Privacy Notice
Effective: July 22, 2026. Version: 2026-07-22.
Launch blocker: the legal operator name, postal address, and privacy email must be configured and reviewed by counsel before production traffic is accepted.
LullaWonder is designed for an adult parent or guardian to use with a child. Children may not create accounts or use the service without the adult account holder present.
Information we handle
- Adult account data: name, verified email, session and security information.
- Child profile data entered by the adult: first name or nickname, age, pronoun preference, interests, companions, and details chosen for a story.
- Requests and results: story prompts, generated story text, narration text, provider usage, and error metadata. Stories saved to the adult’s library are stored in our D1 account database; saved narration remains in the browser.
- Private family links: the selected story text, title, link expiry, and revocation record. We store a one-way hash of the link token, not the working link itself. We do not collect recipient names, email addresses, or viewer accounts for this feature.
- Voice data: saved provider voice identifiers and preferences. If an adult requests instant voice cloning, their microphone recording or uploaded audio is sent to ElevenLabs to create the private clone. LullaWonder does not retain the source recording in D1.
- Billing data: subscription status and Stripe customer/subscription identifiers. LullaWonder does not receive full card numbers.
- Feedback and basic security data such as timestamps, country code, IP-derived abuse signals, and user agent.
Why we use it
We use this information to authenticate the adult, personalize stories, generate requested narration, save preferences, create and revoke an adult-requested private family link, enforce trials and limits, process subscriptions, prevent abuse, provide support, and meet legal obligations. We do not sell personal information or use child profile data for targeted advertising.
Service providers
Only the information needed for a requested feature is sent to the relevant processor:
- OpenAI receives story instructions and details. LullaWonder requests API processing with response storage disabled.
- Google may receive narration text when a Gemini voice is selected.
- ElevenLabs may receive narration text and, when explicitly requested, authorized adult voice samples; it manages generated and cloned voice assets.
- Cloudflare hosts the application, database, security controls, and transactional email delivery.
- Stripe processes checkout, payment, tax, and subscription management.
Retention
Account profiles and preferences remain until the adult deletes them or the account. A private family link expires after 14 days and can be revoked by the adult sooner; its associated record is deleted when the account is deleted. Magic-link tokens expire after 10 minutes; generated voice-preview capabilities expire after one hour. Usage records are retained only as needed for limits, fraud prevention, billing reconciliation, and legal obligations. Provider copies follow each provider’s retention terms; OpenAI states that default API abuse-monitoring logs may be retained for up to 30 days. Stripe may retain transaction records required by financial law.
Adult controls and rights
The signed-in adult can edit or delete each child profile, download an account export, delete saved voices, and request full account deletion from the Account page. Account deletion is blocked while an active subscription still requires cancellation or reconciliation. You may also contact the configured privacy address to request access, correction, deletion, restriction, or portability, or to withdraw consent.
International processing and security
Providers may process data in the United States and other countries. We use encrypted HTTPS transport, verified email login, signed sessions, server-side authorization, ownership checks, usage controls, and restricted production secrets. No internet service can guarantee absolute security.
Changes
If this notice changes materially, the adult will be asked to accept the new version before entering more child information.