Privacy Policy

Last Updated: January 27, 2025

WonderTale (the "App") is operated and provided by Dreamoa ("we", "us", or the "Company"). This Privacy Policy explains how Dreamoa collects, uses, and protects your information when you use the App.

1. Information We Collect

From Parents/Guardians:

• Account Information: Email address, password, billing information
• Payment Information: Processed securely through the Apple App Store or Google Play (we do not store credit card details)
• Contact Information: For customer support and important notifications

From Children (with parental consent):

• Voice Recordings: Temporary recordings for story interaction (deleted after processing)
• Story Preferences: Favorite themes, characters, and topics to personalize content
• Progress Data: Reading level, completed stories, and learning milestones
• App Usage: Features used, time spent, and interaction patterns

Automatically Collected:

• Device Information: Device type, operating system, app version
• Usage Analytics: App performance, crash reports (anonymized)
• IP Address: For security and technical support purposes only

2. How We Use Information

We use collected information to:

• Provide and improve the WonderTale service
• Personalize stories and content for each child
• Track learning progress and provide reports to parents
• Process payments and manage subscriptions
• Provide customer support
• Ensure the safety and security of our platform
• Comply with legal obligations

3. Information Sharing & Disclosure

We do not sell, rent, or share personal information about children for marketing purposes.

We may share information only in these limited cases:

• Service Providers: Trusted partners who help us operate the service:
  • Apple App Store and Google Play for in-app subscription processing
  • OpenAI for speech-to-text (STT), story generation, text-to-speech narration, and content moderation (voice data immediately deleted after processing)
  • Replicate for AI image generation
  • Supabase for secure cloud hosting and database
• Legal Requirements: When required by law or to protect safety
• Business Transfers: In the event of a merger or acquisition (with continued privacy protections)
• Parental Request: With parents when they request their child's information

4. COPPA Compliance

WonderTale complies with the Children's Online Privacy Protection Act (COPPA). Key protections include:

How We Obtain Parental Consent:

• App Store Verification: Parents confirm consent by completing an in-app purchase (including starting a free trial) through the Apple App Store or Google Play — an FTC-approved method that verifies the consenting adult
• Clear Notice: We provide detailed information about what data we collect and how we use it
• Withdrawal Rights: Parents can withdraw consent at any time through app settings or by contacting us
• Re-consent for Material Changes: We notify parents and obtain new consent if we make significant changes to our data practices

Parental Rights:

• Review personal information collected from their child
• Request deletion of their child's personal information
• Refuse to permit further collection or use of their child's information
• Access and download their child's data

Data Minimization:

• We collect only information reasonably necessary for the activity
• We do not require children to disclose more information than necessary
• Voice recordings are processed immediately and deleted

5. GDPR Compliance

For users in the European Union, we comply with GDPR:

Your Rights:

• Right to Access: Request a copy of personal information we hold
• Right to Rectification: Correct inaccurate personal information
• Right to Erasure: Request deletion of personal information
• Right to Portability: Receive personal information in a structured format
• Right to Object: Object to processing of personal information
• Right to Restriction: Request restriction of processing

Legal Basis for Processing:

• Contract Performance: To provide the WonderTale service
• Legitimate Interest: To improve our service and ensure security
• Consent: For marketing communications (adults only)
• Legal Obligation: To comply with applicable laws

6. Data Security

We implement robust security measures to protect personal information:

• Encryption: All data is encrypted in transit and at rest
• Access Controls: Limited access on a need-to-know basis
• Regular Audits: Security assessments and vulnerability testing
• Secure Infrastructure: Industry-standard cloud security practices
• Staff Training: Regular privacy and security training for all employees

7. Data Retention

We retain personal information only as long as necessary:

• Account Data: Until account deletion or legal requirements
• Voice Recordings: Deleted immediately after processing
• Usage Analytics: Anonymized after 12 months
• Payment Records: As required by law and payment processor policies
• Support Communications: 3 years for quality assurance

8. Third-Party Services

We use trusted third-party services that comply with privacy laws:

• Apple App Store & Google Play: In-app subscription processing
• Cloud Hosting: Secure data storage and processing
• Analytics: App performance monitoring (anonymized data only)

9. International Data Transfers

If you are located outside the United States, your information may be transferred to and processed in the U.S. We ensure appropriate safeguards are in place for international data transfers.

10. Your Choices & Controls

• Account Settings: Manage privacy preferences in your account
• Data Download: Request a copy of your data
• Account Deletion: Delete your account and associated data
• Communication Preferences: Opt-out of non-essential communications

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated through email or in-app notifications.

12. Contact Us

For privacy-related questions, data requests, or to exercise your rights: