Privacy Policy

Last updated: July 26, 2026 · Bedside Stories, McKillop Creative LLC, Greenville, South Carolina

1. Who we are

Bedside Stories is operated by McKillop Creative LLC ("we"), which is responsible for the information described in this policy. We are a personalized bedtime story service based in Greenville, South Carolina. You can reach us anytime at [email protected].

2. Who our service is for

Bedside Stories is designed for parents and legal guardians. Accounts may only be created by adults (18+). Children do not create accounts, do not enter information themselves, and are not marketed to. Parents provide limited information about their children solely so we can personalize stories, and by doing so consent to that use.

The parent or legal guardian is the sole intended user and operator of the service and acts as the intermediary between Bedside Stories and any child. All in-product prompts, buttons, notices, and communications are addressed to and intended for the parent. The service does not knowingly communicate directly with children, does not solicit information from a child, and contains no messaging, notification, social, or engagement features directed at a child.

3. What we collect

About your child (provided by you):

• A nickname or first name — never a last name. This stays on your device and is never sent to our AI provider (see section 4)
• An age range (e.g., "5–6") — not an exact age or birthdate
• A short list of interests (e.g., "dinosaurs, soccer")
• Optionally, a "Care Story" topic you select (e.g., "first day of school")
• Optionally, story ingredients you or your child provide for a single night's tale — a line of ingredients and a magic word, an optional co-author sibling's nickname and idea, and an optional pet name and kind of pet (the pet name also stays on your device; the kind of pet — "dog," "cat" — is sent as a story ingredient)

About you (the account holder):

• There are no passwords and no child accounts. Your subscription is your account, handled through Stripe
• The email address you use at Stripe checkout (and to restore your subscription on a new device), plus subscription status — payment card details are handled entirely by Stripe, our payment processor; we never see or store your card number

Optional reminder email. After your first story, you can choose to leave your email address to unlock two more free story nights and get a gentle note when each is ready. This is optional and for you, the adult: we send one welcome email right away (it confirms your free nights and offers a secure link to back up your story library so it follows you between devices), then at most two more notes — a gentle reminder or two, or on the free-week option a mid-week note and a week's-end wrap-up — three in total per sign-up. Every email includes a one-click unsubscribe that we honor permanently, your address is never joined to any information about your child, and for this purpose it is deleted or expires within about 90 days. Separately — only if you affirmatively ask for it, either by ticking the optional box for story ideas and news or by tapping the invitation in the last email of the free week and confirming on the page it opens — we'll send occasional product updates until you unsubscribe; that separate choice keeps your address until you opt out or after about two years of inactivity, and one click ends everything at once. We use an email delivery provider (Resend) solely to send these emails.

Optional library backup (off unless you turn it on). By default your saved stories live only in your browser, which means they can be lost if you change phones or clear your browser. If you want them to follow you, you can turn on library backup: you give us your email address, we email you a link or a short code to confirm it's yours, and from then on your saved stories are kept in our storage so any device you confirm can load them. Two things are true about that backup, and they are the whole point of it: your child's nickname and your pet's name are removed before anything leaves your device — the backup stores placeholders instead, and your own device puts the real names back when it displays a story — and your email address is stored only as a one-way hash, never as plain text, and never joined to anything about your child. Backed-up content is never sold, never used to train any model, and never used for advertising. You can turn backup off and delete the stored copy at any time from the saved-stories screen; your stories stay on your device either way. We also delete a backup automatically after 18 months with no use, so an abandoned library doesn't sit on our servers indefinitely. The one link we send to confirm your address goes out through our email provider (Resend), the same one described above.

Automatically: we use Cloudflare Web Analytics, a privacy-first tool that uses no cookies and collects no personal identifiers. It shows us aggregate counts like page views and country-level location.

Marketing pages and advertising. Our marketing pages (including our home page, pricing section, and post-purchase confirmation page) use cookies and similar technologies, including the Meta Pixel, to measure the effectiveness of our advertising. These pages do not collect or transmit any information about your child. We do not place advertising or analytics trackers on the story-creation, story, or generation screens. We never share your child's nickname, age, interests, story ingredients, or stories with any advertising platform. We also keep aggregate, anonymous usage tallies (for example, how many stories were created on a given day) that contain no identifiers of any kind, and we may ask you — optionally, after checkout — how you heard about us; that answer is tied to your subscription, never to your child's information. When the Pixel is blocked — as many browsers now do — our server may report the same measurement events to Meta directly through Meta's Conversions API. Those reports contain the event itself (for example, that a signup or purchase happened), the page address, your IP address and browser type, and Meta's cookie identifiers when present — never your email address, and never anything about your child.

4. How we use it

• To generate personalized stories — your child's age range, interests, and any optional story ingredients (Care Story topic, tonight's ingredients, an optional sibling's idea) are sent to our AI provider (Anthropic) at the moment a story is created, solely to write that story
• Your child's name is withheld. The nickname and any pet name never leave your device. Before a story is generated, we replace them with neutral placeholder tokens (like "CHILD_NAME_1"); the finished story comes back containing those tokens, and your device substitutes the real nickname back in locally. The AI provider never receives your child's name.
• To keep your story library on your device and manage your subscription and support requests

That's the whole list. We do not sell personal information, share it with advertisers, or use it to build marketing profiles. Your child's story details are never used for advertising, resale, profiling, or AI training.

5. AI processing

Stories are generated using Anthropic's Claude API. Under Anthropic's commercial API terms, data submitted through the API is not used to train their models. We send only the story ingredients described above — never your child's name or pet name, never your email, never payment details.

Story illustrations are generated by our hosting provider's AI service (Cloudflare Workers AI) from short scene descriptions written by the story engine. Those descriptions never contain your child's name or pet name — characters are described generically ("a young hero") — and the finished pictures are sent to your device, not stored on our servers.

6. Where data lives and how it's protected

• All traffic is encrypted in transit (HTTPS/TLS)
• Your child's nickname and interests live only in your browser's local storage on your device — never on our servers, under any circumstance
• Your saved stories and story library also live only in your browser — not on our servers — unless you turn on the optional library backup described in section 3. If you do turn it on, the backed-up copies still contain no child's name: the nickname and pet name are replaced with placeholders before anything leaves your device
• Our story-generation server never receives your child's name, and does not log children's inputs or story contents
• The subscription tokens we store to keep you unlocked contain no child data — only an anonymous device identifier and your subscription status
• Our servers and service providers are located in the United States — the information described in this policy is processed and stored there, and the protections in this policy apply regardless of where you live

7. Retention and deletion

• Because profiles and stories live on your device, deleting them is instant: clear them in the app or clear your browser storage, and they're gone. If you turned on library backup, clearing your browser does not remove the backed-up copy — use "turn off & delete" on the saved-stories screen, which erases it from our storage immediately
• To delete any subscription data we hold, email [email protected] — we verify and delete retrievable data associated with your account, completed within 30 days and confirmed by reply
• Payment records are retained by Stripe and in our accounting as required by law

8. Children's privacy (COPPA)

We take children's privacy seriously and designed the service to stay well clear of the line. The service is directed to parents; parents are our users and provide all information with consent through a one-time parent gate. The parent acts as the operator and intermediary — in-product prompts and communications are addressed to the parent, and the service does not knowingly communicate directly with children. We collect no photos, no voice recordings, no precise location, and no contact information for any child — and we never send a child's name to our AI provider. The only persistent identifiers the service uses are a randomly generated device token (which tracks free-trial use and keeps a subscription unlocked) and IP addresses (hourly rate limiting and free-trial abuse prevention — for example, stopping the same network from repeatedly resetting the free trial; the free-trial check stores only a one-way hash of the address, never the address itself) — used solely to support these internal operations, never to profile anyone, target advertising, or contact a child. Child story details are never used for advertising, resale, profiling, or AI training. Our full Children's Privacy Notice explains exactly what is collected, where it goes, and how to request deletion. If you believe a child has provided us information directly, contact us and we will delete it promptly.

9. Your rights

Wherever you live, we extend the same rights to everyone: access what we hold about you, correct it, export it, or delete it — just email us. California residents have these rights under the CCPA; we do not "sell" or "share" personal information as those terms are defined there. EU/UK residents have equivalent rights under GDPR, and our lawful bases are contract (providing the service you signed up for) and consent (the child information you choose to provide). Canadian residents have these same rights under PIPEDA: everything we collect rests on your meaningful consent, a parent or guardian provides any information about a child, and you may withdraw consent, or request access, correction, or deletion, at any time by emailing us.

10. Payments

Subscriptions are processed by Stripe, Inc. Stripe's handling of your payment data is governed by its own privacy policy at stripe.com/privacy.

11. Changes to this policy

If we make meaningful changes, we'll email account holders and note the new date at the top of this page. We will never quietly weaken the promises in the short version above.

12. Contact

Questions, requests, or concerns: [email protected]