Children's Privacy

1. Our approach in one line

Story Time Together is built to be operated by a parent or guardian, not by a child. We collect the minimum needed to personalise a story, we ask a parent to consent before we collect it, we never use it for advertising or profiling, and a parent can review or delete it at any time.

2. Who operates the account

The account holder must be an adult (18+). The adult enters any details about the child; the product is not designed for a child to register or provide information on their own. We present clear, age-neutral entry points so that data entry happens on the parent's side.

3. What we collect about a child

• To personalise stories — typically a first name (or nickname), age or age range, and a few interests. A nickname is fine; a full legal name is not required.
• We don't ask for a child's contact details, precise location, photos, or voice, and we don't require any data beyond what's needed to generate the stories.

We treat this as children's personal data even though a parent provides it.

4. Verifiable parental consent

Before collecting personal data about a child, we obtain consent from a parent or guardian. Because a simple "I am the parent" checkbox is not sufficient under laws such as the US Children's Online Privacy Protection Act (COPPA), we verify consent using a method appropriate to the sensitivity of the data — for example, confirmation tied to the parent's payment transaction, or another recognised verification step. A parent can withdraw consent at any time.

5. How we use a child's data

• only to generate and deliver the personalised stories requested;
• to keep the service working, safe, and secure.

We do not use children's data for behavioural advertising, marketing, profiling, or to train third-party foundation models, and we do not sell it. We don't use engagement tricks ("dark patterns") to keep a child in the app or to nudge anyone into sharing more than necessary.

6. Sharing

We share children's data only with the service providers needed to run the product (for example, secure hosting and the AI model provider that generates the story), under contracts that limit them to our instructions. These vendors are listed on our Sub-processors page. We may also disclose data where required by law or to protect a child's safety.

7. Retention

We keep a child's personal data only as long as needed to provide the service, then delete or anonymise it. A parent can delete a child's profile and associated stories at any time, and we delete children's data within 30 days of account closure unless the law requires us to keep it longer.

8. Parents' rights

A parent or guardian may, at any time:

• review the personal data we hold about their child;
• correct or update it;
• delete it;
• withdraw consent and stop any further collection or use (we'll then retain only what the law requires).

To exercise any of these, email our Data Protection Officer at dpo@carrotly-ai.com. We may need to verify that you're the child's parent or guardian before acting.

9. International note

Different countries set different rules and ages: COPPA (United States) covers children under 13; the EU's GDPR sets the digital-consent age between 13 and 16 depending on the member state, and the UK's Age Appropriate Design Code ("Children's Code") expects services likely to be accessed by children to be high-privacy by default. In Singapore, the PDPA and the PDPC's guidance on children's personal data apply. We aim to meet the most protective of the standards that apply to a given family.

10. App-store ratings

Where Story Time Together is offered through an app store, we set age-appropriate ratings and follow the relevant kids/family programme requirements (such as Apple's Kids Category and Google Play's Families policies).

11. Contact

Questions or concerns about a child's data? Email our Data Protection Officer at dpo@carrotly-ai.com. If you believe a child has provided us data without a parent's involvement, tell us and we'll delete it promptly.