Privacy Policy
This Privacy Policy describes how WonderUniverse LLC ("we," "us," or "our") collects, uses, discloses, and safeguards information when you use our WonderUniverse mobile application (the "App") and any related services (collectively, the "Services"). The App is designed as a storytime experience for children, where parents/guardians can personalize stories with their child's name(s).
We are committed to protecting your privacy and the privacy of children using the App. This policy complies with the Children's Online Privacy Protection Act ("COPPA") and other applicable U.S. privacy laws.
By using the Services, you consent to the practices described in this Privacy Policy. If you are a parent or legal guardian of a child under 13 using the App, please read this policy carefully. Verifiable parental consent is obtained when a parent or guardian signs in with Apple or Google and creates a child profile. We do not use an age-gate checkbox or identity-document upload.
1. Information We Collect
We collect only the minimum information necessary to provide and improve the Services.
Information Provided by Parents/Guardians:
- Account details: email address and display name (collected via Apple Sign-In or Google Sign-In; we do not collect or store passwords). We may store the display name the sign-in provider returns, plus an internal user ID.
- Payment information (processed by Apple App Store or Google Play Store; we do not store full payment card details).
- Contact preferences and communications.
Information from or about Children (with Verifiable Parental Consent):
- Child's first name or nickname (for on-device story personalization and for the child profile on the parent account).
- Child's age as a number chosen by the parent (not a birthdate). Used to keep generated stories age-appropriate.
- Optional gender or pronouns (to write the child as the hero).
- Interests, story-length preference, story format (standalone / saga / universe), content filters, and optional “special request” notes written by the parent.
- Stories, titles, summaries, and related story-world data generated for that child.
- Optional parent feedback or content reports, which may include the child's name and age so we can investigate.
Specific Handling of Children's Names: Children's names are stored on the parent account as part of the child profile on our cloud infrastructure. Story text, titles, and summaries are generated and stored using the placeholder [CHILD_NAME] instead of the real name. The child's name is inserted only on the parent's device when a story is displayed or shared.
We send the child's name to our servers so we can save the profile and associate stories with the right child. We instruct our story-writing model to use [CHILD_NAME] and not the real name. Age, interests, gender/pronouns, parent story notes, and content-filter settings are sent to our AI providers so the story can be personalized. Our chapter-review model currently also receives the child profile as submitted (including the name) until we finish stripping it to the same placeholder. Feedback and content reports sent to us may include the child's name and age.
Account and Transaction Data:
- User IDs: We assign each account an internal user identifier used to associate your data across our systems and for product analytics.
- Purchase history: We record your subscription status and in-app purchase history (e.g., credit packs) through RevenueCat to manage entitlements and provide customer support.
Automatically Collected Information (Usage Data):
- Device information: device type, operating system, and device identifiers.
- Crash logs: When the App encounters an error in a production build, we send error messages, stack traces, the screen name, app version, platform (iOS/Android), and the internal user ID to our servers. Crash reports do not include the child's name.
- App performance data: Alongside crash reports, we collect the App version, platform (iOS/Android), and related diagnostic information.
- App interactions: We collect product analytics about how you use the App (such as which screens you visit and which features you use) through Mixpanel. See Section 7 for exactly what Mixpanel receives (including parent email, device identifiers, automatic SDK events, and opaque child profile ids where applicable).
- Log data: IP address, access times, and session duration.
We do not collect precise geolocation, photographs, videos, or audio recordings of children. Stories are text. Bedtime reminders are local device notifications (see Section 7); we do not operate a push-notification server or collect push tokens for marketing. We do not collect biometric data (Face ID / Touch ID are only used by the OS for Apple Sign-In if the parent has them enabled).
2. How We Use Your Information
We use the collected information for the following purposes:
- To provide, personalize, and maintain the Services (e.g., generating and delivering customized storytime experiences). Stories are generated using third-party AI companies (up to two may be used for writing, review, and input checks). We send story parameters such as age, interests, gender/pronouns, parent-written story notes, and content-filter settings. Story bodies are requested and stored with
[CHILD_NAME]placeholders; the real name is inserted on your device. - To manage user accounts and authenticate users using your email address and internal user ID.
- To manage subscriptions and in-app purchases using your purchase history and entitlement data.
- To monitor and improve App stability using crash logs and performance data.
- To understand how the App is used and improve the experience using product analytics (see Section 7).
- To communicate with you about updates, support, or your account.
- To ensure safety, security, and legal compliance.
- For any other purpose with your consent or as permitted by law.
We do not use children's personal information for behavioral advertising, profiling, or any marketing purposes targeted at children. We do not sell personal information.
3. How We Share Your Information
We do not sell, rent, or trade personal information, including children's data.
We may share information in these limited circumstances:
- Service Providers: With trusted third-party vendors who perform services on our behalf. These include:
- Amazon Web Services (AWS): Cloud hosting, database storage, and backend infrastructure.
- Mixpanel: Product analytics (parent email, internal user ID, device/app info, interaction events, and opaque child-profile identifiers). Not used for ads aimed at children.
- RevenueCat: Subscription management and purchase validation with Apple and Google.
- Third-party AI companies: Up to two AI companies may be used for story writing, quality review, and safety checks on parent-written notes. Inputs include age, interests, story settings, and
[CHILD_NAME]placeholders in story text. The child's profile name may currently be included in review prompts; we are aligning that path to placeholders only. - Apple App Store / Google Play Store: Payment processing for subscriptions and in-app purchases.
- Legal Requirements: To comply with law, court orders, or governmental requests; to protect the safety of children or prevent harm; or to enforce our terms.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, with appropriate safeguards.
- With Parental Consent: For any other sharing where verifiable parental consent has been obtained.
We do not share children's personal information with third parties for their own marketing or advertising purposes.
4. Children's Privacy (COPPA Compliance)
The App is directed toward children, and we fully comply with COPPA (15 U.S.C. § 6501 et seq. and 16 CFR Part 312). We do not knowingly collect personal information from children under 13 without verifiable parental consent (except for limited internal operations permitted by COPPA, such as supporting the service itself).
- Parental Consent: A parent or legal guardian must sign in with Apple or Google and add a child profile before child-related information is collected. Completing that flow is how we obtain verifiable parental consent for the collection and use described in this policy. We do not currently use a government-ID check.
- Parental Rights: Parents/guardians may review, delete, or refuse further collection/use of their child's personal information at any time. To exercise these rights, contact us (see Section 12). We will respond promptly and without unreasonable delay.
- No Conditioning on Disclosure: We do not condition a child's participation on disclosing more information than reasonably necessary.
Children's names are handled as described in Section 1 (stored on the parent account profile, not in stored story bodies, and inserted on-device at display time).
5. Data Security
The security of your and your child's data is a priority. We implement reasonable administrative, technical, and physical safeguards, including:
- Encryption: Data is encrypted in transit (using HTTPS/TLS). We use industry-standard cloud security practices for storage; we continue to strengthen encryption-at-rest controls on our databases as part of ongoing security work.
- Access controls, secure storage, regular security audits, and monitoring.
- Secure deletion or anonymization practices.
While we strive to use commercially reasonable means to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, and we are not liable for breaches caused by factors beyond our reasonable control. In the event of a data breach that compromises personal information, we will notify affected users and regulators as required by law.
6. Data Retention
We retain personal information (including children's data) only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, or resolve disputes. Upon parental request or when no longer needed, we delete or anonymize children's data. Children's data is deleted from our systems when the associated account is terminated or upon request.
7. Local Storage and Analytics
The App uses local on-device storage (such as AsyncStorage) to save your preferences, authentication session, and App settings. This data stays on your device and is not transmitted to external servers unless necessary for the App to function (e.g., syncing your account data).
We use Mixpanel for product analytics to understand how the App is used and to improve the experience. Mixpanel may receive:
- An internal user ID
- The parent/guardian email address associated with the account (for understanding usage by account, not for marketing to children)
- Device identifiers and app information (platform, app version) and interaction events (screens visited, features used, story mode)
- Automatic SDK events (for example session and app-open style events enabled in the Mixpanel SDK)
- For some events involving a child profile, an opaque child profile identifier of the form
{parentUserId}_{childSlotNumber}. This does not include the child's name.
Mixpanel does not receive: the child's full name, the child's age, or passwords. We do not use Mixpanel for behavioral advertising aimed at children. Analytics are limited to internal product improvement consistent with COPPA.
Bedtime reminders: If you enable them, we schedule a repeating local notification on your device at the time you choose. Reminder content stays on the device. Turning reminders off cancels the scheduled notification.
You can manage local storage by clearing the App's data through your device settings, though this may require you to sign in again.
8. Third-Party Services and Links
The App and backend integrate: Amazon Web Services (hosting and infrastructure), Mixpanel (analytics), RevenueCat (subscription and in-app purchase management), Apple and Google (sign-in and payment processing), and up to two third-party AI companies (story writing, review, and input checks). We are not responsible for their privacy practices. Please review their respective privacy policies. Any links to external sites are for convenience only.
9. International Data Transfers
If you are located outside the United States, your data may be transferred to and processed in the U.S. We ensure appropriate safeguards (e.g., standard contractual clauses) are in place where required.
10. Your Rights and Choices
In addition to parental rights under COPPA:
- You may access, correct, or delete your account data via the App or by contacting us.
- You may opt out of non-essential communications.
- California residents or others may have additional rights under applicable state laws (e.g., CCPA/CPRA) — contact us for details.
11. Changes to This Privacy Policy
We may update this policy periodically. We will notify you of material changes via the App, email, or in-App notice. Your continued use after changes constitutes acceptance of the updated policy. We encourage you to review it regularly.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy, your data, or your child's data, please contact us at:
9300 Conroy Windermere Rd, Unit 1905, Windermere, FL 34786
Email: matt@thewonderuniverse.com
We will respond to parental inquiries about children's data promptly.