1. Who we are
MoonyKids is operated by Fabro Labs LTD, a company registered in England and Wales under company number 17074624, with its registered office at 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom.
In this policy, “MoonyKids”, “we”, “us” and “our” mean Fabro Labs LTD. “You” means the parent or legal guardian who creates and holds a MoonyKids account. “Your child” means the child or children in your care who watch stories. “The Service” means the MoonyKids website at moonykids.com and the MoonyKids applications for iOS and Android.
Fabro Labs LTD is the operator of the Service and is responsible for the information described here.
How to contact us
You can contact us about anything in this policy — including any request to review, delete, or stop the further collection of information relating to your child:
| [email protected] | |
| Post | Fabro Labs LTD, 5th Floor 167–169 Great Portland Street London W1W 5PF, United Kingdom |
| Telephone | +44 7591 442430 |
We respond to every privacy request within 10 business days, and in all cases within the timeframes required by applicable law.
2. What we collect from you
Only one person ever gives us information: you. Here is everything.
| What | Where it comes from | Why we have it |
|---|---|---|
| Email address | You provide it at signup, or Google provides it if you sign in with Google | Your account identity, signing you in, and sending you messages about the Service |
| Password | You provide it at signup | Signing you in. Stored only as a salted cryptographic hash — we cannot read it or recover it |
| Your name | Google provides it if you sign in with Google | Addressing you in the app and in emails |
| Display name (optional) | You choose it | What you would like us to call you. It does not have to be your real name |
| Character names | You type them when creating a story | Generating the story. See section 3 |
| Story selections | You choose them when creating a story | Choosing which artwork appears. Stored as internal references, not descriptions. See section 3 |
| Story text and narration audio | Generated by our system from your choices | The story itself, so you can play it again |
| Sign-in tokens | Created automatically when you sign in | Keeping you signed in and connecting a request to your account |
We do not ask for your date of birth. Our Terms require account holders to be 18 or older.
3. Story inputs, and why we treat them carefully
The names you type
We assume every character name you type is your child’s real first name, and we protect it accordingly. The name is attached to the story you created. We do not use it to identify anyone, we do not index or search across names, and we never use it for marketing.
We ask that you not enter your child’s full real name. A first name, a nickname, or an invented name works just as well for the story, and keeps the finished story from carrying more about your family than it needs to.
Your selections are stored as internal references
When you choose a story world, a character’s appearance, or how a character is culturally or religiously presented, our system records an internal reference such as char_0412. It does not record a description, a label, or a category, because it does not need one — the reference exists only to tell the renderer which artwork to draw.
We treat these choices as sensitive, because appearance and cultural presentation can reveal things about a family that deserve protection. We do not group accounts by them, build audiences from them, infer anything about you or your child from them, or use them for any purpose beyond producing the story you asked for.
4. What we never collect
This list matters as much as the one above.
- Nothing at all from your child. No typing, no voice, no drawings, no photographs, no logins. There are no child profiles in MoonyKids — the Service has no concept of a named or separately identified child, and no screen where a child enters anything.
- No date of birth, for you or for your child. You do pick an age for the story so the writing suits the listener; that number belongs to the story, and section 2 lists it.
- No voice recordings. We never ask for or record speech.
- No payment information. MoonyKids is free. We do not take payments and hold no card or billing details.
- No precise location. We never request GPS or device location permission.
- No access to your microphone, camera, contacts, or photo library.
- No biometric information.
- No advertising identifier. We do not collect Apple’s IDFA or Google’s Advertising ID, and MoonyKids contains no advertising of any kind.
- No information bought from anyone. We do not purchase personal information from data brokers, and we do not receive it from advertising networks or social platforms beyond the sign-in information described above.
5. Children’s privacy
MoonyKids is intended for families with young children, and we follow the Children’s Online Privacy Protection Rule (COPPA).
We collect no personal information from children. Because nothing is collected from your child, we do not need to seek verifiable parental consent — there is nothing for a child to give us.
Persistent identifiers
Signing you in requires identifiers that persist between visits — session and authentication tokens. Our mobile app also creates device-level identifiers for crash reporting and usage measurement, described in section 6. Under COPPA all of these are persistent identifiers, and we use them solely to support the internal operations of the Service. In practice that means:
- signing you in and keeping you signed in;
- performing the network communications needed to deliver a story to your device;
- maintaining and analysing whether the Service is working correctly;
- protecting the security and integrity of the Service and your account;
- meeting our legal obligations.
We do not use or disclose these identifiers to contact you or your child individually, to build a profile of either of you, for advertising, or for any other purpose.
Your rights as a parent
You may at any time review the information we hold, ask us to delete it, and refuse to permit any further collection. Section 11 explains how.
6. Information collected automatically
On our website
Our website uses no third-party analytics. There is no Google Analytics, no Meta or Facebook software, no Hotjar, PostHog, Mixpanel or Plausible, no advertising software and no tracking pixels on moonykids.com.
Instead we run our own measurement, on our own servers, and it is deliberately minimal. When you use our website we record anonymous interaction events — where on a page something was clicked or tapped, how far a page was scrolled, and the name of the element involved — against a random identifier created in your browser.
That identifier is not connected to your account. There is no link in our systems between these events and who you are; they cannot be traced back to you, and we do not try. We use them only to understand which parts of the site work and which confuse people.
In our mobile app
Our mobile app uses two Google services. Here is exactly what they are and what they send.
| Service | Why we use it | What Google receives |
|---|---|---|
| Firebase Crashlytics | Tells us when the app has crashed, so we can fix it | An installation identifier created on the device, the device model, the operating system version, and the technical details of the crash |
| Google Analytics for Firebase | Tells us which screens are used and where people get stuck | An app instance identifier created on the device, the device model, the operating system version, the country, and the names of screens opened |
These identify an installation of the app, not a person. They are not joined to your account, your email address, your stories, or anything you or your child typed into the app. We do not use them for advertising, we do not permit them to be used for advertising personalisation, and the device advertising identifier is not collected.
Connection information
Like any internet service, our servers receive your device’s IP address as part of delivering a request — this is how the internet works and cannot be avoided. We keep it, briefly and for one purpose: abuse and security. Each request our API serves is recorded with its IP address and browser user-agent, so that we can enforce rate limits and investigate an attack on the Service.
That record is not a profile. After 30 days the IP address and the user-agent are erased from it automatically — overwritten in place, not archived — and what remains says only which route was called, how long it took and whether it failed. The remainder is deleted after 90 days. A job enforces both, continuously; this is not a promise to tidy up later.
7. Who else sees your information
We use a small number of service providers to run MoonyKids. Each receives only what it needs.
| Provider | What they do | What they receive |
|---|---|---|
| OpenAI | Generates story text | The story instructions: the character names you typed, the age you chose the story for, the character’s gender, the theme and the language |
| Sentry | Tells us when something breaks, on the website and on our servers | The technical detail of the error. Personal fields are switched off in our configuration, so it does not receive your email address, your account or your stories |
| Google (Gemini) | Translates the wording we write for this website into other languages | Nothing about you — only our own site copy. No account data, no story text, no character names |
| Google (Firebase) | Crash reporting and app usage measurement, in our mobile app only | A device-level installation identifier, the device model, the operating system version, and crash or screen-name data. Never your account details, your email address, or your stories |
| Resend | Sends our transactional email | Your email address and the message we send you |
| Hetzner | Provides the servers we run, in Finland | Hosts our systems — it does not use or access what is stored |
OpenAI does not use your information to train its models. This is contractual, not a courtesy.
They do keep a short-term copy for abuse monitoring — the safety checks every AI provider runs to stop their systems being misused. That copy is held for up to 30 days and then deleted. It is not used for training, not used for advertising, and not shared. Because the story instructions include the character name you typed, that name is part of what is briefly held.
Narration never leaves our servers. The voice is synthesised by software running on our own machines in Helsinki, so no outside company receives the story text in order to speak it, and there is no third-party voice provider to name here.
This is the main reason we ask you not to enter your child’s full real name.
We run our own servers and our own storage. We do not use a third-party content delivery network, so no outside company sees requests for your stories.
8. We do not sell your information
We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not show advertising to anyone, and we do not allow anyone to advertise to you or your child through MoonyKids.
9. How long we keep things
We keep what we need for as long as you have an account with us, and no longer.
| What | How long | Then |
|---|---|---|
| Your account — email address, password hash, name, display name | While your account is open | Deleted when you close your account |
| Your stories — character names, selections, story text and narration audio | While your account is open. Your stories stay available to you for as long as you want them | Deleted when you close your account. Deleting one story on its own is not something the app can do yet |
| Sign-in tokens | Until the session expires or you sign out | Discarded automatically |
| Email verification codes | 15 minutes | Expire automatically and cannot be reused |
| Crash reports held by Google (Crashlytics) | 90 days | Google begins removing them from its live and backup systems |
| App usage events held by Google (Analytics) | 2 months | The individual event records are deleted. Aggregate counts in Google’s own reports are not tied to a device and are kept for longer |
| Copies held by our AI provider for abuse monitoring | Up to 30 days | Deleted by them automatically |
| IP address and browser user-agent in our request records | 30 days | Erased from the record, leaving only which route was called and how it performed |
| Request records, once those identifiers are gone | 90 days | Deleted |
| Server logs on our own machines | 14 days | Deleted on a timer, on every server |
| Anonymous interaction events | 180 days | Deleted. They are not linked to you or your account in the first place |
Closing your account deletes the narration audio too — not just the record of it. Deletion happens immediately, in the same request.
10. Messages you send us
If you write to us for help, we keep your message, our reply, and the address it came from, so that we have a record of the conversation and can pick up where we left off if you write again.
Please do not include your child’s full name, date of birth, photograph, school, or health information in a message to us. We do not need any of it in order to help you, and anything you send becomes part of our support records. If you have already sent us something like this, ask us to delete it and we will.
11. Your rights, and how to use them
You can:
- See what we hold — ask us and we will tell you.
- Correct anything wrong — in your account settings, or by asking us.
- Delete everything you have made — by closing your account, below. Removing a single story on its own is not something the app can do yet.
- Delete your whole account — in the app under Profile → Privacy → Delete account, or at moonykids.com/deletion if you cannot sign in.
- Refuse further collection — closing your account stops it entirely.
Every request is answered within 10 business days.
When you ask us to delete your account, the deletion happens immediately. Your stories, narration audio, account details and sign-in sessions are removed straight away. There is no waiting period, and the deletion cannot be undone.
If you are unhappy with how we have handled a request, you may complain to the UK Information Commissioner’s Office at ico.org.uk.
12. Where your information is held
Fabro Labs LTD is registered in the United Kingdom. Your account and your stories are stored on our own servers in Helsinki, Finland, within the European Union, on infrastructure provided by Hetzner. We manage those servers ourselves.
Some of the providers listed above operate outside the European Union. OpenAI, which generates the story text, Resend, which sends our email, Sentry, which receives our error reports, and Google, which receives the crash and app usage data described in section 6, process information in the United States and in other countries where they operate. Narration is not on that list: it is produced on our own servers in Finland. Where information is transferred out of the UK or EU, we rely on the safeguards required by applicable data protection law.
13. How we protect your information
We maintain a written information security programme covering the personal information we hold, and we review it at least once a year.
In practice, that means:
- Everything travels encrypted. All connections to MoonyKids use TLS 1.2 or 1.3, and HTTP Strict Transport Security is enforced, so a browser will not fall back to an unencrypted connection.
- Passwords are never stored in a readable form — only as a salted cryptographic hash.
- IP addresses are kept for 30 days and no longer — only to rate limit and to investigate abuse — and are then erased from the record automatically.
- Access is limited to the small number of people who need it to operate the Service.
- Our servers are in the European Union, in Helsinki, and are managed by us.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your information, we will tell you and the relevant authorities as the law requires.
15. Stories are generated by AI
MoonyKids stories are created by artificial intelligence from the choices you make. They are not written by a person. We design the system to produce gentle, age-appropriate bedtime stories, but we cannot guarantee that every story is accurate, original, or suited to every child. You are always in control of what your child watches.
16. Changes to this policy
If we change this policy in a way that materially affects how we handle your information or your child’s, we will tell you directly by email before the change takes effect. We will not make a material change quietly.
The effective date at the top of this page always shows the current version.
17. Contact us
Questions about this policy, or about anything we hold:
| [email protected] | |
| Post | Fabro Labs LTD, 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom |
| Telephone | +44 7591 442430 |