Privacy Policy

Last updated 14 August 2026 · Draft prepared for review by your legal adviser before launch.

What we collect

Your email, name and password (hashed); the personalisation details you enter for stories (names, interests, settings); optional child profiles (a first name and age band only); reading progress; purchase and subscription records; and technical logs.

Children's privacy (COPPA / GDPR-K)

Fablewinds accounts are held by adults. We do not knowingly collect personal information directly from children under 13 or under the age of digital consent in your country. Child profiles hold only a display name and an age band, entered by the parent or guardian, and can be deleted at any time. We do not use children's data for advertising or profiling.

Photos

A photo uploaded for hero likeness is sent to our AI provider solely to produce a short text description of appearance, then discarded. We store only the description.

How we use data

To generate and deliver your stories, audio and books; to process payments (via Stripe); to send service emails (receipts, invites, password resets); to keep the service safe; and to improve story quality. We do not sell personal data and do not use behavioural advertising.

Who we share it with

AI generation partners (Synap AI, Google Cloud) receive story inputs; Stripe processes payments; Mailgun delivers email; Google Cloud hosts our infrastructure in Australia; the print-on-demand partner (Lulu) receives the book files and the shipping address for printed orders.

Your rights

You can view and export your stories, delete child profiles, and delete your account from the account page. You may request access to or correction of your data, or lodge a complaint, by emailing hamish@flash13.com. EU/UK residents have rights under the GDPR; Australian residents under the Privacy Act 1988.

Retention and security

Stories are kept while your account exists. Deleting your account removes your identifying details immediately; anonymised records may be retained for accounting. Data is encrypted in transit and at rest.

Cookies

We use a single strictly-necessary session cookie and no tracking cookies.