Privacy policy

• Your account: your email address and the language you use. There is no password; the one-time link in your sign-in email works for 15 minutes, and we keep only a hash of it.
• Your children: the name you give each child, and their birthday if you choose to add it. A nickname is fine.
• Drawings and recordings: the photo of each drawing, a recording of up to 10 seconds, the words transcribed from it, and the mounted drawing with its gently moving version. Location and device details are removed on your device before the photo is uploaded, and our server removes them again.
• Your family: the email addresses of the family members you invite, and whether each of them gets the Sunday letter.
• Payments: handled by Stripe. We never see or store card numbers; we keep your membership status, your orders and the delivery address for printed books.
• Reminders: if you turn on Sunday reminders, the push address your browser gives us.

We don’t collect location or contacts. There are no ads and no third-party analytics or tracking, and we never sell anything about you.

• Mounting drawings, turning your child’s words into text, and putting together each Sunday’s spoken issue and your family’s book;
• Signing you in, and sending you and your family letters and reminders;
• Taking payments, giving refunds and preventing abuse.

Nothing else. Your family’s drawings, recordings and words are never used to train any model.

Some of the work is done by specialist providers. Each receives only what its one task needs, and is bound not to keep it or use it for anything else:

• Rlab: our model gateway. For most families it mounts drawings, transcribes recordings, and writes and reads the Sunday issue.
• Xiaomi MiMo: a model service in mainland China. For families who signed up in Simplified Chinese, model processing goes only to MiMo and to MiniMax below, unless you separately agree to let an image model outside mainland China mount a drawing. Other families use it when Rlab is unavailable.
• MiniMax: a speech service in mainland China that reads issues in Cantonese, Japanese, Korean and Thai.
• Stripe: payments.
• Cloudflare: sending email, carrying network traffic and storing encrypted backups.
• Your browser’s push service: it passes on encrypted reminders and cannot read them.

Image models see only the paper of the drawing. When an issue is written, children’s names are replaced with placeholders, so the model never sees them; when it is read aloud, the names in the narration go to the speech service with the rest of the text.

• The database and files are kept on our own server in Hong Kong. Families who signed up in Simplified Chinese are kept in a separate partition.
• Drawings, recordings, transcripts and issue audio are encrypted with AES-256-GCM before they are written to disk.
• Your family’s drawings and recordings open only through signed links that expire after 10 to 15 minutes; links to issue audio expire after 3 hours.
• Every night the encrypted data is backed up to Cloudflare R2.
• Issue links shared with grandparents are signed and kept out of search engines, and the family’s owner can take them all back at once.

• Drawings, transcripts and issues: until you delete them or close your account.
• Recordings: unless you chose to keep the original recording, deleted as soon as it has been transcribed.
• Sign-ins last 30 days; invitations expire after 7 days.
• When you delete a drawing or close your account, the data is removed from our server straight away, and copies in backups are cleared within 30 days.
• Payment records are kept by Stripe for as long as the law requires.

We use two cookies, both necessary: one keeps you signed in, the other remembers your language. There are no advertising or analytics cookies.

• See and export: on the Family page you can download every drawing, recording, transcript and issue in one archive.
• Delete: any drawing can be deleted on its own, and you can close your account. When the family’s owner closes their account, the whole family is deleted with all its drawings, recordings and issues; when another family member closes theirs, only their own account goes.
• Correct: if a child’s name or birthday is wrong, write to us and we’ll put it right.
• Withdraw consent: at any time. Delete the drawings concerned, or close your account, and we stop processing them.

You also have the right to complain to the data protection authority where you live.

Only a parent or guardian can upload a child’s drawings and voice, and only after agreeing separately as their guardian. We never extract voiceprints, and everything your family adds is seen only by your family unless you share it.

If you have any question about this policy or your information, write to …. If we make an important change, we’ll email you before it takes effect.