Cunastorybooks
The privacy promise

What we keep, and what we don't.

Cuna is designed for children. That means we collect the minimum, advertise nothing, and let you delete it all from Settings whenever you'd like.

Effective2026-10-08also read:Terms

Privacy Policy

This Privacy Policy explains how Cuna ("we", "us", "our") collects, uses, and protects information when you and your children use the Cuna mobile application (the "App"). Cuna is designed for children and is operated by Kevin Porter.

If you have questions about this policy, contact us at support@cunastories.com.

1. Summary for Parents

  • We collect the minimum information needed to provide the App: an account for you, profiles for your children, the stories and characters you create, and your purchase history.
  • We do not advertise to your children. No third-party advertising SDKs are integrated into the App.
  • We do not sell your data. Information is shared only with the service providers we use to operate the App (listed by name in section 4).
  • AI only with your permission. Cuna uses AI services to write, narrate, illustrate, and safety-check stories. Before anything is sent to them, we ask you in the App, and nothing is sent until you allow it. You can turn it off at any time in Settings → AI story making.
  • Account access is gated behind a 4-digit PIN you set up during onboarding. Only the parent account holder can access account settings or your children's data.
  • You can delete your account at any time from Settings, which permanently deletes all associated data.

2. Information We Collect

Information you provide

  • Account information: email address, password (stored as a hash), parent PIN, display name.
  • Child profiles: each child profile includes a name (or nickname) and an age tier (0–2, 3–5, or 6–9). We do not collect children's real names, birthdays, photos, locations, or any other personal information.
  • Custom characters: when you create a character together with your child, we store the character's name, appearance description, voice selection, and a generated portrait image.
  • Stories: the text and audio narration of stories generated in the App, along with the metadata used to generate them (prompts, character cast, age tier).
  • Subscription & purchase information: managed through a subscription-and-purchase processor (see section 4). We receive notifications about subscription status and Cuna Stars credit balances but do not handle or store payment card data.

Information collected automatically

  • Device & diagnostic information: operating system version (iOS or Android), App version, and crash and error diagnostics (for example, an error code, the screen where an error occurred, and whether it was fatal). Used to diagnose problems, minimize crashes, and keep the App compatible and reliable.
  • First-party usage analytics: we log a small set of in-app events — for example, when a story is generated or completed, playback engagement, when the subscription paywall is shown, and when a purchase or subscription completes — associated with your account. We use this only to understand how the App is used, fix problems, and improve features.

These analytics and diagnostics are first-party only: they are stored on our own infrastructure and are not shared with third-party analytics or advertising networks. We do not use any third-party product-analytics, advertising, or behavioral-tracking SDK in the App, and we do not use this information to track you across other apps or websites. If we ever add third-party analytics in the future, we will update this policy before it begins collecting data.

Information we do not collect

  • We do not collect or store children's real names, birthdays, locations, photos, contacts, microphone recordings, or any other personally identifying information about a child.
  • We do not use third-party advertising networks.
  • We do not use behavioral tracking SDKs.

3. How We Use Information

We use the information we collect to:

  • Provide the App and its core features: account access, child profile management, story generation, character creation, audio playback, and story library.
  • Generate stories on demand using the AI services described in section 4.
  • Process subscription and consumable purchases through our subscription-and-purchase processor (see section 4).
  • Diagnose crashes and improve the App.
  • Communicate with you about account-related matters (password resets, subscription receipts, billing issues).

We do not use the information for advertising, profiling, or any purpose outside the operation of the App.

4. Third-Party Service Providers

The App relies on third-party services to operate. Each provider has access only to the information needed to perform its function and is contractually required to protect that information.

Provider Purpose Data shared
Supabase and Google Cloud (cloud infrastructure) Account authentication, database, file storage (audio + images), realtime updates, backend hosting Account info, child profiles, stories, characters, audio files, image files. Encrypted in transit. Server logs record your account identifier, identifiers for your child profiles, stories and characters (not their names or what your child types), and the IP address requests come from, and sign-in logs also record your email address; we use them only to run and secure the service and to fix problems.
Expo (app updates) Delivering App updates Each time the App checks for an update: your device platform and operating system version, the App version, a random identifier for this installation, the message from the App's last crash (if there was one), and the IP address the request comes from.
Anthropic, DeepInfra, ElevenLabs, Groq, and OpenAI (AI) Writing, narrating, illustrating, and safety-checking stories — only after a parent allows it (see below) Story choices (characters, setting, mood), anything typed for a story or a custom character, character context (including, for Premium characters, what they remember from past stories), your child's age tier and story language, and generated story text. Never your name, email address, password, or payment details. These providers are not permitted to use Cuna content to train their AI models.
RevenueCat (subscriptions and purchases) Subscription and consumable purchase processing Your account identifier (never your name or email address), subscription status, purchase events. Does not handle payment card data — that flows directly between you and Apple or Google.
Resend (email) Delivering your support requests, feedback, and content reports to our support inbox What you write, any screenshots or app diagnostics you attach, your account identifier, and your email address so we can reply. For a content report, also which story or character you reported, the reason you chose, and an identifier for the child profile it came from.
Apple App Store / Google Play Payment processing, and sign-in if you choose Sign in with Apple or Google Payment card data is handled directly by Apple or Google per their respective privacy policies. We do not receive or store card information. If you sign in with Apple or Google, they confirm who you are and give us your email address (Apple lets you hide it behind a relay address), plus any basic profile details, such as your name, that you agree to share on their sign-in screen.

AI processing and your permission

Creating a new story or character uses the AI providers listed above. Before anything is sent to them, a parent must allow it in the App on the "AI story making" screen, which is behind the Parental PIN. You'll see it when your child first tries to create a story or character, and you can review it at any time in Settings → AI story making.

  • Nothing is sent until you allow it. Our servers won't start an AI request for an account that hasn't given permission.
  • You can withdraw permission at any time in Settings → AI story making. New AI requests then stop, though one already under way when you turn it off may still finish. Cuna's Picks and the stories you already have keep working.
  • We keep a record of when permission was given or withdrawn.

5. Children's Privacy (COPPA Compliance)

Cuna is designed for children under 13 and complies with the United States Children's Online Privacy Protection Act ("COPPA"):

  • Parental account required: only a parent or legal guardian can create an account. The account holder must provide their email and is responsible for setting up child profiles.
  • No personal information from children: children interact with the App only through the profile their parent creates. Children do not enter their own information, email addresses, or other personal data. Children may type story ideas and names or descriptions for characters they create. That text is used only to make their stories, is checked for safety, and is sent to the AI providers in section 4 only after a parent has allowed it.
  • Parental controls: a 4-digit Parental PIN gates access to all parent-side functions (settings, profile management, subscription, scrapbook, account deletion). The PIN cannot be bypassed by a child.
  • No third-party advertising or marketing: we do not allow advertising SDKs to operate in the App. Children do not see external advertisements.
  • Right to review and delete: parents may review or delete any child profile (and all associated data) at any time from Settings → Profiles.

To exercise your parental rights, contact support@cunastories.com.

6. Data Security

  • All network traffic between the App and our servers is encrypted in transit using TLS.
  • Account passwords are stored as one-way hashes by our authentication provider.
  • Stories, characters, and other user-generated content are stored with row-level access controls so that one account cannot access another account's data.
  • Backend secrets and API credentials are stored in a managed secret store and accessed only by the backend service identity at runtime.

No system is perfectly secure. We do our best, but we cannot guarantee absolute security.

7. Data Retention

  • Account, profile, story, character, and purchase data is retained for as long as your account is active.
  • When you delete a child profile, all stories, characters, and audio/image files associated with that profile are permanently deleted within 30 days.
  • When you delete your account, all associated data — including all child profiles — is permanently deleted within 30 days.

8. Your Rights

You have the right to:

  • Access the information we have about you and your children
  • Correct inaccurate information
  • Delete your account and all associated data
  • Export your data in a portable format

To exercise any of these rights, contact support@cunastories.com.

If you are in the European Union, the United Kingdom, or California, you may also have additional rights under GDPR, UK GDPR, or CCPA respectively, including the right to lodge a complaint with a supervisory authority.

9. Changes to This Policy

We may update this Privacy Policy occasionally. Material changes will be communicated by email to the account holder and announced in the App. The "Effective Date" at the top of this document reflects the most recent revision.

10. Contact Us

Cuna · Operated by Kevin Porter

Email: support@cunastories.com

end of the chapter