Privacy policy
Last updated: October 25, 2026 · Version 2026-10-25
This policy explains what data we process, why, and how you stay in control of it.
Your data, in short
Child Fiction is built for children. About your children, we collect only what we need to write their stories, and nothing more.
- The bare minimum about your children
- A first name or nickname, the year (and, if you wish, the month) of birth and a grammatical gender. Never a last name, a full date of birth, a school or an address.
- Optional, short-lived photos
- A photo is only used to draw a character who looks like your loved one. Its metadata, including GPS location, is removed on upload. It is analyzed by a trusted partner that only extracts appearance details from it. It is stored privately, then deleted as soon as the character is ready, unless you choose to keep it.
- No training on your children’s data
- Your family’s information and photos are never used to train artificial intelligence, neither by us nor by the companies whose services we use.
- Nothing is shared without your consent
- A story is only visible outside your family if you create its share link, which you can turn off at any time. Photos of your loved ones are never sent to an illustration service without your explicit consent, which is off by default.
- You stay in control
- You can change your consents at any time. You can delete a character, a child profile or your whole account: the related stories, voices and photos are then erased.
- Protected data
- Each family’s data is kept separate, files are stored privately and can only be reached through temporary links. Sensitive actions are recorded in an audit log.
- Payments without your bank details
- Payments are made on Stripe’s secure page: we never see your card, and Stripe receives no information about your children.
- Limited, optional audience measurement
- No analytics tool is ever loaded in the family space or in child mode. On our public pages, audience measurement only runs if you accept it, and you can change your mind at any time.
- How you found Child Fiction
- At sign-up, we note the button you used, the campaign and first public page that brought you here, and the name of the site that referred you. This information helps us spread the word about Child Fiction, is never sent to Google and is deleted 25 months after sign-up.
1.Data controller
Weetool, which publishes Child Fiction (5 square de la Trémoille, 17200 Royan, France), is the controller of the processing described on this page. Questions about your data? Write to us at bonjour@childfiction.com.
2.Data we process
About you: email address, first name, language, password (stored in an encrypted, irreversible form) and the history of your consents. About your children: first name or nickname, year (and, if you wish, month) of birth, grammatical gender and parental settings. About characters: name, relationship to the child, description and, if you wish, a photo. Finally, the stories created, the choices made while watching and the viewing time. At sign-up, how you discovered Child Fiction: the sign-up button you used, the campaign parameters of the link you followed (utm), the first public page you visited and its language, and the name of the site that referred you to us (never the full address of the referring page). On the public pages, and only if you accept audience measurement: the pages viewed (without their parameters, except campaign ones), the referring page (its domain only), clicks on the sign-up buttons, starting the demo story on the home page, the choices made in it and reaching its end, the device and browser type, an approximate location (country, city) and a pseudonymous identifier stored in a cookie (your IP address is only used to infer the location and is not kept by Google Analytics). Technical data: your IP address is only used to protect accounts against abusive attempts (sign-in, sign-up) and is kept for about 24 hours; it is only stored for longer in an encrypted, irreversible form, in the log of sensitive actions and with your consents. The browser type is kept neither in the family space nor with the sign-up information. If you share a story through a link: that link, when it was created and how many times the story was watched through it, with nothing about the people who watch it. If you buy credits or the Family plan: your purchases (pack or plan, amount, date and payment status), when you asked to use your credits right away, and the billing emails owed to you. Your bank details are entered on Stripe’s page and are never sent to us.
3.Purposes
Running the service (creating stories, voices and characters, remembering adventures), securing accounts, applying your parental settings, sharing a story through a link when you ask for it, the limits of your plan and your credits, handling your payments and subscriptions and keeping our accounts, and sending you essential emails (address confirmation, password, warning before an inactive space is deleted, purchase confirmation, declined payment, reminder before a yearly plan renews). With your consent, measuring visits to our public pages to improve them. Finally, understanding, through overall statistics, how families discover Child Fiction (pages, campaigns, sites that mention us), to better choose where to spread the word.
4.Legal bases
Performance of the contract to run the service and sell the plans and credits. Compliance with our legal obligations for accounting and invoicing. Your consent for your children’s data and for photos (which you can change at any time in the settings), and for audience measurement on the public pages (which you can withdraw at any time with the “Manage cookies” link at the bottom of these pages). Our legitimate interest in keeping the service secure and in knowing how families find us; you can object to this last use at any time by writing to us.
5.Service partners
We rely on carefully chosen partners who do not use your data for their own purposes (except Stripe for payments, see below): application hosting (Vercel, Paris), database (Supabase, European Union), file storage (Cloudflare R2, European Union), character creation and photo analysis (Anthropic), voices (Google Cloud in the European Union, and ElevenLabs for stories whose voices were created with that service), the rest of stories created before October 25, 2026 (written by the partner that wrote the story, depending on our settings at the time: Anthropic, Google Cloud in the European Union, Mistral AI, through Vercel, or Alibaba Cloud, through Vercel, outside the European Union), emails (Resend) and payments (Stripe Payments Europe, in Ireland, which receives your email address and technical identifiers, never any information about your children). On its payment page, Stripe itself collects your payment details (card, name, country) and technical information (IP address, device); it also processes them for its own purposes, to prevent fraud and meet its legal obligations, as its privacy policy explains (stripe.com/privacy), and may transfer them to Stripe, Inc., in the United States, with the safeguards required by the GDPR (Data Privacy Framework, standard contractual clauses). Our stories are written in advance by our team, then filled in on our side with the first names and characters of your universe: no partner receives your child’s first name to write a story. To create the voices, Google Cloud receives the story’s text, first names included. For voices, as for the rest of older stories, these partners receive only text, never a photo. When you share a story through a link, anyone who has that link can watch it without an account, just as your child sees it: its title, the first names, the characters and the voices. Messaging apps that show a preview of the link receive its title and a short description naming the story’s hero. The link cannot be guessed and is not listed by search engines: only the people it was sent to can open it. When Mistral AI or Alibaba Cloud writes the rest of one of those stories, the request goes through Vercel, which keeps neither the request nor the response and passes it to that partner only under their zero data retention agreement. If you accept it, audience measurement of the public pages is handled by Google Ireland Limited (Google Analytics), acting on our behalf, with Google’s advertising features turned off (Google signals, ad personalization). It is never used in the family space, in child mode or in the admin area, and it never receives data from your account or about your children. When data leaves the European Union, the transfer is covered by the safeguards required by the GDPR; a transfer to Google LLC, in the United States, relies on the EU-U.S. Data Privacy Framework. Family photos are never sent to an illustration service without your explicit consent.
6.Retention
Your data is kept as long as your account exists. Reference photos are erased as soon as the character is ready, unless you choose to keep them. The log of sensitive actions is kept for 12 months. A shared story’s link stays active until you turn it off; it is erased when you turn it off, or when you archive or delete the story. When you delete a character, a child profile or your account, the corresponding data is erased, including stored files. An account whose email address was never confirmed is deleted after 7 days. A family space without any sign-in for 3 years is deleted with everything in it, after a warning email sent at least 30 days before: simply signing in keeps it. A space with a running plan or unused bought credits is never deleted for inactivity. Information on how you discovered Child Fiction is deleted 25 months after sign-up; if the account is deleted sooner, it is detached from it and only used for overall statistics. On the public pages, audience measurement data is kept for 14 months by Google Analytics, and its cookies for 13 months at most. Your cookie choice is kept for 6 months, after which we ask again. Information about your purchases is kept for 10 years, as the law requires for accounting records; if your account is deleted, it is detached from it. During a payment started while creating a story, your choices are kept in your browser tab, for 2 hours at most.
7.Your rights
You can access, correct and erase your data, restrict or object to a processing, withdraw a consent, ask for portability and set instructions on what happens to your data after your death. Most of these actions can be done directly in the settings; for anything else, write to us. You can withdraw your consent to audience measurement at any time with the “Manage cookies” link at the bottom of the public pages, and object, by writing to us, to the use of information on how you found us. You can also file a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr).