Privacy Policy

The Service is designed for parents, guardians and educators to use together with children. Accounts may only be created by adults, and the adult account holder is responsible for how the Service is used with a child. We do not knowingly collect personal information from children under 13 (or the equivalent age where you live). If you believe a child has provided us personal information directly, contact us and we will delete it.

When you build a story you may type in a child’s first name as the hero. That is your choice; we suggest sticking to a first name or nickname and never adding a surname, school, address or other identifying detail to a story.

Account. When you sign in with Google, Google sends us your email address, name and profile picture; we use the email to identify your account and store the name for display. We never see your Google password.

What you create. The story ingredients you choose (character, place, problem, magic object, mood, and an optional writing style), the directions you pick between chapters, the changes you ask for, the chapters and titles that are written, and any cover picture you upload.

Voice input. Free-text fields can take dictation. This uses the speech recognition built into your browser or device (for example Google’s in Chrome or Apple’s in Safari). Audio is processed by that provider under its own privacy terms; it is not sent to or stored by us. We only receive the text.

Payment. Subscriptions are handled by Stripe. Card details go directly to Stripe and never touch our servers. We store a Stripe customer reference, your subscription status and the end of the current billing period.

Technical data. Our servers log the usual request data — IP address, browser type, pages requested and timestamps — for security and debugging. We use Vercel Web Analytics for aggregate page-view counts; it does not use cookies or track you across sites.

Advertising measurement. We advertise on Google, and use Google’s tag to learn whether an ad led to a subscription: it records that a page was viewed and that a purchase was completed, and Google matches that against the ad click. Google sets its own cookies for this and handles the data under its privacy policy. The tag never receives your name, email address or any story content. For visitors in the UK, the European Economic Area and Switzerland the tag runs with advertising cookies switched off, so Google gets only cookieless, aggregate signals.

Cookies. We set the cookies needed to keep you signed in and to complete sign-in and checkout, plus Google’s advertising-measurement cookies described above. You can block those with your browser settings or an ad-blocking extension, or opt out of ad personalisation in your Google Ads Settings; the Service works just the same without them.

• To run the Service: write your chapters, keep your shelf, and show your stories back to you.
• To take payment, manage your Weave Plus subscription and send receipts.
• To keep the Service safe: preventing abuse, enforcing fair-use limits, and investigating problems.
• To contact you about the Service — billing notices and important changes. We don’t send marketing email unless you opt in.
• To understand, in aggregate, how the Service is used so we can improve it.

We do not sell your personal information and we do not show ads.

Chapters are written by an AI model from Anthropic (Claude). To do that, we send the story ingredients, the chapters so far, and your chosen direction or change to Anthropic’s API. Under Anthropic’s commercial terms, this content is not used to train their models, and Anthropic retains it only for a limited period for trust-and-safety purposes under its own policies. We do not use your stories to train models either.

We share information only with the providers that run the Service, each under contracts that limit what they may do with it:

• Supabase — sign-in and the database that stores your account and stories.
• Anthropic — the AI model that writes chapters.
• Stripe — payments and subscription management.
• Vercel — hosting, storage for cover pictures, and aggregate analytics.
• Google — if you choose to sign in with Google, and for advertising measurement (page views and a purchase confirmation; never your name, email or stories).

We may also disclose information if the law requires it, to protect the rights or safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

Story links. If you create a share link for a story, anyone who has the link can read that story, without signing in. Shared stories are unlisted and hidden from search engines, but you control who you send the link to.

We keep your account and stories for as long as your account exists. You can delete any storybook from your shelf at any time, and it is gone straight away, including its cover picture. To delete your whole account, email 20codemom23@gmail.com from the address on the account; we will remove your account, stories and covers, and any copies in backups are purged within 30 days. Payment records held by Stripe are kept for as long as tax and accounting rules require.

All traffic to the Service is encrypted in transit, data is encrypted at rest by our providers, and every story is protected by row-level access rules so it can only be read by the account that made it (or by someone you give a share link to). No system is perfectly secure, so please keep your email account safe — it is the key to yours.

Wherever you live, you can ask us to access, correct, export or delete the personal information we hold about you, or to stop using it in a particular way. Email 20codemom23@gmail.com and we will respond within 30 days. We may ask you to confirm the request from the email address on the account.

If you are in the UK or European Economic Area, our legal bases are: performing our contract with you (running the Service and billing), our legitimate interests (keeping the Service secure and improving it), legal obligations, and your consent for anything optional, which you may withdraw at any time. Our providers are based in the United States; where personal data leaves the UK or EEA it is protected by standard contractual clauses or an equivalent safeguard. You also have the right to complain to your local data protection authority.

If you are in California, you have the right to know what personal information we collect and how we use it (this policy), to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell personal information. The Google advertising-measurement tag described above may count as “sharing” under California law; you can opt out by blocking it in your browser or by emailing 20codemom23@gmail.com.

We will update this page when our practices change and revise the date at the top. For significant changes we will also let you know by email or a notice in the Service before they take effect.

Questions, requests or concerns: 20codemom23@gmail.com. Our Terms of Service cover the rest of the relationship.