Oolie — Privacy Policy

Effective date: 12 April 2026

Version: [VERSION]

1. Introduction and scope

This Privacy Policy explains how [PUBLISHER LEGAL NAME] ("we", "us", "Oolie") collects, uses, shares, and protects personal information when you use the Oolie mobile application for iOS (the "App") and the related website at [WEBSITE URL] (together, the "Service").

Oolie creates personalized AI bedtime stories for children. The App is designed to be set up and operated by a parent or legal guardian on behalf of their child. This policy is written with parents in mind, in plain language first, and applies worldwide.

By using the Service you acknowledge that you have read this policy. If you do not agree with it, please do not use the Service.

2. Who we are

The data controller responsible for your personal information is:

• Legal name: [PUBLISHER LEGAL NAME]
• Address: [PUBLISHER ADDRESS]
• Country: [PUBLISHER COUNTRY]
• General contact: furlanpaolo90@gmail.com
• Privacy contact: furlanpaolo90@gmail.com
• EU representative (if applicable): [EU REPRESENTATIVE]
• UK representative (if applicable): [UK REPRESENTATIVE]

3. Information we collect

We collect only the information we need to run the Service. Below is a full breakdown by category.

a. Parent account information

• Email address used to create the account
• Sign in with Apple identifier and authentication tokens, if you choose that sign-in method
• Account creation date, last sign-in time, and basic account status

b. Child profile information entered by the parent

• Child's first name (no last name is required)
• Child's age or age range
• Interests, favourite themes, and favourite characters selected by the parent

We do not ask for the child's surname, contact details, school, address, or any other direct identifier. All child profile data is entered by the parent, not by the child.

c. Child photos and voice recordings

• Photos: If a parent chooses to upload a photo of their child, we use it solely to generate cartoon-style illustrations in which the child appears as the story's protagonist. Photos are stored in Firebase Storage on the parent's account.
• Voice recordings: If a parent chooses to record their own voice for narration, those recordings are stored on the parent's account and associated with their profile.

Photo uploads and voice recordings are optional. You can delete them at any time from within the App.

d. Generated stories and illustrations

We store the stories and images that the Service generates for your family, together with the prompts used to create them, so that you can replay them and so that we can diagnose problems. Generated content is linked to the child profile for which it was created.

e. Subscription and billing information

All purchases are handled by Apple through the App Store and StoreKit. We do not receive or store your credit card number, billing address, or other payment credentials. We receive from Apple only the subscription status (active, lapsed, trial, tier) required to unlock paid features.

f. Device and usage data

• Device model, operating system version, language, and locale
• App version
• Anonymous usage events (for example, "story generated", "voice changed") collected through Firebase Analytics when enabled
• Approximate region derived from IP address for service performance and abuse prevention

We do not use persistent advertising identifiers, we do not build behavioural advertising profiles, and we do not track users across third-party apps or websites.

g. Crash and diagnostic data

If enabled, Firebase Crashlytics collects anonymous crash reports and technical diagnostics (stack traces, device state at the time of the crash) so we can fix bugs.

4. How we use information

We use the information described above to:

• Generate personalized stories, illustrations, and narration tailored to the child profile you created
• Authenticate your account and keep it secure
• Deliver and manage your subscription, including unlocking premium features
• Sync your story library across your devices and back it up
• Respond to your support requests
• Diagnose crashes and improve reliability and performance
• Protect the Service from fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

We do not use child profile data, child photos, or voice recordings to train third-party public AI models, and we do not use them for advertising.

5. Legal basis for processing (EU/UK/EEA users)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract (Article 6(1)(b)) — to provide the Service you signed up for, including story generation, account management, and subscription delivery.
• Consent (Article 6(1)(a)) — for optional features such as uploading your child's photo, recording your voice, and for any analytics or diagnostics that require consent in your jurisdiction. You can withdraw consent at any time without affecting the lawfulness of processing that already took place.
• Legitimate interests (Article 6(1)(f)) — to keep the Service secure, prevent abuse, diagnose problems, and improve quality. We have balanced these interests against your rights.
• Legal obligation (Article 6(1)(c)) — to comply with applicable laws, including record-keeping and responding to lawful requests.

Because the Service relates to children, we also rely on the parent's or legal guardian's consent or authorization on behalf of the child where required (GDPR Article 8).

6. Children's privacy — COPPA notice

Oolie is intended to be set up and operated by a parent or legal guardian, and is used by children only with adult supervision. We take children's privacy extremely seriously and design the Service to collect as little information about children as possible.

What information about a child we collect

Only what the parent enters or uploads: the child's first name, age, interests, and — optionally — a photo and voice recording. We do not ask children for contact information, we do not enable children to post content publicly, and we do not allow children to communicate with strangers through the App.

We do not knowingly collect information directly from children

The App's account creation, photo upload, voice recording, and subscription flows are designed for a parent. If we learn that we have collected personal information directly from a child under [CHILDREN'S AGE THRESHOLD] without verifiable parental consent, we will delete that information promptly.

No targeted advertising; no profiling for ads

We do not serve targeted or behavioural advertising in the App. We do not build advertising profiles about children. We do not share child data with ad networks. We do not sell child data.

Verifiable parental consent

Before any child profile is created, photo is uploaded, voice is recorded, or premium feature is used, a parent must create an account and confirm that they are the child's parent or legal guardian. For paid features, completing an App Store purchase through the parent's Apple ID provides an additional verification signal consistent with the COPPA Rule. Where your jurisdiction requires a stronger form of verifiable parental consent, we will implement and apply that stronger method.

Parent rights

As a parent or legal guardian, you have the right to:

• Review the personal information we have collected about your child
• Ask us to delete your child's personal information
• Refuse further collection or use of your child's personal information
• Withdraw consent you previously gave

To exercise any of these rights, email furlanpaolo90@gmail.com from the email address associated with your account. We will respond within the time required by law and in any event without undue delay.

7. How we share information

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We share information only with the service providers ("sub-processors") needed to run the Service, under contracts that restrict their use of the data to providing their service to us.

• Apple Inc. — App Store distribution, Sign in with Apple, StoreKit subscription processing, on-device text-to-speech. Apple's own privacy policy applies to the data it processes.
• Google LLC (Firebase) — Authentication, Firestore database, Cloud Storage (photos, voice recordings), Cloud Functions (backend orchestration), Analytics, and Crashlytics.
• OpenAI, L.L.C. — Generation of story text and illustrations based on the prompts and child profile data needed for that generation. Inputs and outputs are sent to OpenAI's API. We use OpenAI's API offering, which is governed by contractual terms that prohibit using API inputs to train general-purpose models.
• ElevenLabs, Inc. — Premium AI voice synthesis for narration of generated stories, for users who opt into that feature.

We may also disclose information when required by law, to protect the rights or safety of users or the public, to enforce our Terms, or in connection with a corporate transaction such as a merger or sale, in which case we will require the recipient to honour this policy or notify affected users.

8. International data transfers

Our sub-processors operate servers in the United States and other countries. This means your personal information may be transferred to and processed outside your country of residence, including in jurisdictions whose data protection laws differ from your own.

Where personal data of EU, EEA, UK, or Swiss users is transferred outside those regions, we rely on lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum and the EU–US Data Privacy Framework. You can request a copy of the relevant safeguards by contacting us.

9. Data retention

We keep personal information only as long as we need it for the purposes described in this policy:

• Account data: for as long as your account is active.
• Child profile data, uploaded photos, voice recordings, and generated stories: until you delete them in-app, delete the relevant profile, or delete your account. When you delete your account we delete this data without undue delay, normally within 30 days, except where we are required to retain it by law.
• Subscription records: retained as long as required for accounting, tax, and consumer-protection purposes.
• Server and security logs: retained for up to 90 days unless needed longer to investigate a security incident.
• Crash diagnostics: retained per Firebase Crashlytics defaults.

10. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access — ask us what personal information we hold about you or your child
• Rectification — ask us to correct inaccurate information
• Erasure — ask us to delete your information
• Portability — ask us to provide your information in a machine-readable format
• Restriction and objection — ask us to limit or stop certain types of processing
• Withdraw consent — when processing is based on consent
• Complain to a supervisory authority — if you are in the EU, EEA, UK, or Switzerland, you may lodge a complaint with your national data protection authority

To exercise any of these rights, email furlanpaolo90@gmail.com. We may need to verify your identity before acting on your request. We will not discriminate against you for exercising your rights.

California residents — CCPA / CPRA notice

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you additional rights:

• The right to know what personal information we collect, use, disclose, and share about you
• The right to delete personal information we collected from you
• The right to correct inaccurate personal information
• The right to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined under the CCPA
• The right to limit the use of sensitive personal information
• The right to be free from discrimination for exercising your rights

To exercise these rights, email furlanpaolo90@gmail.com. You may designate an authorized agent to act on your behalf, subject to verification.

11. Security

We use industry-standard safeguards to protect your information:

• Encryption in transit using TLS
• Encryption at rest via Firebase infrastructure
• Access controls and the principle of least privilege for anyone who operates the Service
• Secret management for API keys and credentials
• Monitoring and incident response procedures

No online service can be guaranteed 100% secure. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as required by law.

12. Cookies and tracking

The Oolie iOS app itself does not use web cookies. The App uses only the minimum local storage needed to run — for example, iOS UserDefaults to remember your preferences and library.

Our website at [WEBSITE URL] may use strictly functional storage to serve pages. It does not use advertising cookies or cross-site tracking technologies. Where required by law, we will request your consent before setting any non-essential storage.

13. Third-party links

The Service may contain links to third-party websites or services. We are not responsible for their content or privacy practices. We encourage you to read their privacy policies before providing them with personal information.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" and, where required by law, we will notify you in-app or by email before the changes take effect. Continued use of the Service after an update constitutes acceptance of the updated policy.

15. How to contact us

For any privacy question, request, or complaint:

• Email: furlanpaolo90@gmail.com
• General support: furlanpaolo90@gmail.com
• Postal address: [PUBLISHER LEGAL NAME], [PUBLISHER ADDRESS], [PUBLISHER COUNTRY]

16. Effective date and version

This Privacy Policy is effective as of 12 April 2026. Document version: [VERSION].