Tally Privacy Policy

1. Who is responsible

Tally is provided by Yaron Ogen, Humboldtstr. 12, 06114 Halle (Saale), Germany, who is the controller responsible for your data under the EU General Data Protection Regulation (GDPR). Contact: deneb.algedi2026@gmail.com.

Tally is meant for parents and other adults. Children listen to the stories, but an adult sets up and manages the app.

2. What we collect

Account: your email address and password (the password is stored only in hashed form by our sign-in provider).

Your child's profile, as you enter it: first name, age, and whether stories should call your child a girl or a boy (for grammar). The name is stored encrypted. We don't ask for or keep your child's birthday.

Stories: the stories written for you, their settings (language, themes, length, ending, main character), your child's choices and answers in the interactive modes, any main-character description you type, the stories you keep in a child's Book, and the scores you give stories.

Account settings and usage: your time zone, how many stories you have used, which version of the Terms you agreed to and when (including your confirmation that you are 18 or older), and your Premium subscription status.

Reports: if you report a story, we keep your reason, any note you add, and a short excerpt of the story with your child's name removed, so we can review it.

Technical data: when the app talks to our server, the server briefly records technical information such as your IP address and the time of the request, for security and troubleshooting.

We do not collect your location, contacts, photos, advertising identifiers, or any data for advertising. We do not use analytics or tracking tools.

3. Why we use it (and on what legal basis)

To provide the app you asked for: accounts, children's profiles, writing, storing and reading stories, the Book, book PDFs and coloring pages (contract, Art. 6(1)(b) GDPR).

To keep the service safe and working, for example preventing abuse, fixing errors and reviewing reported stories (legitimate interest, Art. 6(1)(f) GDPR).

To improve story quality: story scores are kept as anonymous statistics, together with how the story was made, but without who rated it (legitimate interest, Art. 6(1)(f) GDPR).

Your child's details are used only to write stories for your family. We never use them for advertising or profiling.

4. Artificial intelligence

Stories, questions and answer choices are written by AI models from OpenAI. To write a story, the AI receives only the story settings: language, your child's age, themes, length, ending, grammatical gender, the main-character choice or description you typed, and your child's choices and answers.

The AI never receives your child's name or your email. Stories are written with a placeholder, and the name is filled in on our server afterwards. The same applies to story pictures (Premium plans): the picture AI only receives a description of the scene.

After a story is written, a second AI step checks its grammar and spelling. It receives the same story text (still without your child's name) and nothing else.

OpenAI processes this data on our behalf through its business API, does not use it to train its models, and keeps it only for a short period under its commercial terms.

5. Service providers

We use carefully chosen providers who process data only on our instructions (data processing agreements, Art. 28 GDPR):

Supabase: sign-in, sign-in emails (confirming your address, resetting your password) and database, hosted in Frankfurt, Germany.

Railway: hosting of our application server.

OpenAI: the AI that writes and proofreads the stories (see section 4). On Premium plans it also draws a picture for each story, and redraws it as outlines when you ask for a coloring page. For pictures it receives only an English description of the scene and characters (or the picture itself), never your child's name or your email.

Apple, Google and RevenueCat: Premium subscriptions are sold and billed by Apple (App Store) or Google (Google Play). RevenueCat tells us whether a subscription is active, using an anonymous app user ID. We never see your payment details.

Some providers are based in the USA. Where data is transferred outside the EU, it is protected by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

6. How long we keep data

Your account, children's profiles, stories, pictures, coloring pages and book PDFs are kept until you delete them.

Deleting a story or a child removes it right away. Deleting your account (Settings → Delete my account) removes your account, children, stories, Books, PDFs, pictures and audio, and your sign-in account. You can also ask us to delete your account by email (see https://tallyapi-production-1103.up.railway.app/delete-account).

Story reports are kept for up to two years so we can review them and improve story safety; deleting your account removes the link to you.

Anonymous story scores and cost records without any content or link to you are kept to improve the service. Server logs and backups are deleted after a short period.

7. Security

All connections are encrypted (HTTPS). Children's names are additionally encrypted in our database. Access to data is limited to what is needed to run the service.

8. Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, and to receive it in a portable format. Most of this you can do directly in the app; for anything else, write to deneb.algedi2026@gmail.com.

You also have the right to complain to a data protection supervisory authority, for example the authority in the German federal state where you live.

9. Children

Tally is used by parents on behalf of their children. Children should not create accounts themselves; settings, purchases and account deletion are behind a grown-ups check. If you believe a child has given us data without a parent, contact us and we will delete it.

10. Changes

If we change this policy in an important way, we will tell you in the app. The current version is always at https://tallyapi-production-1103.up.railway.app/privacy.