Privacy policy

Bubby is a storytelling service for families. Accounts are for grown-ups 18 or older. Children do not create their own logins. If you add a child’s name or photo, you are the parent or legal guardian and you control that data.

What we promise

• We do not sell children’s information. We do not sell family data to anyone.
• We do not use children’s photos, names, voices, or stories to train AI models.
• We do not use this data for ads, retargeting, or a social feed.
• Photos go to our picture model only to paint your book, then we keep the painting in your library.
• You can review, export, or delete the household. Deletion is by request — in the app or by email.
• Quiz recordings are scored, then deleted. We do not keep the child’s voice clip.

What we keep

Your email, hashed password or sign-in provider, children’s first names, ages, photos you upload, companion photos, optional look notes, optional details you add about a child (what they love, favorites, a best friend’s first name), voice samples you choose to record, story text, illustrations, read-aloud audio, plan status, a grown-up PIN hash, and COPPA consent (date, policy version, your birth year). If Words to grow is on, we keep words a child taps while reading. We do not collect a child’s email, phone, contacts, precise location, or government ID. We do not need more than one photo and a first name to make a book.

How we use it

We use household data only to run Bubby for that household: write and illustrate stories, read them aloud, remember the library, bill the parent, keep Grown-ups locked, and fix bugs. We do not build marketing profiles of children.

Kids’ privacy (COPPA)

Bubby is directed at parents, not at children under 13 as account holders. Before we keep a child’s name or photo, a parent must confirm they are 18+, they are the parent or guardian, and they agree to this policy. That consent is stored with a date and version. We will ask again if this notice changes in a material way.

Hosting, Stripe (billing the parent only), Anthropic (writing stories), xAI (painting stories, and writing them when Anthropic is unavailable), and Inworld (reading stories aloud) are service providers. They process only what they need to run the product. Anthropic receives the child’s first name, age, and story wish, never photos or voices, and does not train on API data. xAI does not train on API inputs or outputs without permission — we do not grant that permission. By default they may keep API traffic about 30 days for abuse review. We turn on Zero Data Retention (ZDR) on our xAI team when the Console offers it, so prompts and photos are not kept on their side after the book is made.

Parents may review a child’s information, refuse further collection, and delete it. In the app: Grown-ups → Account (export or delete), or Grown-ups → Family & pets (remove one child). By email: support@bubby.ai or the form at /delete. We complete deletion requests as soon as we can, and within 30 days.

Optional share links are created only when a parent taps Share. Whoever has that link can see that story. That is the parent’s choice, not ours.

Printed books are made only when a parent orders one. Then that one book’s pages (its words and pictures) and the shipping name, address and phone number go to Lulu, our printer, only to print and ship it.

Who helps us

Hosting and database (so the app stays up), Stripe (web billing), Apple, Google Play, and RevenueCat (app store subscriptions; they see a purchase ID, never your child’s information), Apple Push Notification service and Firebase Cloud Messaging (“your book is ready” alerts), Anthropic (story writing), xAI (pictures and backup story writing), and Inworld (read-aloud voices, including a parent’s own voice when a parent records one; that voice is deleted when the parent switches back to a Bubby voice or deletes the account), and Lulu (printing and shipping a book a parent orders). We do not share children’s data with advertisers or data brokers.

How long we keep it

We keep household data while the account is open. After you delete the household, we erase children, photos, voices, stories, pages, practice words, and the login from our database. Backups fall away on the normal backup cycle. Generated copies you already saved (a screenshot, a print) stay on your devices. Stripe keeps the payment record they are required to keep.

Security

Passwords are hashed. The grown-up PIN is hashed. Photos and stories sit behind the parent login. No product is perfectly safe; we work to keep access limited to the household.

Your choices

Download a household JSON from Grown-ups → Account (names, titles, consent, and each kid’s photos). Delete a kid’s photos in Grown-ups → Kids. Delete a child or the whole household in that same page. Type DELETE to confirm. Or email support@bubby.ai / use Request deletion if you cannot log in.

Questions: support@bubby.ai