

Tuckly is a children's bedtime story app that creates personalized, AI-powered stories for children. This app is directed at children under 13 and their parents or guardians. We are fully committed to protecting children's privacy and comply with the Children's Online Privacy Protection Act (COPPA) and Apple's App Store Guidelines for Kids' Category apps. By using Tuckly, you (the parent or guardian) agree to the practices described in this policy.

COPPA Compliance and Parental Consent

Tuckly is designed for use by parents and guardians on behalf of their children. We comply with the Children's Online Privacy Protection Act (COPPA) and Apple's guidelines for apps in the Kids category.

• Parental consent is required before a child can use the app. During setup, a math-based parental gate is presented to verify that a parent or guardian — not the child — is approving account creation and data entry.
• We do not knowingly collect personal information directly from children. All data is entered by the parent or guardian on the child's behalf.
• We do not engage in behavioral advertising targeted at children.
• If we discover that we have inadvertently collected data from a child without proper parental consent, we will delete it promptly upon request.

Information We Collect From or About Children

To create personalized bedtime stories, we collect the following information about your child:

• First name only — used to address the child as the story's hero (we never collect last names)
• Age — used to calibrate story complexity and appropriate content
• Reading level — used to set vocabulary and sentence complexity in generated stories
• Preferred language — used to generate stories in the child's language, including bilingual mode
• Story preferences — selected themes (e.g., adventure, fantasy) and character types (e.g., fairy, knight) used to personalise story content
• Reading activity — reading streaks ("cosy nights this week") and achievement badges earned within the app, used solely to encourage engagement within the app

Account Information (Parent/Guardian)

When you create a Tuckly account, we collect:

• Your email address
• Your password, which is securely hashed using bcrypt before storage (we never store passwords in plain text)
• Optionally, a phone number for SMS-based account verification

Payment Information

Subscription payments are processed through Apple's in-app purchase system, managed by RevenueCat. We never see, access, or store your credit card or payment details. All billing is handled securely by Apple.

How We Use Children's Information

Children's data is used exclusively to personalize story content within the app. Specifically:

• Your child's first name, age, reading level, preferred language, and story preferences are sent to our AI provider (OpenAI) solely to generate a personalized bedtime story.
• Reading activity (streaks, badges) is stored to display progress within the app and encourage consistent bedtime routines.
• Children's names, ages, and personal details are never shared with advertisers, used for profiling, or sold to any third party.
• We do not use children's data to serve targeted advertisements.

Third-Party Services That Process Data

The following third-party services may receive data as part of operating the app. We have carefully limited what data is shared with each provider.

OpenAI

We use OpenAI's API to generate personalized story text. When a story is created, your child's first name, age, reading level, preferred language, and story preferences (themes and character choices) are sent to OpenAI's API to produce the story. OpenAI does not retain this data beyond the API request, in accordance with their API data usage policy (no training on API submissions). OpenAI does not receive your child's last name, email address, or account information.

Twilio

We use Twilio to send SMS verification codes during account creation for parents who choose phone-based sign-up. Only the parent's phone number is sent to Twilio — no children's data is ever shared with Twilio.

RevenueCat

We use RevenueCat to manage in-app subscriptions and verify purchase receipts. RevenueCat receives an anonymous user identifier to track subscription status. No children's personal data (name, age, story preferences) is shared with RevenueCat. Payment processing is handled by Apple, not RevenueCat or Tuckly.

Google AdMob

Free-tier users may see advertisements served by Google AdMob. Child-directed treatment is enabled for all AdMob requests, which disables interest-based advertising and limits data collection as required by COPPA. No personal data about your child is shared with Google for advertising purposes.

Stripe

Stripe is integrated as a payment processor for web-based subscription management. All payment information is handled directly by Stripe on their secure, PCI-compliant infrastructure. No children's personal data is sent to Stripe.

We do not sell your data or your child's data to any third parties.

Data Storage and Security

We take the security of your family's data seriously. All data is transmitted over HTTPS (TLS encryption) and stored securely in encrypted databases with appropriate access controls. Specifically:

• All API communication uses HTTPS — data in transit is encrypted end-to-end
• Data is stored in encrypted, access-controlled cloud databases
• Passwords are hashed using bcrypt, an industry-standard hashing algorithm
• User sessions are secured with signed, encrypted cookies
• Stories and child profiles are securely synced to your device for cross-device access
• Your device also caches stories locally using AsyncStorage for faster access and offline reading

Your Rights as a Parent or Guardian

As the parent or guardian, you have full control over your child's data. You have the right to:

• Access and review all information stored about your child
• Correct or update your child's profile at any time within the app
• Request deletion of your child's data at any time by using the "Delete Account" feature within the app's Profile settings, or by contacting us directly at ryan@realityshift.com.au
• Cancel your subscription at any time through your Apple ID settings
• Opt out of any non-essential communications

Upon receiving a deletion request, we will remove all personal data associated with your account and child profiles from our servers within 30 days.

Data Retention

• Account and child profile data is retained for as long as your account remains active
• When you delete your account, all associated data — including child profiles, stories, streaks, and badges — is permanently deleted from our servers
• Story data stored locally on your device can be cleared at any time through your device settings

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or App Store requirements. When we make significant changes, we will notify parents through the app or via email. We encourage you to review this policy periodically.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal data, or your child's data — including requests to review, correct, or delete information — please contact us:

• Email: ryan@realityshift.com.au
• Support: support@tuckly.com.au