سياسة الخصوصية

1. Who we are

MoonyKids is operated by Fabro Labs LTD, a company registered in England and Wales under company number 17074624, with its registered office at 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom.

In this policy, “MoonyKids”, “we”, “us” and “our” mean Fabro Labs LTD. “You” means the parent or legal guardian who creates and holds a MoonyKids account. “Your child” means the child or children in your care who watch stories. “The Service” means the MoonyKids website at moonykids.com and the MoonyKids applications for iOS and Android.

Fabro Labs LTD is the operator of the Service and is responsible for the information described here.

How to contact us

You can contact us about anything in this policy — including any request to review, delete, or stop the further collection of information relating to your child:

We respond to every privacy request within 10 business days, and in all cases within the timeframes required by applicable law.

2. What we collect from you

Only one person ever gives us information: you. Here is everything.

We do not ask for your date of birth. Our Terms require account holders to be 18 or older.

3. Story inputs, and why we treat them carefully

The names you type

We assume every character name you type is your child’s real first name, and we protect it accordingly. The name is attached to the story you created. We do not use it to identify anyone, we do not index or search across names, and we never use it for marketing.

We ask that you not enter your child’s full real name. A first name, a nickname, or an invented name works just as well for the story, and keeps the finished story from carrying more about your family than it needs to.

Your selections are stored as internal references

When you choose a story world, a character’s appearance, or how a character is culturally or religiously presented, our system records an internal reference such as char_0412. It does not record a description, a label, or a category, because it does not need one — the reference exists only to tell the renderer which artwork to draw.

We treat these choices as sensitive, because appearance and cultural presentation can reveal things about a family that deserve protection. We do not group accounts by them, build audiences from them, infer anything about you or your child from them, or use them for any purpose beyond producing the story you asked for.

4. What we never collect

This list matters as much as the one above.

• Nothing at all from your child. No typing, no voice, no drawings, no photographs, no logins. There are no child profiles in MoonyKids — the Service has no concept of a named or separately identified child, and no screen where a child enters anything.
• No date of birth, for you or for your child. You do pick an age for the story so the writing suits the listener; that number belongs to the story, and section 2 lists it.
• No voice recordings. We never ask for or record speech.
• No payment information. MoonyKids is free. We do not take payments and hold no card or billing details.
• No precise location. We never request GPS or device location permission.
• No access to your microphone, camera, contacts, or photo library.
• No biometric information.
• No advertising identifier. We do not collect Apple’s IDFA or Google’s Advertising ID, and MoonyKids contains no advertising of any kind.
• No information bought from anyone. We do not purchase personal information from data brokers, and we do not receive it from advertising networks or social platforms beyond the sign-in information described above.

5. Children’s privacy

MoonyKids is intended for families with young children, and we follow the Children’s Online Privacy Protection Rule (COPPA).

We collect no personal information from children. Because nothing is collected from your child, we do not need to seek verifiable parental consent — there is nothing for a child to give us.

Persistent identifiers

Signing you in requires identifiers that persist between visits — session and authentication tokens. Our mobile app also creates device-level identifiers for crash reporting and usage measurement, described in section 6. Under COPPA all of these are persistent identifiers, and we use them solely to support the internal operations of the Service. In practice that means:

• signing you in and keeping you signed in;
• performing the network communications needed to deliver a story to your device;
• maintaining and analysing whether the Service is working correctly;
• protecting the security and integrity of the Service and your account;
• meeting our legal obligations.

We do not use or disclose these identifiers to contact you or your child individually, to build a profile of either of you, for advertising, or for any other purpose.

Your rights as a parent

You may at any time review the information we hold, ask us to delete it, and refuse to permit any further collection. Section 11 explains how.

6. Information collected automatically

On our website

Our website uses no third-party analytics. There is no Google Analytics, no Meta or Facebook software, no Hotjar, PostHog, Mixpanel or Plausible, no advertising software and no tracking pixels on moonykids.com.

Instead we run our own measurement, on our own servers, and it is deliberately minimal. When you use our website we record anonymous interaction events — where on a page something was clicked or tapped, how far a page was scrolled, and the name of the element involved — against a random identifier created in your browser.

That identifier is not connected to your account. There is no link in our systems between these events and who you are; they cannot be traced back to you, and we do not try. We use them only to understand which parts of the site work and which confuse people.

In our mobile app

Our mobile app uses two Google services. Here is exactly what they are and what they send.

These identify an installation of the app, not a person. They are not joined to your account, your email address, your stories, or anything you or your child typed into the app. We do not use them for advertising, we do not permit them to be used for advertising personalisation, and the device advertising identifier is not collected.

Connection information

Like any internet service, our servers receive your device’s IP address as part of delivering a request — this is how the internet works and cannot be avoided. We keep it, briefly and for one purpose: abuse and security. Each request our API serves is recorded with its IP address and browser user-agent, so that we can enforce rate limits and investigate an attack on the Service.

That record is not a profile. After 30 days the IP address and the user-agent are erased from it automatically — overwritten in place, not archived — and what remains says only which route was called, how long it took and whether it failed. The remainder is deleted after 90 days. A job enforces both, continuously; this is not a promise to tidy up later.

7. Who else sees your information

We use a small number of service providers to run MoonyKids. Each receives only what it needs.

OpenAI does not use your information to train its models. This is contractual, not a courtesy.

They do keep a short-term copy for abuse monitoring — the safety checks every AI provider runs to stop their systems being misused. That copy is held for up to 30 days and then deleted. It is not used for training, not used for advertising, and not shared. Because the story instructions include the character name you typed, that name is part of what is briefly held.

Narration never leaves our servers. The voice is synthesised by software running on our own machines in Helsinki, so no outside company receives the story text in order to speak it, and there is no third-party voice provider to name here.

This is the main reason we ask you not to enter your child’s full real name.

We run our own servers and our own storage. We do not use a third-party content delivery network, so no outside company sees requests for your stories.

8. We do not sell your information

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not show advertising to anyone, and we do not allow anyone to advertise to you or your child through MoonyKids.

9. How long we keep things

We keep what we need for as long as you have an account with us, and no longer.

Closing your account deletes the narration audio too — not just the record of it. Deletion happens immediately, in the same request.

10. Messages you send us

If you write to us for help, we keep your message, our reply, and the address it came from, so that we have a record of the conversation and can pick up where we left off if you write again.

Please do not include your child’s full name, date of birth, photograph, school, or health information in a message to us. We do not need any of it in order to help you, and anything you send becomes part of our support records. If you have already sent us something like this, ask us to delete it and we will.

11. Your rights, and how to use them

You can:

• See what we hold — ask us and we will tell you.
• Correct anything wrong — in your account settings, or by asking us.
• Delete everything you have made — by closing your account, below. Removing a single story on its own is not something the app can do yet.
• Delete your whole account — in the app under Profile → Privacy → Delete account, or at moonykids.com/deletion if you cannot sign in.
• Refuse further collection — closing your account stops it entirely.

Every request is answered within 10 business days.

When you ask us to delete your account, the deletion happens immediately. Your stories, narration audio, account details and sign-in sessions are removed straight away. There is no waiting period, and the deletion cannot be undone.

If you are unhappy with how we have handled a request, you may complain to the UK Information Commissioner’s Office at ico.org.uk.

12. Where your information is held

Fabro Labs LTD is registered in the United Kingdom. Your account and your stories are stored on our own servers in Helsinki, Finland, within the European Union, on infrastructure provided by Hetzner. We manage those servers ourselves.

Some of the providers listed above operate outside the European Union. OpenAI, which generates the story text, Resend, which sends our email, Sentry, which receives our error reports, and Google, which receives the crash and app usage data described in section 6, process information in the United States and in other countries where they operate. Narration is not on that list: it is produced on our own servers in Finland. Where information is transferred out of the UK or EU, we rely on the safeguards required by applicable data protection law.

13. How we protect your information

We maintain a written information security programme covering the personal information we hold, and we review it at least once a year.

In practice, that means:

• Everything travels encrypted. All connections to MoonyKids use TLS 1.2 or 1.3, and HTTP Strict Transport Security is enforced, so a browser will not fall back to an unencrypted connection.
• Passwords are never stored in a readable form — only as a salted cryptographic hash.
• IP addresses are kept for 30 days and no longer — only to rate limit and to investigate abuse — and are then erased from the record automatically.
• Access is limited to the small number of people who need it to operate the Service.
• Our servers are in the European Union, in Helsinki, and are managed by us.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your information, we will tell you and the relevant authorities as the law requires.

14. Cookies and similar technologies

We use only what is necessary to sign you in and keep you signed in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies on our website.

15. Stories are generated by AI

MoonyKids stories are created by artificial intelligence from the choices you make. They are not written by a person. We design the system to produce gentle, age-appropriate bedtime stories, but we cannot guarantee that every story is accurate, original, or suited to every child. You are always in control of what your child watches.

16. Changes to this policy

If we change this policy in a way that materially affects how we handle your information or your child’s, we will tell you directly by email before the change takes effect. We will not make a material change quietly.

The effective date at the top of this page always shows the current version.

17. Contact us

Questions about this policy, or about anything we hold: