Skip to content
Story SprinkleLog in

Story Sprinkle Privacy Policy

Summary

This Privacy Policy explains how Dnysus OÜ ("Story Sprinkle", "we", "us" or "our") collects, uses and shares personal data, and what data protection rights you have. It applies to the Story Sprinkle website (storysprinkle.com), the web app (app.storysprinkle.com) and the mobile app, and to your contact with us about them.

In short:

  • Story Sprinkle is for parents and guardians. Accounts are for adults. Children do not have accounts.
  • To make a story, you give us details about your child, such as a name, an age and story ideas, and a photo if you upload one.
  • Stories, pictures and narration are made by artificial intelligence (AI). To make them, we send the story details and any photo you upload to our AI provider, xAI, in the United States.
  • We ask for your consent first: once before your first story, and separately before you upload a photo of your child. You can withdraw your consent at any time in the web app (app.storysprinkle.com), in Account → Privacy.
  • Your stories are private unless you share them with a link.
  • We show no ads, and we do not use analytics or crash-reporting tools.
  • You can delete your account, and all data about your child that we hold, in the app or at storysprinkle.com/delete-account. For now, your e-mail address, name and sign-in details stay in our sign-in system after you delete your account (see "Data retention"). If you made a custom narrator voice with your own voice before November 2026, we delete your voice recordings and the story audio made with them too. About 119 older narration files may not be linked to an account, so they may not be removed; we are working to delete them (see "Data retention").

This Privacy Policy was last updated on 7 November 2026.

Who we are

The controller of your personal data is Dnysus OÜ, a company registered in Estonia (registry code 16003621, VAT number EE102331758), Akadeemia tee 68-70, 12614 Tallinn, Estonia. For any privacy question or request, write to [email protected].

General

Story Sprinkle is a service for creating children's stories. It uses AI to turn what you type into illustrated, narrated bedtime stories. We try to ask only for the data we need to create your stories and to run the service.

A parent or guardian creates every story and decides what details to give us. Children should enjoy Story Sprinkle together with a parent or guardian.

Children's Privacy

Story Sprinkle is designed for parents and guardians, and it is directed to them, not to children. Accounts are for adults only. We do not ask children for personal data, and we do not knowingly collect personal data directly from a child.

Stories are about children, so a parent or guardian gives us data about their child. Please note:

  • Give us data about a child only if you are the child's parent or legal guardian. Only a parent or legal guardian can give consent for a child.
  • You decide what to share. You can use a nickname instead of your child's real name.
  • Before you create your first story, the app asks for your consent to use your child's details and to send them to our AI provider. Without this consent, we cannot create stories. The consent step is in the web app. If you use the mobile app, open app.storysprinkle.com once, sign in with the same account and give your consent there.
  • If you upload a photo of your child, we use it to create an illustrated character (an avatar) that looks like your child. To draw the likeness, our AI provider writes a short description of the child's facial features (not ethnicity, identity or age). The photos are not used to train or fine-tune any AI model. We keep the photo in private storage. Before you upload a photo, the app asks for a separate consent. This consent is optional: you can create stories without a photo.
  • The story details you type and any photo you upload are sent to xAI in the United States to create the story (see "How we may share your information"). If you made a custom narrator voice before November 2026, the text of the stories read in that voice, which includes your child's name and story details, was also processed by our own AI engine, hosted for us by Microsoft Azure in the United States until May 2026 (see "How we use your information").
  • You can withdraw your consent at any time in the web app (app.storysprinkle.com), in Account → Privacy (see "Withdrawal of consent").
  • If you already had an account before we added the consent step, the app asks for your consent before your next story and before your next photo upload. Until you give consent, we do not send your child's details to xAI. We also do not send photos that you uploaded earlier to xAI until you give the consent for photos. Until then, we only store the stories and child profiles you already made, so that you can open them.
  • You can delete all data about your child that we hold at any time by deleting your account in the app or at storysprinkle.com/delete-account, or you can write to us.

If you believe that a child has given us personal data directly, or that someone has given us data about your child without your permission, write to [email protected] and we will delete it.

In the United States, the Children's Online Privacy Protection Act (COPPA) applies to online services that are directed to children under 13, or that knowingly collect personal information from children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected it, we will delete it.

What information we collect

  • Account data: your e-mail address and your password. If you sign in with Google or Apple, we receive the basic details that Google or Apple sends us to sign you in, such as your e-mail address.
  • Story data: what you type to create a story or to save a child profile (such as your child's name, age and story ideas), any photo you upload for an avatar, information derived from that photo (a short description of facial features and the avatar made from it), and the stories, pictures and audio created for you.
  • Voice recordings: only if you made a custom narrator voice before November 2026. These are the recordings of your own voice that you made for it. Our own AI engine used them to read stories aloud in your voice between June 2024 and August 2025. We shut the engine down on 26 May 2026. It kept no copy of your recordings and no voice model (see "Data retention"). Since 27 October 2026, those stories are read by a standard built-in voice from xAI. Your recordings are not sent to xAI, and we no longer use them. This feature is switched off. You cannot record a new narrator voice, and our servers do not accept new voice recordings.
  • Consent records: which consent you gave, the version of the text you agreed to, the language of your browser or app, the app you used, when you gave or withdrew it, and whether you chose to delete or keep your data.
  • Subscription data: your plan, your purchases and the status of your subscription. Card payments are handled by our payment providers, not by us.
  • Technical data: data that your device sends when it connects to our service, such as its IP address, and, in the mobile app, the device identifiers needed to deliver push notifications.
  • Messages: what you send us when you contact support.

We need your account data to give you an account, and the story details to create a story. Without them, we cannot provide those parts of the service. We also need your consent to use your child's details. Without it, we cannot create stories. A photo, and the consent for photos, are optional.

We do not ask for sensitive data, such as health information. Please do not put sensitive data about you or your child into your story ideas. Give only the details that the story needs. A photo can show personal features of your child, so upload one only if you are comfortable with that.

The web app uses cookies and similar storage to sign you in and to make the service work. Our sign-in system (auth.storysprinkle.com) sets session cookies to sign you in and to keep you signed in. These cookies are strictly necessary. During checkout on the web, our payment provider Stripe sets its own cookies (from m.stripe.com) to prevent fraud, and hCaptcha, a third-party service, runs to detect bots. These third-party cookies and checks are necessary for a secure payment. We do not use advertising or analytics cookies.

How we collect your information

We collect information directly from you when you create an account, create stories, buy a subscription or contact support. Data about your child comes from you. If you sign in with Google or Apple, we receive sign-in details from them. We receive the status of your purchases from Apple and from our payment providers.

How we use your information

Purposes and legal bases

We use your information for the purposes below. Each purpose has a legal basis under the General Data Protection Regulation (GDPR).

  • To provide the service to you: create your account, sign you in and manage your plan. This uses your own account data. Legal basis: our contract with you (GDPR Article 6(1)(b)).
  • To read stories in your own voice (custom narrator voice): only if you made a custom narrator voice before November 2026. You chose this feature as part of your account. We store the recordings of your own voice in our storage (Amazon Web Services, Canada). Our own AI engine used them to read your stories aloud in your voice between June 2024 and August 2025. We shut the engine down on 26 May 2026. This engine was our own system. It ran on servers hosted for us by Microsoft Azure in the United States. We did not send your recordings to any outside voice service. Only our own engine processed them. To narrate a page of a story, the engine received your voice recordings and the text of that page, which includes your child's name and story details. It cloned your voice for that request only, and it kept no copy of your recordings and no voice model. Since 27 October 2026, those stories are read by a standard built-in voice from xAI. Your recordings are not sent to xAI. We no longer make new narrator voices, and we no longer use your recordings. We keep them only until your account is deleted, or sooner if you ask us to delete them (see "Data retention"). Legal basis for your voice recordings: our contract with you (Article 6(1)(b)). Legal basis for the story text with your child's details: your consent as the child's parent or legal guardian (Article 6(1)(a)). This is the same consent as for creating stories (see the next point).
  • To create stories about your child: we use the details that you give us about your child to create, store and show the stories, pictures and audio you ask for. To create them, we send these details to our AI provider, xAI, in the United States. If you made a custom narrator voice before November 2026, our own AI engine also received the text of the stories it read in your voice (see the point above). Legal basis: your consent as the child's parent or legal guardian (Article 6(1)(a)). The app asks for this consent before your first story. Without it, we cannot create stories. Because this data is about a child, we keep it private, and it is deleted from our systems when you delete your account (backup copies expire later, see "Data retention"). You decide what to give us, and you can withdraw your consent at any time (see "Withdrawal of consent").
  • To use photos of your child: if you upload a photo, we send it to xAI. xAI writes a short description of the child's facial features, draws the avatar, and uses the photo to draw your child in story pictures. We store the photo, the description and the avatar. Legal basis: your separate consent as the child's parent or legal guardian (Article 6(1)(a)). The app asks for it before you upload a photo. This consent is optional, and you can withdraw it at any time.
  • To keep a record of your consent: we record which consent you gave, the version of the text, and when you gave or withdrew it. Legal basis: our legal obligation to be able to show that you gave consent (Article 6(1)(c), with Article 7(1)).
  • To take payments and keep accounting records. Legal basis: our contract with you and our legal obligations (Article 6(1)(b) and 6(1)(c)).
  • To send you service messages: e-mails about your account, security and purchases. Legal basis: our contract with you. The mobile app shows push notifications only if you allow them on your device. Legal basis: your consent (Article 6(1)(a)).
  • To answer you when you ask for help or send feedback. Legal basis: our contract with you and our legitimate interest in supporting our users.
  • To keep the service safe: keep security logs, prevent misuse and fraud, find and fix errors, enforce our terms and defend legal claims. Legal basis: our legitimate interest in a safe and working service (Article 6(1)(f)).
  • News and offers: if we send news or offers about Story Sprinkle, we send them only if you agreed to receive them. Legal basis: your consent. You can unsubscribe at any time.

We do not sell personal data. We do not use personal data for advertising. We do not make decisions about you or your child that have legal or similarly significant effects by automated means alone.

Artificial intelligence

The stories, pictures and narration in Story Sprinkle are created by AI from what you provide. Our instructions to the AI forbid inappropriate content and match the vocabulary to the age of the child. We do not review what you type before it is sent to the AI. AI can make mistakes. We recommend that you read or listen to each story before you share it with your child.

How we may share your information

We share personal data with the service providers that help us run Story Sprinkle. They receive it so that they can provide their service to us. Where a provider processes personal data for us, we rely on that provider's data processing terms. Apple, Google, Stripe and hCaptcha also act under their own privacy policies.

  • xAI (United States): our AI provider (Grok). It creates the story text, the illustrations, the avatar pictures made from photos, and the narration. It receives the story details you type (such as your child's name, age and ideas) and any avatar photo you upload. We send your child's details to xAI on the basis of your consent, and photos on the basis of your separate consent for photos. From an avatar photo it writes a short description of facial features to draw the likeness; photos are not used for training. How long xAI keeps this data is governed by xAI's API data terms.
  • Microsoft Azure (United States): hosted the servers that ran our own AI engine until 26 May 2026. The engine was our own system and was operated by us. If you made a custom narrator voice before November 2026, this engine processed your voice recordings and the text of the stories it read in your voice, which includes your child's name and story details. It kept no copy of them and no voice model. The servers have been shut down, their storage no longer exists, and nothing remains on Microsoft Azure.
  • Amazon Web Services (Canada): stores stories, images, audio and avatar photos, and sends our e-mails.
  • DigitalOcean (United States): hosts our application servers and our database. Our sign-in system, which holds accounts and passwords, runs on these servers and is operated by us.
  • RevenueCat (United States): manages subscriptions and what your plan includes. For purchases on the web, it sends the receipt e-mail, which has the link to manage your subscription.
  • Stripe: processes card payments for purchases on the web, and sets cookies during checkout to prevent fraud.
  • hCaptcha: a third-party service that runs during checkout on the web to detect bots.
  • Apple: processes purchases made in the iOS app.
  • OneSignal: delivers push notifications in the mobile app.
  • Cloudflare: provides the domain name service (DNS) that directs your device to our servers.

If you choose to sign in with Google or Apple, that company learns that you sign in to Story Sprinkle.

We may also share your information:

  • If the law requires it, or to answer a lawful request from a public authority.
  • If it is necessary to enforce our terms, or to defend the rights, property and safety of Dnysus OÜ, our users or others.
  • During or in preparation for a business transaction such as a merger, an asset sale, financing or an acquisition. We will tell you if your data moves to a new controller.
  • With your consent or at your direction. For example, if you share a story with a link (storysprinkle.com/s/ followed by a code), anyone who has the link can open that story without signing in, until you turn the link off. You can turn the link off at any time. The shared page is read-only. It shows the story itself: the title, the text, the pictures and the narration. It does not show your child's profile details, your photos or what you typed to create the story. The story itself can still contain your child's name, and its pictures can show the character made from your child's photo. Shared pages are marked to tell search engines not to list them.

International data transfers

We are based in Estonia, in the European Union. Some of our providers process personal data outside the European Economic Area (EEA): in the United States (xAI, Microsoft Azure until May 2026, DigitalOcean, RevenueCat) and in Canada (Amazon Web Services). Stripe, hCaptcha, Apple, OneSignal and Cloudflare may also process data in the United States and in other countries.

When personal data is transferred outside the EEA, we use the safeguards that the providers' data processing terms provide, such as the European Commission's Standard Contractual Clauses, or an adequacy decision of the European Commission. An adequacy decision exists for Canada, where the recipient is a commercial organisation covered by Canada's privacy law (PIPEDA). Where UK data protection law applies, we rely on the equivalent UK safeguards that those terms provide. You can ask us for more information about these safeguards, and where to get a copy of them, at [email protected].

How we protect your information

Your stories, images, audio and photos are kept in private, encrypted storage. The storage accepts encrypted (TLS) connections only, and files open signed links that expire after a short time. No system is perfectly secure. If a data breach is likely to put you at high risk, we will tell you as the law requires.

Data retention

  • Account and story data, including all data about your child and any photos: we keep your account data while you have an account, and your stories and photos until you withdraw your AI consent and choose to delete them, or until your account is deleted. You can also delete a single child profile or photo avatar in the app at any time. If you withdraw your consent for photos, we delete the photos, the descriptions of facial features and the avatars (see "Withdrawal of consent"). When you delete your account, all data about your child is deleted from our live systems, including stories, pictures, audio and photos. Your sign-in record is the exception for now (see below). If you made a custom narrator voice, a small number of older narration files may also remain for now (see "Voice recordings" below).
  • Inactive accounts: this rule starts on 7 November 2026. Using Story Sprinkle means any signed-in use of the web app or the mobile app. If you do not use it for 23 months, we send a warning e-mail to your account address. It gives the deletion date, 30 days later, and a link to sign in. Signing in at any time cancels the deletion. If you do not sign in, we delete your account after 24 months without use, and no sooner than 30 days after the warning. We delete all its stories, child profiles and photos, the same as when you delete the account yourself. We do not delete an account with an active paid subscription. If your account existed before 7 November 2026, we count from your last account change or your last story, whichever is later.
  • Sign-in record: when an account is deleted, our sign-in system still keeps your e-mail address, name and sign-in details. This applies if you delete the account, ask us by e-mail to delete it, or we delete it as inactive. We are fixing this. Until then, we keep this record only in our sign-in system and do not use it for anything else. You can ask us to remove it at [email protected]. We cannot remove it by hand yet, so we will remove it as soon as the fix is ready. Until then, your sign-in details still work. If you sign in again after your account is deleted, we create a new, empty account. Nothing from the deleted account comes back.
  • Voice recordings: only if you made a custom narrator voice before November 2026. We store your voice recordings, and the story audio made with them, in our storage (Amazon Web Services, Canada). When your account is deleted, in any of the ways above, we delete them. Our own AI engine, which made those narrations, kept no copy of your recordings and no voice model. It ran on Microsoft Azure until 26 May 2026. Its storage no longer exists, and nothing remains there. One exception: about 119 narration audio files that the engine made in 2024 and 2025 may not be linked to an account in our records, so deleting an account may not remove them. These files can contain a child's name. We are working to delete them. If you want them deleted, or want to know more, write to [email protected].
  • Consent records: we keep them while you have an account. They are deleted when you delete your account.
  • Backups: we make a backup of our database every day and keep each backup for about 7 days. Data that you deleted can stay in a backup until that backup expires.
  • Purchase and accounting records: we keep them for as long as tax and accounting law requires. In Estonia this is seven years from the end of the financial year.
  • Technical data: our application logs are available to us for about 7 days. We keep other technical data only as long as we need it to run and secure the service.
  • Support messages: we keep them for as long as we need to answer you and to deal with any follow-up or legal claim.

Providers that received data to deliver the service handle it under their own terms and retention rules. How long xAI keeps the story details and photos that it receives is governed by xAI's API data terms. Microsoft Azure hosted our own AI engine for us until 26 May 2026. The engine kept no copy of your recordings and no voice model, and nothing remains on Microsoft Azure (see "Voice recordings" above). Write to us if you want to know more.

Your data protection rights

You have the following rights over your personal data. As a parent or guardian, you can also use them for your child.

  • Access: ask what data we hold and get a copy.
  • Correction: ask us to correct data that is wrong or incomplete.
  • Deletion: ask us to delete data. You can delete your account, and all data about your child that we hold, yourself in the app (on the web, iOS and Android) or at storysprinkle.com/delete-account. Your e-mail address, name and sign-in details in our sign-in system are not removed yet (see "Data retention"). If you made a custom narrator voice before November 2026, we delete your voice recordings and the story audio made with them too. About 119 older narration files may not be linked to an account, so they may not be removed; we are working to delete them (see "Data retention"). Deleting your account does not cancel a subscription. Cancel it first: in the web app under Account → Manage subscription, or with the "manage subscription" link in your receipt e-mail, if you bought it on the web, or in the subscription settings of your Apple account if you bought it in the iOS app.
  • Restriction: ask us to limit how we use data.
  • Portability: where we process data on the basis of your consent or our contract, get the data you gave us in a common, machine-readable format.
  • Withdrawal of consent: you can withdraw your consent for data about your child at any time in the web app (app.storysprinkle.com), in Account → Privacy. See "Withdrawal of consent" below.

Your right to object: you can object at any time to processing that we base on our legitimate interests, such as keeping the service safe. Our use of data about your child is not based on legitimate interests. It is based on your consent, which you can withdraw at any time (see below).

To use your rights, write to [email protected]. It is free. We answer within one month. For a complex request, the law lets us take up to two more months, and we will tell you why. We may ask you to confirm your identity first.

You also have the right to complain to a data protection authority. Our supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You can also complain to the authority in the country where you live or work. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk).

Withdrawal of consent

Where we rely on your consent, you can withdraw it at any time. This does not affect processing that happened before.

Consent for data about your child. You can withdraw each consent in the web app (app.storysprinkle.com), in Account → Privacy:

  • Consent for AI stories (your child's details): when you withdraw it, we stop sending your child's details to xAI, and we cannot create new stories unless you give consent again. The app asks you what to do with your stories, child profiles and photos: delete them or keep them. If you keep them, we only store them, on the basis of that choice, so that you can still open them. You can still delete a child profile or a photo avatar in the app. Your stories stay until you delete your account, or until you write to us and ask us to delete them.
  • Consent for photos: when you withdraw it, we delete your child's photos, the descriptions of facial features made from them, and the avatars. Pictures in stories and child profiles that you already made are not deleted, and they can still show the character made from the photo. They stay until you withdraw your AI consent and choose Delete, or delete your account.

You can also delete your account at any time, in the app or at storysprinkle.com/delete-account. This deletes all data about your child that we hold, with the exceptions in "Data retention".

Data that is deleted can stay in a backup until that backup expires (see "Data retention"). Data that xAI received before you withdrew your consent is handled under xAI's API data terms. If you cannot use the web app, write to [email protected] and we will withdraw your consent for you.

Other consents. You can turn off push notifications in the settings of your device. You can unsubscribe from news e-mails with the link in each e-mail or by writing to us.

Permissions

The mobile app may ask for permission to send you notifications and, if you choose to add a photo, for access to your camera or to the photo you select. You can change these permissions in the settings of your device.

Advertising

The Story Sprinkle app is completely free of ads. We do not add analytics or crash-reporting tools to our website or apps. The push-notification and subscription providers in the mobile app receive limited device data to do their job.

Social media interactions, links to other websites and other platforms

Our services may include links to third-party websites and social media platforms. We are not responsible for their content or for how they collect and use personal data. When you sign in with Apple or Google, these companies may use your personal information according to their own policies. We advise you to read their privacy policies.

Changes

Dnysus OÜ may update this Privacy Policy to reflect legal, technical or business changes. The date in the Summary shows when it was last updated. If we make an important change, we will tell you by e-mail or in the app before the change takes effect.

How to contact us

For any question about this Privacy Policy, about how we handle your personal data, or about your rights, write to us at [email protected]. Our company is Dnysus OÜ, Tallinn, Estonia, registry code 16003621.