Privacy Policy

Last updated: 28 September 2026. Applies to new accounts from this date. For existing account holders, this Policy takes effect on 12 October 2026.

Tale Twirlers is a storytime service for families, operated by Pondr Group Pty Ltd trading as Tale Twirlers (ABN 33 600 151 513, ACN 600 151 513) of Unit 501, 4–6 Gold Street, Collingwood VIC 3066, Australia ("Tale Twirlers", "we", "our", "us").

This Privacy Policy explains what personal information we collect through the Tale Twirlers native app for iPhone and iPad, the website at taletwirlers.com, and everything connected to them (together, the "Service"), how we use it, who we share it with, and the choices and rights you have. It applies wherever in the world you use the Service.

We've written it to be read, not skimmed past. Each section starts with a plain-English summary; if the summary and the full text ever differ, the full text applies.

1. The Short Version

If you only read one section, read this one.

• The account belongs to a grown-up. You create the account, you're the person whose information we hold, and your child uses Tale Twirlers through your account.
• We don't collect information about your child. No name, no age, no photos, no voice, no location. When your child reads or creates a story, we record which story and which choices, against your account, so we can save their place and sync across devices.
• No ads. There's no advertising in Tale Twirlers and no third-party trackers of any kind in the app (Apple's own App Store ad attribution is explained in section 5). We never sell personal information, and the only advertising we ever measure or run is for Tale Twirlers itself.
• Analytics, but carefully. We use PostHog to understand how Tale Twirlers is used so we can make it better. It runs on our servers, not inside the app, and it's configured for that purpose only. Our website uses Google Analytics and the Meta Pixel, and neither sets a cookie until you've said yes.
• The AI tools that help us make stories never see your data. Stories are written, illustrated and narrated before they reach the library. Nothing about you or your child is ever sent to the AI tools we use.
• Payments are handled by Apple and Stripe. We never see or store your card details.
• Your data lives in Australia, with some service providers in the United States. Section 8 explains how we protect it when it travels.
• You're in control. You can access, correct or delete your information at any time. Section 10 explains how.

2. Who This Service Is For, and Whose Data We Hold

In short: Tale Twirlers is for children, with a parent or guardian. The account holder is an adult, and the personal information we hold is the account holder's.

Tale Twirlers is designed for children aged roughly 3 to 7 to enjoy with a parent or guardian. Our stories are for children; our accounts are for adults.

This matters for privacy. Under our Terms of Service, you must be at least 18 to create an account, and you confirm you're the parent or guardian of any child using it. That means:

• You are the person whose personal information we hold. Your email address, your account, your purchases, your reading activity.
• Your child does not have their own account, profile or identity in Tale Twirlers. We don't ask for, and the Service has no field for, a child's name, age, birthday, gender, photo, voice or any other detail about them.
• When your child uses the Service, their activity is recorded against your account: which story was opened, which path was chosen, which character, place and adventure were picked to create a story. We need this to save their place, deliver the created story, and sync between your iPhone, iPad and the web. We don't use it to build a profile of your child.

We've designed Tale Twirlers so that a child never types anything in. There's no free-text input, no chat, no open prompting. Every story your child can read or create was written and reviewed before they saw it. This is a content-safety decision first, but it also means there's no way for a child to accidentally give us personal information.

We can't verify the age of the person who signs up. If we become aware that an account has been created by someone under 18, we'll delete the account and its data.

We take our obligations to children seriously under the laws that apply to us, including the Australian Privacy Act, the US Children's Online Privacy Protection Act (COPPA), the UK GDPR and Age Appropriate Design Code, the EU GDPR, and Canadian privacy law. If you have any concern about your child's privacy in Tale Twirlers, email hello@taletwirlers.com and we'll respond personally.

3. What We Collect

In short: what you give us when you sign up, what happens in your account, how the app and website are performing, and payment status from Apple or Stripe.

3.1 Information you give us

Account details. When you sign up we collect your email address and, if you sign in with Apple or Google, the name and email address they share with us, along with the account identifier they use to recognise you. If you use Apple's "Hide My Email," we receive Apple's relay address instead of your real one, and that's fine. If you sign up with email, we also store your password in hashed form, so we can't see it. We record which sign-in method you used, when you last used the Service, and which page or story you were on when you signed up.

Onboarding answer. During sign-up we ask what brings you to Tale Twirlers, with a few options to choose from. This is about you, not your child. We use it to understand why families come to us.

Support and correspondence. If you email us, we keep the correspondence so we can help you and refer back to it.

Marketing preference. Whether you've asked to hear from us about new stories and updates (section 6). If you opt in, we keep a record of when and where you did so, including your IP address at the time, so we can show that you agreed.

3.2 Information created as you use the Service

Reading and creation activity. Stories opened, choices made, reading progress, how many times a story has been finished, favourites, your answer to "Parents, how was this story?" at the end of a story, and the character, place and adventure selected when a story is created. Created stories are saved to your account.

Orbs and membership. Your Orb balance and history, your membership status and plan, trial status, and renewal dates. This is managed for us by RevenueCat, which receives purchase confirmations from Apple (for app purchases) or Stripe (for web purchases) and keeps your membership in sync across platforms. We never receive or store your card number or bank details. Apple and Stripe handle those under their own privacy policies.

3.3 Information collected automatically

Server logs. When the app or your browser talks to our servers, Cloudflare and our hosting record standard request details (your IP address, the time, and information like app version or browser type), which we use to keep the Service secure and diagnose problems. Our application logs are stored separately and may contain a pseudonymous account identifier, but not your name or email address. The app itself contains no analytics or tracking software.

Push notifications. If you choose to turn on notifications, we store a notification token for your device and whether notifications are enabled, so we can send you the notifications you've asked for (section 6). You can turn these off at any time in your device settings.

Analytics events. How Tale Twirlers is used: stories started and finished, features used, memberships started, where people get stuck. These events are generated on our servers and sent to PostHog under a pseudonymous account identifier. Section 5 explains how this is configured.

Cookies (website only). Small files stored in your browser. Section 9 explains what they do and how to control them.

3.4 What we don't collect

To be explicit: we don't collect your child's name, age or any details about them; photos or camera access; voice or microphone recordings; precise location; your contacts; or anything from other apps on your device. We don't ask for your date of birth, your address (except as part of payment processing by Apple or Stripe), or your phone number.

4. How We Use Your Information

In short: to run Tale Twirlers, keep it working, keep it fair, improve it, and stay in touch when you've asked us to.

Where we rely on legitimate interests, we've weighed those interests against your rights and are confident the processing is proportionate. You can object at any time (section 10).

We do not sell personal information, share it with data brokers, use it to show you other companies' advertising, or use it to make automated decisions that have a legal or similarly significant effect on you. We do not build profiles of children.

5. Analytics and Tracking

In short: PostHog for product analytics, run from our servers, not the app. Google Analytics and the Meta Pixel on our website, and neither sets a cookie until you've agreed. Nothing third-party in the app.

5.1 In the app

We use PostHog for product analytics, recording events like "story started," "story finished," "membership started," "story created", so we can see how Tale Twirlers is being used and where it needs work.

The app itself contains no analytics software. Analytics events are generated on our own servers and sent to PostHog from there. PostHog is configured to support the operation and improvement of the Service only. Specifically:

• Events are linked to a pseudonymous internal account identifier, never your name or email address.
• There is no session recording and no capture of what's on screen or what's typed.
• IP addresses are partially masked before they're stored.
• It is not used for advertising, and analytics data is never shared with advertising networks.
• It does not track you across other apps or websites.
• No third-party advertising or attribution SDKs are included in the app.

Our own App Store ads. If you install the app after tapping one of our ads on the App Store, Apple's AdServices framework may tell us which campaign or keyword led to the install. This is Apple's own first-party attribution: it doesn't track you across other apps or websites, and it tells us nothing about you beyond which ad you tapped. We record it against your account and share it with RevenueCat so we can see which campaigns lead to memberships. It is never shared with any other advertising platform.

Because children use the app through your account, this configuration is important: it's what allows us to run analytics in a service children use without collecting personal information from them for anything beyond running the Service itself.

We also receive aggregated App Store analytics from Apple (installs, crashes, performance). Apple only shares this for users who've opted in to sharing analytics with developers in their iOS settings.

5.2 On the website

Our website uses two third-party tools, and both wait for your permission where the law requires it:

• Google Analytics (loaded through Google Tag Manager) helps us understand how visitors find and use the site: which pages people arrive on, what they read, and where they get stuck.
• Meta Pixel helps us measure our own advertising on Meta platforms (Facebook and Instagram) and, if you've consented, lets us show our ads to people who've visited our website. It runs only for visitors who aren't logged in.

Both tools run across the website, including story pages. Neither sets a cookie or attaches any identifier to you until you've agreed to cookies through our banner. Until then, Google receives only an anonymous, cookieless signal that a page was loaded, which isn't linked to you. You can change your choices at any time via "Cookie Settings" in the site footer, and we honour Global Privacy Control browser signals as a "decline."

We don't use any other advertising or conversion-tracking tools on the website. If we add server-side conversion measurement in future (sending a signal to an advertising platform when someone signs up or subscribes, so we can see which ads work), we'll update this policy first, and it will only ever be used to measure ads for Tale Twirlers itself.

Google and Meta act as independent companies here, not just as our service providers. When you consent to these tools, Google and Meta also receive the data under their own privacy policies and may use it for their own purposes. That's why they aren't listed in the service-provider table in section 7 for this activity. You can read their policies at policies.google.com/privacy and facebook.com/privacy/policy.

Under some US state laws, sharing information with advertising platforms in this way may count as "sharing" personal information for cross-context advertising. You can opt out via Cookie Settings, and Global Privacy Control does this automatically.

None of this applies to the app. The app contains no Google, Meta or other third-party tracking of any kind.

6. Emails We Send

In short: we'll always email you about your account. We'll only email you about new stories if you've asked us to.

Service emails are part of running your account: welcome and verification emails, receipts and renewal reminders, trial-ending notices, changes to our terms, deletion confirmations. You can't opt out of these while you have an account, because they're how we tell you things you need to know.

Story news (new stories, features and the occasional surprise) is sent only if you've opted in. Every one has an unsubscribe link, and you can also change your preference in your account settings. Unsubscribing doesn't affect your account or membership.

We send emails using SendGrid, which processes your email address on our behalf.

Push notifications work the same way, and we only send them if you've turned them on: reminders about your trial or account, and news about new stories. You can turn them off at any time in your device settings.

7. Who We Share Information With

In short: the companies that help us run Tale Twirlers, under contracts that limit what they can do with it. Never advertisers or data brokers. Never sold.

We share personal information with service providers who process it on our behalf and only for the purposes we specify. Each is bound by contract to protect your information and use it only to provide their service to us.

A note on AI. We use AI tools from Anthropic, Google and OpenAI to help write, illustrate and narrate stories. This happens entirely before a story reaches the library. No information about you, your child, your account or your child's story choices is ever sent to these AI services, so they aren't listed above for that purpose. (Google also provides our sign-in and website analytics, listed in the table; that's separate from its AI tools.)

We may also share information:

• When the law requires it: to comply with a legal obligation, court order or lawful request from a public authority, or to protect the rights, safety or property of Tale Twirlers, our users or others.
• If Tale Twirlers changes hands: if we're acquired or merge with another business, your information may transfer to the new owner. We'd tell you beforehand, and this Privacy Policy would continue to apply to your information until you're told otherwise.

We don't share personal information with advertisers, data brokers or anyone else for their own purposes.

8. Where Your Data Lives, and How Long We Keep It

In short: stored in Australia. Some providers are in the US, with legal safeguards in place. We keep your information while you have an account, and delete it when you leave.

8.1 Location and international transfers

Your account data and created stories are stored on servers in Sydney, Australia. Some of our service providers (section 7) process data in the United States or through global networks.

If you're in the EU or UK, this means your personal information is transferred outside the EEA/UK. Australia and the United States aren't automatically recognised as providing equivalent protection, so we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our providers, plus the EU–US Data Privacy Framework where a provider is certified under it. You can ask us for details of the safeguards we use.

If you're in Australia, we take reasonable steps to ensure overseas recipients handle your information in a way consistent with the Australian Privacy Principles.

8.2 How long we keep it

• Account information, created stories and activity: for as long as your account exists, then deleted within 30 days of your deletion request (section 8.3). Our encrypted backups rotate every 7 days, so every copy is gone within 37 days of your request at the latest.
• Server and security logs: 3 days.
• Transaction records: kept for at least 7 years after the transaction. This is a legal requirement under Australian tax and corporate law, not a choice we make.
• Analytics data: PostHog event data is retained for one year and is pseudonymous throughout.
• Support correspondence: for 2 years after the last contact, so we can help with any follow-up.
• Marketing preferences: if you unsubscribe, we keep a record of that so we don't email you again.

8.3 Deleting your account

You can request deletion of your account from account settings in the app or on the website. Our team actions deletion requests rather than processing them instantly. This protects families from a child accidentally deleting the account and all its stories. We complete deletion within 30 days and confirm by email.

Once your account is deleted, your account details, created stories, activity and notification tokens are permanently removed, your customer record with RevenueCat (membership status and Orb balance) is deleted, and any web membership is cancelled. If you subscribed through Apple, you'll also need to cancel that subscription in your Apple ID settings, because Apple doesn't let us do it for you. We keep only what the law requires us to (transaction records) and what's needed to honour your choices (an unsubscribe record). Analytics data already collected remains pseudonymous and can no longer be linked to you.

9. Cookies and Similar Technologies (Website)

In short: a few cookies to keep the site working and remember your choices; analytics and advertising cookies only if you allow them. Nothing in the app.

Our website uses:

• Essential cookies keep you logged in, remember your cookie choices, protect against fraud. These are necessary for the site to work and can't be turned off.
• Analytics cookies: Google Analytics, to understand how the site is used. Set only with your consent where the law requires it.
• Advertising cookies: Meta Pixel, to measure our own ads and reach visitors with them. Set only with your consent, and only for visitors who aren't logged in.

You can change your choices at any time via "Cookie Settings" in the site footer, or through your browser settings. If your browser sends a Global Privacy Control signal, we treat it as declining analytics and advertising cookies. Blocking essential cookies may stop parts of the site working.

The app doesn't use cookies.

10. Your Rights and Choices

In short: you can see, correct, download and delete your information, object to how we use it, and complain if you're unhappy. Email us and we'll help.

Wherever you live, you can ask us to:

• Access the personal information we hold about you;
• Correct anything that's inaccurate or out of date;
• Delete your account and personal information (section 8.3);
• Export your information in a portable format;
• Object to processing based on our legitimate interests, or ask us to restrict it;
• Withdraw consent where we rely on it (marketing emails or analytics cookies) at any time, without affecting anything that happened before.

To exercise any of these, email hello@taletwirlers.com from the email address on your account. We may need to verify it's really you before acting. We respond within 30 days, and there's no charge unless a request is clearly excessive or repetitive. If we can't do what you've asked, we'll tell you why.

10.1 If you're in Australia

The Privacy Act 1988 and the Australian Privacy Principles apply. If you're not satisfied with how we've handled a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

10.2 If you're in New Zealand

The Privacy Act 2020 applies. If you're not satisfied with how we've handled a complaint, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

10.3 If you're in the EU or UK

The GDPR or UK GDPR applies. You have the rights listed above, including the right to lodge a complaint with your local data protection authority. In the UK, the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to resolve your concern first. If you'd like a copy of the safeguards we use for international transfers, ask us.

10.4 If you're in the United States

Depending on your state, you may have rights to access, correct, delete and export your personal information and to opt out of its "sale" or "sharing" for targeted advertising. We don't sell personal information. You can opt out of sharing with advertising platforms via Cookie Settings on our website, and we honour Global Privacy Control browser signals. We don't discriminate against you for exercising your rights.

Because children use Tale Twirlers through a parent's account and we don't collect personal information from children beyond what's needed to run the Service, we operate within COPPA's provisions for the support of internal operations. If you believe we've collected information from a child in a way that's inconsistent with this Policy, email hello@taletwirlers.com and we'll investigate and delete it.

10.5 If you're in Canada

PIPEDA and applicable provincial laws (including Quebec's Law 25) apply. You have the rights listed above and can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or the Commission d'accès à l'information du Québec if you're in Quebec. Our Privacy Officer, Tale Twirlers, can be reached at hello@taletwirlers.com.

11. Security

In short: we protect your information with sensible, industry-standard measures. No system is perfect, and we'll tell you if something goes wrong.

We protect your information with encryption in transit and at rest, access controls so that only team members who need it can see it, secure hosting, and regular review of our practices. Passwords are hashed and never stored in readable form. Payment details never touch our systems.

No online service can guarantee absolute security. If a data breach ever affects your personal information in a way that's likely to cause you harm, we'll notify you and the relevant authorities as the law requires.

12. Links to Other Services

Our website and emails may link to other sites, like Apple's App Store, our social media pages, and so on. This Privacy Policy doesn't cover those services, and we're not responsible for their privacy practices. Check their policies before sharing information with them.

13. Changes to This Policy

In short: if we change how we handle your information in a way that matters, we'll tell you before it happens.

We may update this Privacy Policy as the Service evolves or the law changes. Minor updates, like clarifying wording or updating a provider's name, take effect when published. If we make a material change to what we collect or how we use it, we'll tell you at least 30 days before it takes effect, by email or in the app. The date at the top shows when this Policy was last updated, and earlier versions are available on request.

14. Contact Us

Questions, requests or concerns about your privacy, or your child's, can be sent to our Privacy Officer:

Pondr Group Pty Ltd trading as Tale Twirlers ABN 33 600 151 513 Unit 501, 4–6 Gold Street, Collingwood VIC 3066, Australia hello@taletwirlers.com

We usually reply within two business days and resolve privacy requests within 30 days.

© Pondr Group Pty Ltd trading as Tale Twirlers. All rights reserved.