Privacy Policy — Timistories

Last updated: 6 October 2026 (version 1.2 — version 1.1 had been in effect since 1 October 2026) Document version: 1.2

This policy explains, in plain language, what personal data Timistories collects when you use the service, why we collect it, who we share it with, and how you can exercise your rights. It is written for parents — no law degree required.

1. Who is responsible for your data

The Timistories service (the mobile app, the website at timistories.com, the API) is operated by:

ILAD DIGITAL AGENCY - FZCO IFZA Business Park, Premises 56908-001, Building A1 Dubai Digital Park, Dubai Silicon Oasis Dubai, United Arab Emirates IFZA licence number: 56908 Privacy contact: privacy@timistories.com General contact: support@timistories.com

ILAD DIGITAL AGENCY - FZCO is the data controller under the EU General Data Protection Regulation (GDPR) — meaning we are the entity that decides why and how your data is processed.

In this policy, “we”, “our”, “Timistories” mean ILAD DIGITAL AGENCY - FZCO. “You” means the parent or legal guardian who creates the account.

2. EU Representative

Timistories is operated from the United Arab Emirates. GDPR Article 27 requires non-EU companies that regularly process EU residents’ data to designate a representative inside the EU whom users and supervisory authorities can contact.

At the time this policy is first published, no EU representative has yet been designated. We commit to designating an EU Representative (through a specialised provider such as EDPO or Prighter) within sixty (60) days of Timistories’ public launch and to updating this policy with their contact details as soon as the appointment is in place. Until then, you can exercise your rights directly with privacy@timistories.com.

3. What data we collect

Below is the complete list of personal-data categories Timistories collects in this version.

#	Category	Concrete examples	Source
1	Email address	The address used to create your parent account	You enter it
2	Child’s first name	First name used to personalise stories	You enter it
3	Other user content	Child’s date of birth, family values, topics to address or avoid, story prompts, characters and places you create	You enter them
4	Payment information	Stripe / RevenueCat / Apple / Google transaction identifiers. We never store your card number — it stays with Stripe or the App Store.	Sent by the payment provider
5	Crash data	Technical error reports (Sentry)	Generated automatically
6	Performance data	Technical performance metrics (Sentry)	Generated automatically
7	Product interactions	Pseudonymous in-app funnel statistics (PostHog) — never linked to your identity	Generated automatically
8	Android launch alert (website)	Email address and language left on `timistories.com` to be told the day the app comes out on Android and, where applicable, the campaign you came from (`utm_source` parameter)	You enter it
9	Website audience measurement	Pages viewed, referring page, campaign parameters (`utm_`) in the address, clicks on “Download on the App Store”; IP address and browser/device type, used only for the daily count and then discarded — no cookies, no profile (see section 13)	Generated automatically
10	Religious or philosophical beliefs (optional)	Your family’s tradition (e.g. secular / no religion, Christian, Muslim, Jewish…) and how present you want it to be in stories	You enter it, only if you consent — see section 7

No voice recording in this version. Recording a parent’s own voice so that stories can be read back in that voice is a planned future feature (Pro) that is not available yet. In this version we collect no voice samples and build no voice model. Story narration uses synthetic voices (see section 8). If and when we launch the voice feature, we will update this policy first, add an “Audio data” row to the list above, and ask for your explicit consent before any recording — see section 6.

We do not collect: your card number, your phone number (unless you write it yourself in a support message), your GPS location, your contacts, your web browsing history, any advertising identifier (IDFA / GAID).

4. Why we collect this data, and on what legal basis

GDPR requires every processing operation to rest on a legal basis (Article 6). Here is our mapping:

Data category	Purpose	Legal basis (GDPR Art. 6)
Email, child’s first name, user content	Run the service: create your account, generate personalised stories, send you essential emails (verification, reset, billing receipts)	Performance of contract (Art. 6(1)(b))
Religious or philosophical beliefs (optional)	Tailor stories to your family’s traditions — and nothing else	Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) — see section 7
Voice recording (planned future Pro feature — not active in this version)	Would let your child hear stories read in your own voice, if we launch it	Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) will be required before any recording — see section 6
Payment information	Charge a subscription or credit pack, prevent fraud	Performance of contract + legal obligation
Crash and performance data	Diagnose bugs, measure app stability	Legitimate interest (Art. 6(1)(f)) — narrow technical diagnostics, pseudonymised
Product interactions (PostHog)	Understand which flows work and improve the experience	Legitimate interest (Art. 6(1)(f)) — pseudonymous data, no advertising profiling
Android launch alert	Send you one email, on the day the Android app comes out — nothing else (no newsletter)	Consent (Art. 6(1)(a)), given by filling in the form; withdraw it at any time by writing to privacy@timistories.com
Website audience measurement (PostHog, cookieless)	Know how many people visit the site, where they come from and which pages lead them to the App Store	Legitimate interest (Art. 6(1)(f)) — aggregate statistics, nothing is stored on your device

You can object to any legitimate-interest processing (see section 10: Your rights).

5. Children’s data

Timistories is a parent-operated application for generating stories for a child to listen to. The child does not create an account, does not type, does not pay. You — the parent or legal guardian — are the one who:

Creates the account with your email address.
Enters the first name and date of birth of your child to personalise stories.
Optionally adds an avatar and narrative preferences.
Optionally, and only with your explicit consent, enters your family’s religious or philosophical tradition — see section 7.

The application is not directed at children in the sense of the U.S. Children’s Online Privacy Protection Act (COPPA), and is not enrolled in the App Store Kids Category. It is designed to be used by an adult who then shares the resulting story with their child. We do not knowingly collect data from U.S. children under the age of 13.

We nonetheless apply child-protective principles:

Verifiable parental consent: account creation requires you to confirm you are at least 18 years old and the parent or legal guardian of the child whose details you enter.
Data minimisation: we collect only what is strictly useful to personalise the story (first name, approximate date of birth, the preferences you choose to enter).
No public profile, no social sharing on the child’s behalf, no advertising targeted at the child.
Deletion on request: you can delete the child profile at any time — see section 11.

If you believe a minor’s data has been entered without the parent’s consent, write to privacy@timistories.com; we delete within 7 days of verification.

This feature is not available in this version of Timistories. Today, story narration uses synthetic voices: a standard voice provided through OpenAI, or a “Signature” voice provided through ElevenLabs if you choose one (see section 8). We do not record your voice, do not build a voice model, and collect no audio samples.

We describe the feature here so you know the safeguards we intend to put in place before we ship it. If we launch parent-voice narration (as a Pro feature), your recorded voice samples would be used to build a digital voice model capable of reading new text in your voice. A voice model is special-category personal data under GDPR Article 9 (biometric data). Before that feature becomes usable, we commit to:

Updating this policy first and adding “Audio data” to the collection list in section 3.
Asking for explicit consent: before the first recording, the app would show a dedicated screen explaining what happens and ask you to actively check “I consent to my voice being used to create a voice model”, withdrawable at any time from Settings → Voices.
Defining retention and deletion: raw samples and the voice model would be kept only while your account exists and you have not deleted the voice yourself, in a private bucket encrypted at rest, and deleted within a maximum of 30 days of account closure.
Limiting reuse: the model would narrate stories on your account only — never shared with anyone, never used to train a general-purpose AI model.

Until we publish that update, none of the above is active and no voice data is collected. Every Timistories feature works today with synthetic voices.

7. Religious or philosophical beliefs (optional)

Right after you create your child’s profile, and at any time later in Settings › Values & beliefs, you can tell us your family’s tradition — secular / no religion, Christian, Muslim, Jewish, Buddhist, Hindu or other — and how present it may be in stories (not at all, in the background, in the values, or explicitly).

This information reveals religious or philosophical beliefs. It is sensitive data under GDPR Article 9 and under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. So we apply stricter rules:

It is optional. You can skip this step: nothing is stored, and every Timistories feature stays available. “Secular / no religion” is a (philosophical) belief too, so it gets exactly the same protection.
Only with your explicit consent. We store your choice only if you tick a dedicated box that is unticked by default and separate from accepting the Terms. We keep the date you agreed and the version of the wording you accepted. Legal basis: GDPR Art. 6(1)(a) and Art. 9(2)(a).
One purpose only: writing your stories. We use it to tailor stories to your family: consistent food and customs (for example, no pork for a Muslim or Jewish family, no beef for a Hindu family), the celebrations you keep, and never the practices of a religion other than yours. It is never used for advertising, to put you in a marketing segment or to set a price, and it is never sold. No automated decision about you is based on it.
Who receives it. To write each story, the tradition and level you chose are included in the instructions sent to our text-generation provider, Google (Gemini API, United States), which processes them on our behalf. Google does not use them to train its models and may keep them for up to 55 days, solely to detect abuse. If we ever had to switch to a fallback provider (Anthropic or OpenAI, see section 8), the same rules would apply. Your choice is never sent to our product-analytics tool (PostHog) or our error-tracking tool (Sentry).
The stories themselves. A story written with this setting may reflect your tradition (a holiday meal, a bedtime prayer). Like every story, its text goes through our automated content-safety check and through audio narration (OpenAI, or ElevenLabs if you pick a “Signature” voice), then it is kept in your library. If you share a story by link, anyone who has the link can read it.
Extra security. Your choice is stored separately from your profile and encrypted by our application (AES-256-GCM) with a key kept outside the database. It does not appear in our admin tool: our team can only see whether it is set or not.
Withdraw your consent at any time. Settings › Values & beliefs › “Delete this information” erases your choice immediately. We only keep a record that a consent was withdrawn, without the value you had chosen. You can also write to privacy@timistories.com. Withdrawal applies going forward: stories already created stay in your library and you can delete them if you wish. To change your choice, you tick the consent box again.
How long we keep it. Until you delete it. If you ask us to delete your account, it is erased immediately, without waiting for the 30-day window to end; an encrypted copy may remain in database backups for up to 30 days.
Your children. This choice is about your family, including your children. Only the parent or legal guardian who holds the account can enter it. We never ask for the religion of a friend, a character or anyone else.
Access and portability. Your choice is included in the copy of your data you can request (section 10).

8. Sub-processors and recipients

To run Timistories we rely on the service providers (“sub-processors” within the meaning of GDPR Art. 28) listed below. Each is bound by a Data Processing Agreement (DPA) incorporating the EU Standard Contractual Clauses (SCCs, Module 2 Controller-to-Processor) where data leaves the EEA.

Sub-processor	Role	Data transferred	Hosting region	DPA
Stripe Payments Europe Ltd.	Payment processing (web, grandfathered subscriptions)	Customer ID, amounts, transaction metadata	Ireland (EU) + United States	https://stripe.com/legal/dpa
RevenueCat, Inc.	iOS/Android in-app purchase receipts, subscription state	Timistories user ID (UUID), product identifiers, transaction events	United States	https://www.revenuecat.com/legal/dpa
Google LLC (Gemini API)	Primary story-text generation and illustration generation (all plans)	Story prompt (child first name, family values, narrative preferences and, if you consented, your family’s tradition and how present it may be — section 7), illustration prompt	United States + EU	https://business.safety.google/processorterms/
OpenAI, L.L.C.	Default audio narration for all plans (text-to-speech, model `gpt-4o-mini-tts`) that turns the story text into the spoken narration your child hears; automated content-safety check (moderation of the free-text instructions you type and of the generated text); fallback text-generation provider, not active today	Story text — which contains the child’s first name —, free-text instructions you type, chosen voice/style	United States	https://openai.com/policies/data-processing-addendum
Anthropic, PBC	Fallback text-generation provider (Claude model) — configured for failover only, not active; receives no user data in normal operation	Story prompt — only if failover is triggered	United States	https://www.anthropic.com/legal/commercial-terms (DPA in annex)
ElevenLabs Inc.	Narration with the premium “Signature” voices, only when you pick one of those voices for a story. (Narration in the parent’s own cloned voice remains a planned future feature, not active — see section 6.)	Story text to be narrated — which contains the child’s first name	United States	https://elevenlabs.io/dpa
Resend, Inc.	Transactional email delivery (verification, reset, receipts)	Email address, message content	United States + EU	https://resend.com/legal/dpa
Functional Software, Inc. (Sentry)	Crash and error reporting	Pseudonymised user ID, error traces	United States + EU	https://sentry.io/legal/dpa/
PostHog, Inc.	Product analytics — pseudonymous in-app funnel statistics; cookieless website audience measurement (section 13)	Pseudonymous distinct ID, in-app events (screens viewed, funnel steps); for the website: pages viewed, referring page, `utm_` parameters, IP address and browser processed transiently for counting; no story content, no child data, no beliefs	European Union (EU Cloud, `eu.i.posthog.com`)	https://posthog.com/dpa
MongoDB, Inc. (Atlas)	Primary database hosting	All non-media account data (the beliefs in section 7 are stored there encrypted by our application)	EU (eu-west-1, Ireland)	https://www.mongodb.com/legal/dpa
Cloudflare, Inc. (R2)	Media storage — generated audio narration and cover images (S3-compatible object storage)	Generated audio files, cover-image files, object keys	European Union (R2 EU location)	https://www.cloudflare.com/cloudflare-customer-dpa/
Cloudflare, Inc.	CDN, DDoS protection, email routing	Request metadata, headers	Global network (EU PoPs preferred)	https://www.cloudflare.com/cloudflare-customer-dpa/
Amazon Web Services, Inc.	EU compute host — runs the Timistories API (ECS Fargate, eu-west-1) and holds our encryption keys. Processes requests in transit; no media or database is stored on AWS (media is on Cloudflare R2, the database on MongoDB Atlas).	Request data processed transiently in memory	EU (eu-west-1, Ireland)	https://aws.amazon.com/agreement/ (DPA in annex)
Apple Inc.	App distribution, iOS in-app purchase processing	App Store transaction identifier	United States	Under Paid Apps Agreement
Google LLC (Play)	Android distribution, Android in-app purchase processing	Play transaction identifier	United States	Under Developer Distribution Agreement

We update this list whenever we change provider. The last update date appears at the top of this page.

9. International transfers

Timistories is operated from the United Arab Emirates (which is not, at the time of writing, the subject of an EU Commission adequacy decision). Several sub-processors are based in the United States or replicate data there.

To frame these transfers:

To the UAE: we rely on the EU Standard Contractual Clauses (SCCs) integrated into the contract between you (EU user) and Timistories.
To the United States: U.S. sub-processors (Stripe US, RevenueCat, Google, OpenAI, ElevenLabs, Resend, Sentry, Apple, Google Play — plus Anthropic as a configured-but-inactive provider) are bound through SCCs, and several are certified under the EU-U.S. Data Privacy Framework where applicable. Our media storage (Cloudflare R2), our product analytics (PostHog EU Cloud) and our compute host (AWS, eu-west-1) keep that data inside the European Union.
To the United Kingdom / Switzerland: equivalent DPAs (UK Addendum / Swiss DPA).
If you live in the United Arab Emirates: your data is hosted in the European Union (Ireland) and some of it is processed in the United States, as shown in the table in section 8. For the optional information in section 7, the consent box you tick mentions this transfer and also serves as your express consent to it.

You can request a copy of the contractual safeguards in place by writing to privacy@timistories.com.

10. Your rights

As a user you have the following rights under GDPR (Articles 15–22):

Right of access (Art. 15): obtain confirmation that we process your data and receive a copy.
Right of rectification (Art. 16): have inaccurate data corrected.
Right to erasure (Art. 17, “right to be forgotten”): have your data deleted — see section 11.
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20): receive your data in a structured format (JSON).
Right to object (Art. 21): object to legitimate-interest processing.
Right to withdraw consent at any time (for any processing based on your consent — for example your beliefs: Settings › Values & beliefs › “Delete this information”). Withdrawal does not affect what was done before.
Right to lodge a complaint with a supervisory authority (e.g., the CNIL in France: cnil.fr).

If you live in the United Arab Emirates, you have equivalent rights under Federal Decree-Law No. 45 of 2021 (access, portability, rectification, erasure, restriction, objection, withdrawal of consent).

To exercise any of these rights, write to privacy@timistories.com from the email address registered on your account. We respond within one month at most, as GDPR requires.

If you reside in the United States: we do not knowingly collect data from children under 13 (the app is parent-operated and not directed at children for COPPA purposes). If you are a parent and believe your child has provided data without your consent, contact privacy@timistories.com.

11. Retention and account deletion

Here is how long we keep each category of data:

Category	Retention period
Parent account (email, hashed password)	As long as the account is active. Deletion: see below.
Child profile (first name, DOB, preferences)	Same as parent account
Religious or philosophical beliefs (optional — section 7)	Until you delete them. Erased immediately if you withdraw consent or ask us to delete your account (encrypted copy in backups: 30 days at most)
Generated stories	Same as parent account
Generated audio narration + cover images (Cloudflare R2)	Same as parent account; deleted within 30 days of account deletion
Payment data (Stripe / RevenueCat transactions)	10 years (accounting requirement) — transaction identifiers only, no card data
Sentry crash logs	90 days, then automatic deletion
PostHog logs (pseudonymous in-app interactions, website audience measurement)	12 months
Android launch alert (email)	Until the launch email is sent, then deleted within 30 days; at most 12 months if the app has not come out on Android by then
Internal audit log	5 years, anonymised after account deletion (`actorUserId: null`)

Account deletion:

From the app: Settings → Account → Delete my account. Your beliefs (section 7), if you had entered them, are erased as soon as you make this request.
A 30-day cooling-off window opens — during this period, you can reactivate the account by emailing privacy@timistories.com or by signing back in (you would then need to enter your beliefs again, if you wish).
After 30 days, a nightly scheduled job (the gdpr_hard_purge cron) permanently deletes: stories, series, episodes, characters, places, family context, beliefs (as a safety net, if any still existed), generated audio and illustration files in Cloudflare R2, sessions, email OTPs, shared links. The credit-ledger row is preserved but anonymised (userId: null) to meet our accounting obligation.
The internal audit log retains records of actions in anonymised form for security and legal traceability reasons.
MongoDB Atlas backups may still contain your data for the backup retention window (30 days) — this is an inherent property of any backup system.

12. Security

We implement the following measures:

Encryption in transit: all client ↔ server traffic uses TLS 1.2+.
Encryption at rest: the database and stored media files (Cloudflare R2) are encrypted (AES-256).
Application-level encryption of beliefs (section 7): AES-256-GCM, with a key kept outside the database; this data is excluded from our technical logs, Sentry and PostHog.
Password hashing with Argon2id (no plaintext storage, no reversible encryption).
Authentication tokens: short-lived JWTs + rotating refresh tokens; every session can be revoked.
Audit log: every sensitive action (deletion, admin access, payment) is traced.
Log redaction: Sentry and our server logs filter sensitive data before storage (Pino redaction layer).
Private bucket for generated narration audio; cover images are served read-only through the CDN.
Rate limiting on sensitive routes (/auth, story generation, /admin).

No system is invulnerable; we commit to notifying affected users and the relevant supervisory authority within 72 hours of any data breach with significant impact (GDPR Art. 33–34).

13. Cookies and trackers

The Timistories mobile app does not use cookies in the European-law sense (cookies are a browser concept). Authentication uses a token stored in expo-secure-store, the phone’s secure enclave.

The marketing site timistories.com is served by Cloudflare Pages. It carries no advertising pixel, no Google Analytics tag, no third-party attribution tool, and it sets no cookie and stores nothing in your browser — unless you ask not to be counted (see below).

To know how many people visit it, the site uses PostHog (hosted in the European Union) in “cookieless” mode:

What we measure, and nothing else: pages viewed (with the referring page and any utm_ campaign parameters in the address), clicks on “Download on the App Store”, and Android launch alert signups (without the email address, which is never sent to PostHog).
No profile, no tracking: no identifier is kept in your browser, no visitor profile is created, your browsing is not recorded (no “replay”). Address parameters other than utm_ campaign parameters are removed before sending.
Counting visitors: to count a day’s unique visitors, PostHog computes, on its servers, a one-way fingerprint from your IP address and browser combined with a random value that is renewed every day and then erased. We do not use this fingerprint to identify you, and it cannot recognise you from one day to the next. Your IP address is used only for this calculation and is removed before the statistics are stored.
No banner: this measurement is limited to traffic statistics for our own use, sets no cookie and does not follow you on other sites; it meets the conditions set by the CNIL (the French data protection authority) for being exempt from consent (Article 82 of the French Data Protection Act, implementing the ePrivacy Directive). Legal basis: our legitimate interest in knowing the site’s traffic (GDPR Art. 6(1)(f)).
Objecting: at the bottom of this page, the “Stop counting my visits” button stops all measurement in your browser; to do so it stores a single piece of information there (“don’t count”), which you can erase at any time. Nothing is measured either if your browser sends the “Global Privacy Control” or “Do Not Track” signal.

14. Changes to this policy

We may update this policy to reflect new sub-processors, new features, or legal developments. When the changes are substantial, we notify you by email and/or via an in-app notification at least 30 days before they take effect. The current version is always available at https://timistories.com/privacy.

What changed on 6 October 2026 (version 1.2):

The timistories.com website now measures its traffic with PostHog, without cookies and without profiles (section 13).
New data category: the Android launch alert (your email, for a single message on launch day), with its legal basis and retention period (sections 3, 4 and 11).

These changes only concern the website and do not change how the app uses your data.

What changed on 1 October 2026 (version 1.1):

New section 7 on religious or philosophical beliefs: an optional feature; nothing is stored without your explicit consent.
Clarifications about our sub-processors (section 8): OpenAI also runs our automated content-safety check, and ElevenLabs receives the story text when you pick a “Signature” voice.
Former sections 7 to 14 are now sections 8 to 15.

These changes do not alter how we use the data you have already entrusted to us.

15. Contact

For any question relating to your personal data:

ILAD DIGITAL AGENCY - FZCO IFZA Business Park, Premises 56908-001, Building A1 Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE Privacy: privacy@timistories.com General support: support@timistories.com Legal: legal@timistories.com

Audience measurement

Your visits are counted anonymously (section 13).

Privacy Policy