Data retention policy
What we collect about children and why, why we keep it, and when it’s deleted, as the COPPA Rule requires (16 CFR 312.10). Nothing is kept indefinitely. This policy is part of our privacy policy. The deletions below run automatically every day.
The timetable
| What | Why we collect it | Why we keep it | When it’s deleted |
|---|---|---|---|
| A child’s profile: first name or nickname, age (and birthday month, if given), pronouns (if given), favorite things, reading settings, topics to avoid, how they look (as the family describes or designs them) | To write stories at the right reading level, about the right child | The stories are made for them, every time a story is made | When the family deletes its account. A reader removed from the cast is hidden and kept only for the stories on the family’s shelf that star them, until the account is deleted. To delete one child or one story, email us at john@phantom-labs.com. |
| Characters a family adds (family members, friends, pets, imaginary friends): name, relation, age, how they look, what they love | To put them in stories | As long as they’re in the cast | Removing a character deletes their photos and paintings at once; their name and description stay only inside stories already made with them, until the account is deleted |
| Photos a family uploads to paint a character | To paint the character’s likeness | Only until the painting is made | 7 days after upload at the latest; at once when the family taps Delete photos now, switches photos off, gives the character a new look, or removes the character |
| Paintings of characters (including ones painted from a photo) | Every story’s pictures use them | As long as the character is in the cast | When the character is removed, or the account is deleted |
| Stories: the words, pictures and narration, what the child picked at each fork, and paths written ahead | They’re the family’s stories, to read again | Until the family deletes them | When the family deletes its account. To delete one child or one story, email us at john@phantom-labs.com. |
| A child’s own ideas (“My idea!”) that became part of a story | They’re part of that story | With the story | With the story |
| A child’s own ideas that didn’t (turned away by the safety check, declined by the storyteller, or that failed) | So the family’s grown-ups can see them (with help lines, for an idea that sounded like a child might be hurt) | 30 days, while the grown-ups can see them | The words are deleted after 30 days; only that there was an idea, and the categories the safety check named, stay with the story |
| Safety-check records: the categories a check named (never the words or the picture) | To spot patterns and keep the app safe | A year of history | After a year |
| Pictures a family reported | To review and fix them | A year of history | After a year (the picture itself is hidden at once) |
| Feedback a family sends (topics, and an optional note) | To improve the app | A year of history | After a year |
| AI cost records: counts and costs per story, no content | Billing and planning | Year-on-year comparisons | After 400 days |
| Consent records: what was agreed to, when, the notice’s words and vendors | To show what each family agreed to (and when they changed their mind) | While the account exists | With the account |
| Sign-in records: a random id for this phone’s sign-in, and, if the family saved the account, the Apple or Google account id or the email address (and a scrambled form of the password that can’t be turned back into it) | To keep the family signed in, and let the grown-up sign back in | While the account exists | With the account (a Sign in with Apple is also revoked with Apple) |
| Email sign-ins: for a family saved with an email, each sign-in, wrong password and new password (the account and when; never the password or where from) | Security | A year of history | After a year, or with the family |
| A grown-up’s recording of a story page | So it can play for your family | Until removed | With the story, when the page’s words change, when you take it off, or with the account |
| Purchases: the family’s subscription and credits | To give what was paid for | While the account exists | With the account (the customer record at RevenueCat too) |
| Analytics events (a random family id and what happened, no child details) | To see what works | Under our project’s retention setting | PostHog keeps events (no child details) under our project’s retention setting; they aren’t yet deleted when a family deletes its account. |
Families who stop using the app
- Not saved with Apple, Google, or an email and password: the family lives on one phone’s sign-in, which ends after 90 days without opening the app. Nobody can open the family again after that, so everything is deleted 95 days after the app was last opened.
- Any family without a subscription: everything is deleted 400 days after the app was last opened.
- Switching a phone to a family saved with Apple, Google, or an email and password deletes what was on the phone before (the grown-up is told first), except while it has a subscription of its own.
Deleting on request
- Delete account (Settings → Your family’s account) deletes everything at once from our servers: every child, character, photo, painting, story, idea, consent, sign-in and purchase record. The RevenueCat customer record is deleted, and a Sign in with Apple is revoked. What the app kept on the phone (recordings, pictures, photo copies, the family’s settings) is deleted too. A subscription itself is cancelled by the parent with Apple or Google.
- Delete photos now (Settings → Privacy) deletes every photo at once.
- Anything else, or a copy of what we keep: john@phantom-labs.com, answered within 30 days, after checking the request comes from the family (the app sends the family’s reference with the email).
At our vendors
- OpenAI: Zero Data Retention is not yet granted. Until then, OpenAI may keep API requests up to 30 days for abuse monitoring, then deletes them.
- Convex stores our data and deletes it when we do, plus Convex’s backups.
- RevenueCat and PostHog: see our vendor list.
Review
The security coordinator reviews this policy at least once a year, and whenever we collect something new or keep something longer. Last reviewed: October 22, 2026.