Privacy Policy
Last updated: 7 April 2026
ICO registration: pending. We are registering as a data controller before accepting paying subscribers.
You give us your email and your child's profile (name, age, interests). We use that to write personalised bedtime stories. We never sell your data, never use it for adverts, and never share it with anyone except the services listed below that help us run the app. You can delete everything at any time.
1. Who we are
Moss & Tale is operated by Kyle Marham, trading as Blue Dog Digital, Wales, UK. We are the data controller under UK GDPR and the Data Protection Act 2018.
Contact for data enquiries: privacy@mossandtale.com
2. What data we collect
| Category | Data | Who it's about |
|---|---|---|
| Account | Email address, password hash (hashed, never readable), subscription tier | Parent / guardian |
| Child profile | Child's name, date of birth or approximate age, gender, pronouns, interests, pets, friends, favourite colour, bedtime | Child (data subject) |
| Child appearance | Skin tone, hair colour, hair style, eye colour β optional, only if you provide it and consent separately | Child (data subject) |
| Generated content | AI-generated story text, scene illustrations, portrait images | Relates to child |
| Usage | Login timestamps, story generation count, story ratings, notification delivery status | Parent account |
3. Why we process it and our lawful basis
Under UK GDPR, we must have a lawful basis for every category of processing:
| Processing | Lawful basis |
|---|---|
| Account management, billing, authentication | Contract (Art. 6(1)(b)) β necessary to provide the service |
| Child profile data for story generation | Legitimate interests (Art. 6(1)(f)) β personalising stories is the core service you signed up for. We have completed a Legitimate Interests Assessment. |
| Child appearance data for portrait generation | Explicit consent (Art. 6(1)(a)) β you give separate consent when entering this data. You can remove it at any time. |
| Service improvement, error monitoring | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) β only if you opted in at signup. Withdraw at any time. |
4. Children's data β ICO Children's Code
Moss & Tale is designed under the ICO's Age Appropriate Design Code (Children's Code). Here is what that means in practice:
- Children do not create accounts. Only parents and legal guardians can sign up, and you confirm this at registration.
- Child profile information is used only to generate personalised stories. It is never used for advertising, marketing profiling, or shared with third parties for their own purposes.
- All stories are private to your account. No other user of Moss & Tale can see your child's stories or profile.
- Privacy settings are on by default. There are no sharing features that are on unless you opt in.
- We collect only the information we genuinely need. Fields like appearance are optional.
- We do not profile children for any commercial purpose beyond generating their stories.
- We do not apply any nudge techniques or dark patterns to encourage you to share more data than needed.
We have completed a Data Protection Impact Assessment (DPIA) covering our processing of children's data.
5. Who we share data with
We do not sell your data. We share it only with the following processors, who act on our instructions:
| Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting and file storage | Germany (EEA) |
| Anthropic PBC | AI story generation (Claude) | USA β UK-US adequacy arrangements apply; DPA in place, no training on your data |
| Google (Imagen AI) | Portrait and scene illustration generation (Premium) | USA β UK-US adequacy arrangements apply; DPA in place, no training on your data |
| Resend | Transactional email delivery (story notifications, sign-in codes) | USA β DPA in place |
We have a Data Processing Agreement (DPA) with each processor. No processor uses your data for their own purposes.
6. How long we keep it
| Data | Retention |
|---|---|
| Child profile data (name, age, interests, appearance) | Deleted within 30 days of account closure |
| Generated stories | Deleted within 30 days of account closure (export available before deletion) |
| Account data (email, subscription history) | 6 years from last transaction (UK tax record requirement), then deleted |
| Marketing consent records | Until consent withdrawn, then deleted |
7. Automated processing and AI
Moss & Tale uses artificial intelligence (Anthropic Claude) to generate story text, and Google Imagen to generate illustrations. Your child's profile is used as input to these systems.
This is not automated decision-making within the meaning of Article 22 of UK GDPR β it produces creative content for entertainment and has no legal or similarly significant effect on any individual. You can contact us to request a review of any generated content you are concerned about.
We have confirmed with both Anthropic and Google that your data is not used to train their models.
8. International data transfers
Your data is stored on servers in Germany (Hetzner), which is in the EEA. The UK recognises EEA countries as providing adequate protection β no additional safeguards are required for this transfer.
Story generation and illustration use services based in the USA. We have UK International Data Transfer Agreements (IDTAs) in place with these processors.
9. Your rights
Under UK GDPR, you have the following rights. To exercise any of them, email privacy@mossandtale.com. We will respond within one month.
- Access: request a copy of all data we hold about you and your child
- Erasure: delete your account and all associated data (also available in Settings)
- Rectification: correct any inaccurate data β child profiles can be edited directly in the app
- Portability: receive your data in a machine-readable format
- Object: object to processing based on legitimate interests
- Restrict: request we limit processing while a dispute is resolved
- Withdraw consent: for appearance data or marketing emails, at any time β this does not affect the lawfulness of processing before withdrawal
- Automated decision-making: we do not make solely automated decisions with legal or similarly significant effects
As the parent or guardian, you exercise these rights on your child's behalf.
10. Right to complain
If you are unhappy with how we have handled your data, please contact us first at privacy@mossandtale.com.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
11. Changes to this policy
We will notify you by email if we make material changes to this policy. The βlast updatedβ date at the top of this page reflects the most recent revision. Continued use of the service after notification constitutes acceptance of the updated policy.
Questions about this policy: privacy@mossandtale.com
Moss & Tale is operated by Kyle Marham t/a Blue Dog Digital, Wales, UK.