Concept in development

Privacy policy

How Storylit handles information about you and your family, in plain words.

A draft for our lawyer's review. This policy describes what the Storylit app and website actually do today. A lawyer is reviewing it, in every language, before Storylit launches; anything marked TO CONFIRM is still being settled. It is not legal advice.

Effective date: October 21, 2026 (U.S. Eastern Time) · Version 2026-10-21

In short

The short version

A parent or guardian, 18 or older, makes the Storylit account. Children use Storylit inside that account, and we never ask a child for information.
From you, we keep your name, e-mail, country and postal area (or city), each child's grade level, how you heard about us (if you say), your news choice, and facts about your account such as when you last signed in.
Your children's names, ages, looks, photos, voices, drawings and stories stay on your phone or tablet. Only their grade levels leave it.
No ads, no selling, no sharing for advertising, no profiling of children and no tracking in the app.
The website counts visits with Google Analytics only if you say OK.
You can see, download, correct or delete your information at any time, in the app or by e-mail, wherever you live.

Who we are

Who is responsible for your information

Storylit is a Breath Global, Inc. company. Breath Global, Inc. decides how and why your information is used (in European terms, the "controller"). It is a United States company.

Company: Breath Global, Inc. [TO CONFIRM: that it is a North Carolina corporation, its registered address and a telephone number (the U.S. COPPA Rule asks for both)]
Contact, including privacy: hello@breathglobal.com
Our representative in the European Union (GDPR, Article 27): [TO CONFIRM: name and address, once appointed]
Our representative in the United Kingdom (UK GDPR, Article 27): [TO CONFIRM: name and address, once appointed]
Brazil, the person in charge of data (encarregado, LGPD Article 41): [TO CONFIRM: name and contact; until then, write to the address above]
Quebec, the person in charge of the protection of personal information (Law 25): by law, the company's highest-ranking officer unless another person is named. [TO CONFIRM: name and title]
India, the person who answers questions and grievances (DPDP Act): [TO CONFIRM: name and contact; until then, write to the address above]

A data protection officer? We have not appointed one. European law requires one when an organisation's core work is large-scale, regular and systematic monitoring of people, or large-scale use of sensitive information. Storylit does neither: it tracks no one and keeps no sensitive information. [TO CONFIRM: our lawyer to confirm, since the app is used by children]

This policy covers the Storylit Live app (at storylit.io/app and when installed on a phone), the Storylit website (storylit.io) and the e-mails we send. Storylit Studio, the photo studios, is a concept and not open: when it is, it will have its own notice.

What we collect

What we collect, and from whom

1. From you, when you sign up or edit your profile

Your first and last name and your e-mail address.
Your country, prefilled from your phone's language and region settings (never from its location or GPS). You can change it.
Your postal area. You type your whole postal code so the app can catch a typo. Where a full code can point to a street or a building, the app keeps and sends only its area part: for example SW1A from SW1A 1AA in the UK, K1A from K1A 0B1 in Canada, D02 from an Irish Eircode, 01310 from a Brazilian CEP. Where the code already names a whole town or district, such as a U.S. ZIP code (kept as its 5 digits), it is kept as it is. In some countries we ask for your city or town instead. We never ask for a street address. [TO CONFIRM: full codes saved before October 21, 2026 are being cut to their area]
Each child's grade level (Pre-K to Grade 6): a grade, never a name or an age.
How you heard about Storylit, if you choose to say.
Whether you want Storylit news (unticked unless you tick it), that you confirmed you are a parent or guardian aged 18 or older, that you agreed to the terms and which version, and the app's language.
Your name, e-mail, country and postal area (or city) and your children's grade levels are needed to make an account: without them we cannot make one. How you heard about us and news are optional.

2. About your account

How you sign in (Google, Apple or e-mail and password), when the account was made, when you last signed in, how many times you have signed in, on how many devices, the kind of device you last used (for example "iPhone Safari") and whether a password is set (never the password itself).
Sign-in is provided by Google (Firebase Authentication). If you use an e-mail and password, Google keeps the password in scrambled (hashed) form and nobody at Storylit can see it. If you continue with Google or Apple, they confirm your name and e-mail to us; we never see their password. To run sign-in and protect accounts, Google also processes technical information such as your IP address and browser.

3. News, only if you confirm

If you tick "E-mail me Storylit news and early access", we send one e-mail with a button to confirm it was you; nothing else about news comes until you tap it. We keep your e-mail, your name, your account ID if you were signed in, whether your news is waiting, on, off or unsubscribed, and when. The links in our e-mails are random codes that we keep only in a one-way scrambled form.

4. When you send feedback or report a bug

What you write (up to 2,000 characters), its kind (bug, idea, something confusing, praise), what you were doing (if you say), and, shown to you before you send it: the screen's name, the app's version, the kind of device (like "Android Chrome"), the screen size, whether you were online, the time, up to 5 recent app error messages, and your account's name and e-mail. Before anything is sent, the app replaces the names of the children you added with "[child]" and any e-mail address in an error message with "[email]". Please do not put anyone else's personal details in a note.

5. Keeping bots and spam out

Sign-up, profile and feedback requests go through our own server, which counts how many arrive from one network address and one e-mail in an hour. Our own records keep only a salted, one-way scrambled form of the address and of the e-mail, which expires after about two hours and is then deleted automatically, usually within a day, never the address itself. Google's standard request logs for the server record the network address of each request and are kept for 30 days.

When we switch it on, Google reCAPTCHA (part of Firebase App Check) will check that the grown-up screens are used from a real app or browser; it runs only on those screens, never while a child plays, and Google receives information about the device and browser to do it.

6. On the website

The website's forms send nothing: "Bring Storylit to your city" is a demonstration, and what you type in it is neither sent nor stored.
Visit counting with Google Analytics, only after you say OK on the bar at the bottom of the page: pages viewed, buttons tapped, the rough region and the kind of device, with Google's advertising features turned off. Saying no is remembered, and nothing is measured.
Like every website, the servers that deliver the pages (Google Firebase Hosting) receive your IP address and browser details in order to send them.

7. On your phone or tablet only

Your kids' first names or nicknames, ages, pronouns, looks and colours, favourite worlds and learning goals, and everything they make (stories, paintings, photos, voice recordings, videos, stars and progress), your settings, and your grown-up passcode stay on the device, kept separately for each account that signs in there. We never receive them. The passcode is kept only as a salted, scrambled code, never the four numbers. The app also keeps a copy of its own files on the device so it opens without a connection, and a short queue of sign-up and profile changes waiting to be sent when you are offline.

8. Features that use your phone's or browser's own services

Voice typing for answers is off unless you turn it on in the grown-ups' area. When it is on, your browser's own speech recognition may send the audio to the browser's maker (for example Google or Apple) to turn it into text, under that company's privacy policy. Storylit never receives the audio.
The reading voice uses the voices your phone or browser provides. By default, Storylit reads only with voices that run on your device, so the words never leave it. Some browsers also offer online voices, which send the text being read, including the first name you gave your child, to the browser's maker; Storylit uses one only if your device has no voice of its own for your language and you turn on "Online reading voices" in the grown-ups' area (off unless you turn it on). With it off and no voice on the device, the words light up on screen without speech. You can choose the voice in Profile, then Preferences, or turn the voices off with "Character voices" in the grown-ups' area.
Sharing and saving a story or a painting uses your device's own share sheet or downloads, and happens only when a grown-up chooses it.

9. What we never collect

Nothing from a child. No child's name, age, birthday, photo, voice, drawing or story; no precise location; no contacts; no advertising identifiers; no advertising or tracking code in the app; no sensitive information such as health or religion. We do not knowingly collect personal information directly from a child. If we learn that we have, we delete it.

Why

Why we use it, and on what legal basis

Each use below names its legal basis under the European and UK GDPR (Article 6) and Brazil's LGPD (Article 7). Other countries' laws have similar grounds.

To make and run your account (sign-in, your profile, the right number of children and grade levels on a new phone): needed to provide the service you asked for, a contract (GDPR 6(1)(b); LGPD 7, V).
To support you and improve Storylit (the account facts: how often and on how many devices you sign in, and the kind of device): our legitimate interest in helping families and seeing whether the app works for them (GDPR 6(1)(f); LGPD 7, IX).
To write to you about your account and answer you (for example when you delete it, or reply to your feedback): contract, and our legitimate interest in helping you and fixing the app (GDPR 6(1)(b) and (f); LGPD 7, V and IX).
To send Storylit news, only after you confirm: your consent, which you can withdraw at any time with the unsubscribe link or in the app (GDPR 6(1)(a); LGPD 7, I).
To count website visits, only after you say OK: your consent, also as the cookie rules require (GDPR 6(1)(a); UK PECR; the EU ePrivacy rules; LGPD 7, I).
To keep Storylit safe (the hourly limits, App Check, refusing anything shaped wrong): our legitimate interest in protecting families and the service from abuse (GDPR 6(1)(f); LGPD 7, IX).
To plan locally: we count families by country and postal area (or city) to decide where to hold events and open studios, and to plan local marketing. Our legitimate interest (GDPR 6(1)(f); LGPD 7, IX). We only ever e-mail you about it if you asked for news.
To meet the law (keeping a record that we honoured your deletion request, answering a lawful request from an authority): a legal obligation (GDPR 6(1)(c); LGPD 7, II).

Weighing our interests against yours. Where we rely on legitimate interests, we have checked that they do not override your rights. For local planning: we keep only the area part of a postal code, never a street or a home; the area is never tied to a child; we look at counts, not at one family; nothing is sold or shared for advertising; and you can object at any time, after which we leave your record out of the counts. [TO CONFIRM: our lawyer to review this balancing test]

We make no decisions about anyone by automated means alone, and we do no profiling.

Children

Children and their parents

Storylit is made for children from Pre-K to Grade 6, and it is designed so that children's personal information does not leave the device. The account belongs to a parent or guardian aged 18 or older, who gives their own information and decides how the app is used. The grown-ups' areas sit behind a passcode only the grown-up knows.

Europe and the UK. The account rests on a contract with the adult, and every consent we ask for (news, website visits) comes from the adult. Where consent is the basis for an online service offered to a child, the law requires a parent's consent below an age each country sets between 13 and 16 (13 in the UK and Belgium, 14 in Spain and Italy, 15 in France, 16 in Germany, Ireland and the Netherlands, for example). We never ask a child for consent.
United States (COPPA). Storylit is directed to children under 13. We do not collect personal information from children: the parent gives their own details, and a child's grade level comes from the parent, tied to the parent's account, never to a child's name. There is no chat and no public posting, so a child cannot make personal information public. Parents can review or delete what we hold and stop further use at any time (see "Your rights"). [TO CONFIRM: our lawyer to confirm whether any feature needs verifiable parental consent under the amended COPPA Rule, and which method; today the adult confirms they are a parent or guardian aged 18 or older and signs in]
Brazil (LGPD, Article 14). Children's and teenagers' information is handled only in their best interest. The only thing about a child that leaves the device is the grade level, given by a parent or guardian as part of the parent's own account. [TO CONFIRM: our lawyer to confirm the legal basis for the grade level (a contract with the parent, as the ANPD's Statement 1/2023 allows in the child's best interest, or a parent's specific consent)]
India (DPDP Act 2023). A child is anyone under 18, and their information needs a parent's verifiable consent. Storylit does no tracking or behavioural monitoring of children and no advertising aimed at them, which that law forbids. [TO CONFIRM: the verifiable consent method under India's DPDP Rules 2025, before their children's-data rules apply]
Canada and Quebec. For a child under 14 in Quebec, consent comes from a parent or guardian; across Canada, we treat children's information as sensitive.

If you believe a child has given us personal information, write to hello@breathglobal.com and we will delete it.

Built for children's privacy

How Storylit applies the UK Children's Code

The UK's Age Appropriate Design Code (the "Children's Code") sets 15 standards for online services likely to be used by children. We apply them everywhere, not only in the UK. This is how, and what we are still working on:

Best interests of the child come first in every design choice: learning and making, no ads, no endless feeds, no streak guilt (missed days simply pause).
A data protection impact assessment for the account and sign-up has been drafted and is being reviewed before launch; we will review it again with every change that touches personal information.
Age-appropriate application: we treat everyone in the children's screens as a child; the grown-up screens sit behind the passcode.
Transparency: this policy, a short version in the app (Profile, then Privacy and data), plain words on the sign-up screen, and short notes where the microphone and photos are used.
No detrimental use of information, and no notifications: Storylit sends none. Parents can set a daily time limit and quiet hours.
Our own rules, upheld: we do what this policy says, and the database and server are built to refuse records of any other shape.
High privacy by default: voice typing off, news off, website visit counting off until you say OK, nothing shared unless a grown-up shares it. The reading voice is on, with voices on the device only; online voices stay off unless you turn them on (see section 8 above).
Data minimisation: a grade, never a name or an age; the postal area, never the full code or an address.
No data sharing beyond the service providers that run Storylit for us (see "Who we share it with").
Geolocation off: Storylit never uses the device's location. The country is suggested from the phone's language and region settings, and the grown-up types the postal code.
Parental controls are in the grown-ups' area: the passcode, time limits, quiet hours, and voice, photo and video features on or off. Children's progress shown to parents stays on the device. We plan a clear sign on the children's screens that a grown-up can see their progress.
Profiling off: there is none. What the app suggests to a child is worked out on the device from what the parent chose.
No nudge techniques: the privacy choices are worded neutrally, and saying no is as easy as saying yes.
Connected toys and devices: Storylit has none today.
Online tools: download your family's data, correct it, delete the account, or write to us, all from Profile.

Where

Where it is stored, and transfers abroad

Your information is stored in Google's cloud, in Breath Global, Inc.'s own account. Our sign-up server runs in Google's us-central1 region, in the United States. The database's location: [TO CONFIRM: the Cloud Firestore location of the breath-inc project]. If you live outside the United States, your information is transferred there.

For transfers from the European Economic Area, the UK and Switzerland, we rely on Google's Cloud Data Processing Addendum, which includes the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and on Google LLC's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. For Brazil (LGPD Article 33), Argentina, Canada, Australia, India, Mexico and other countries, we rely on the same contractual safeguards and on the transfer rules of each law. [TO CONFIRM: Breath Global accepts Google's data processing terms in the Firebase and Google Cloud consoles; our lawyer confirms each country's transfer tool, including Brazil's standard clauses and the assessment Quebec's Law 25 requires before information leaves Quebec]

How long

How long we keep it

Your account, sign-up and profile records: while your account is open. When you delete your account, we erase them, and your sign-in account with Google's sign-in service, within 30 days and tell you when it is done.
Accounts nobody uses: after 24 months without a sign-in, we plan to e-mail you and then delete the account. [TO CONFIRM: this clean-up is not automated yet]
Your deletion request itself (it carries your name, e-mail and place, and the date): kept for 24 months, to show we honoured it.
Feedback and bug reports: 24 months, then deleted. [TO CONFIRM: this clean-up is not automated yet]
Your news choice: while you receive news. After you unsubscribe, we keep your e-mail and the date so we do not write to you again. A confirm link works for 7 days, an unsubscribe link for a year; then they stop working.
The scrambled counters that keep bots out, and the codes behind e-mail links: deleted automatically shortly after they expire, usually within a day (the counters expire after about two hours, a link's code when the link stops working).
The copies of sign-ups and notes in our team's mailbox: deleted with your account. [TO CONFIRM: the staff steps for this]
Server logs: Google's standard operational logs, which include the network address of each request, kept for 30 days.
Website visit counts: Google Analytics keeps them for 2 months. [TO CONFIRM: the retention setting in Google Analytics]
On your device: until you remove it: clear a child's progress, delete the account, clear the browser's data or remove the app. Signing out hides your family's things on that device but keeps them there for your next sign-in. Deleting the account wipes the device you delete it on; on any other phone or tablet you used, clear the app's data there.

Your rights

Your rights, wherever you live

We give every family these rights, whatever the law where they live requires:

Access: ask what we hold about you, and get a copy.
Correction: fix your details in Profile, then Account, or ask us.
Deletion: Profile, then Privacy and data, then Delete my account; or ask us.
Portability: "Download my family's data" gives you your details and your children's profiles, progress and settings from your device as one file, and "Save our paintings" saves the paintings as pictures (photos and voice recordings stay in the app); ask us and we send what our server keeps, as a file too.
Objection and restriction: object to a use based on our legitimate interests, such as local planning, or ask us to pause a use while a question is settled.
Withdrawing consent: turn news off in the app or with the unsubscribe link; change your website answer at any time with "Cookie choices" at the bottom of every page. Withdrawing does not affect what was done before.
Complaining to a regulator, at any time (see below). We would like the chance to help first.

How: in the app, or by e-mail to hello@breathglobal.com. To protect you, we answer at the e-mail address on your account, or ask you to sign in. It is free. We answer within one month in the UK and Europe (up to two more months for complex requests, and we tell you why), within 15 days for a full report in Brazil, within 45 days in California and other U.S. states (up to 45 more, with notice), within 30 days in Canada, Quebec and Australia, and within 20 working days in Mexico. A parent can act for their child, and you can name someone to act for you.

Where you live

United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk.
European Union and EEA: the data protection authority of the country where you live or work (the list is at edpb.europa.eu). We have no establishment in the EU, so there is no single lead authority.
Brazil: your rights under LGPD Article 18 include confirmation, access, correction, anonymisation or deletion of unnecessary data, portability, information about whom we share with, and revoking consent. The regulator is the ANPD (Autoridade Nacional de Proteção de Dados), gov.br/anpd. The Consumer Defence Code also protects you.
Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca. In Quebec, the Commission d'accès à l'information, cai.gouv.qc.ca, and your Law 25 rights, including portability.
United States: under California's CCPA as amended by the CPRA and other state privacy laws, you can know, access, correct and delete your information, and you will not be treated differently for using these rights. We do not sell or share personal information for cross-context behavioural advertising, we do not use sensitive information to infer anything about you, and we do no targeted advertising or profiling, so there is nothing to opt out of; we do not sell or share the information of anyone under 16. The categories we collect are identifiers (name, e-mail, account ID), general location (country and postal area or city), internet or other electronic activity (the account facts, the kind of device, feedback details) and the sign-in details used only to sign you in; we disclose them only to the service providers above, for the purposes above, and keep them as long as the "How long" section says. If we say no to a request, you can appeal by replying to our answer. [TO CONFIRM: which state laws apply to Breath Global today]
Australia: the Australian Privacy Principles let you access and correct your information; if you are unhappy with how we handled a complaint, you can go to the Office of the Australian Information Commissioner, oaic.gov.au. Your information is disclosed to the United States as described above.
India: under the DPDP Act you can access, correct, complete and erase your information, have a grievance answered by us first (write to the address above), and nominate someone to act for you; after that, you can go to the Data Protection Board of India.
Mexico: under the Federal Law on the Protection of Personal Data Held by Private Parties you have the ARCO rights (access, rectification, cancellation and opposition), and this policy is our privacy notice. Running your account is the main purpose; local planning and news are secondary purposes that the service does not need, and you can refuse them at any time by writing to us. Send ARCO requests by e-mail as described above. [TO CONFIRM: the Mexican authority that now oversees this law, since its 2025 reform]
Anywhere else: you have the rights above, and you can complain to the data protection authority where you live.

Cookies and on-device storage

In the app: no cookies for tracking or advertising. The app uses your browser's own storage (local storage and IndexedDB) for what it needs to work: your family's things, settings and passcode, which account is signed in, the queue of changes waiting to be sent, and Google's sign-in session, plus a copy of the app's own files so it opens offline. This is strictly necessary for the service you asked for, so under the UK's PECR and the EU's ePrivacy rules it needs no consent.

On the website: your yes or no to visit counting is remembered in your browser's storage. Only after a yes does Google Analytics set its cookies (named _ga and _ga_ followed by an ID, which last up to 2 years) to count visits. To change your answer at any time, tap "Cookie choices" at the bottom of any page: it shows your current answer and lets you choose OK or No thanks again. Choosing No thanks after an OK stops the counting at once and deletes the _ga cookies set on this site's domain. If your browser sends a Global Privacy Control signal, we respect it as a no, even if you said OK here before, and we do not ask; "Cookie choices" then tells you the signal is being honoured.

Google Analytics on this website runs without its advertising features (Google signals and ad personalisation are off). It is never used in the app.

Security

How we protect it

Every connection is encrypted (HTTPS).
Database rules let each parent read and write only their own record, and refuse anything that is not the exact shape described here; sign-ups can only arrive through our server, which checks them again.
Hourly limits, and App Check once it is switched on, keep bots out.
We never see or store passwords; the grown-up passcode never leaves the device and is kept only as a salted, scrambled code.
Only Breath Global staff who need it can see families' records, after signing in.

No system is perfectly secure. If a breach puts your information at risk, we will tell you and the regulators as the law requires (in the UK and Europe, the regulator within 72 hours).

Changes

Changes to this policy

If this policy changes in a way that matters, we will tell you in the app or by e-mail before the change applies, and where the law requires it we will ask for your agreement again. Each version has a date and a number at the top of this page.

Contact

Questions

Write to hello@breathglobal.com. Storylit is a Breath Global, Inc. company.