StoryTap Privacy Policy

Effective date: 19 May 2026
Version: Draft v1.0 for legal review
Controller: TEKBIZ OÜ, registry code 17128684, Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
Privacy contact: help@storytap.app

This Privacy Policy explains how TEKBIZ OÜ (“StoryTap”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you use StoryTap.

StoryTap is a mobile app that lets parents or guardians scan physical children’s book pages and create private interactive page packages that can be used offline by children under adult supervision.

Important: This Privacy Policy is a practical launch draft and should be reviewed by qualified counsel before public release, especially for GDPR, children’s privacy, COPPA if targeting or attracting US children, app store family policies, consumer law, AI providers, analytics, and cross-border transfers.

---

1. Privacy summary for parents

StoryTap is designed around privacy and offline use.

In plain language:

• StoryTap is for parents and caregivers to set up and manage.
• Children should not need to create accounts.
• We do not sell personal data.
• We do not use third-party advertising.
• We do not use behavioral ad tracking.
• We do not create a public library of scanned books.
• Saved books are stored locally on your device by default.
• A scan is uploaded only when you ask StoryTap to analyze a new page.
• The uploaded scan is processed to generate an interactive page package.
• Raw scanned images are not stored permanently on our servers by default.
• Normal child interactions, such as tapping objects, reading saved pages, and playing saved games, happen locally after the page package is generated.
• You can delete local books and request deletion of account data.

---

2. Who this policy applies to

This policy applies to:

• parents, guardians, teachers, and other adults who install, set up, purchase, or manage StoryTap;
• children who use child-facing parts of StoryTap under adult supervision;
• visitors to our website or support channels;
• beta testers and users of preview versions.

StoryTap is not designed to let children create public profiles, send messages, upload content publicly, interact with strangers, or share scanned books publicly.

---

3. Controller information

The data controller for StoryTap is:

TEKBIZ OÜ
Registry code: 17128684
Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
Email: help@storytap.app

For privacy requests, use the email above or the in-app privacy request flow if available.

---

4. Data we collect

The data we collect depends on how you use StoryTap.

4.1 Account data

If you create an account, we may collect:

• email address;
• authentication identifiers;
• account ID;
• login provider information, such as Apple or Google sign-in identifier;
• account creation date;
• account status;
• deletion status.

4.2 Purchase, entitlement, and credit data

If you use free credits, subscriptions, or scan packs, we may process:

• plan name;
• subscription status;
• scan credit balance;
• credit ledger entries;
• purchase identifiers;
• billing event IDs;
• app store or payment provider entitlement status;
• renewal, cancellation, refund, or restore-purchase events;
• country or region information provided by the store or payment provider.

We do not receive full payment card details when payment is handled by Apple App Store, Google Play, RevenueCat, Stripe, or another payment provider.

4.3 Scanned page data

When you scan a page and ask StoryTap to analyze it, we may process:

• the scanned page image;
• scan type, such as single page or double-page spread;
• selected language;
• selected child age range or reading mode;
• book title if you provide one;
• local page ID generated by the app;
• extracted OCR text;
• detected text blocks;
• detected objects;
• object labels;
• colors or categories;
• bounding boxes;
• tap responses;
• generated game prompts;
• safety flags;
• package version and metadata.

Scanned pages may accidentally contain personal data if a book has a handwritten dedication, child name, photo, address, school name, library card, label, or other identifying information. Please review what you scan.

4.4 Local device data

StoryTap stores some information locally on your device, such as:

• scanned page images;
• generated interactive page packages;
• local books and pages;
• local app settings;
• cached entitlement state;
• cached audio if premium voice features are introduced;
• local database records;
• offline-ready status.

Local device data normally stays on your device unless you choose to upload a page for analysis, enable optional sync or backup, contact support with files, or opt in to diagnostics that include additional data.

4.5 Diagnostics, logs, and telemetry

To operate and improve StoryTap, we may collect privacy-safe diagnostics such as:

• app version;
• device type and operating system version;
• language setting;
• approximate region if provided by app stores or system settings;
• crash reports;
• error logs;
• scan started, scan confirmed, analysis success, analysis failure;
• page opened, game started, game completed;
• purchase started and purchase completed;
• provider, model, token usage, duration, retry count, cost metadata, and success/failure metadata for analysis.

By default, we try not to log:

• raw page images;
• full OCR text;
• child identity;
• precise location;
• advertising ID;
• contact list;
• microphone recordings;
• child voice recordings.

4.6 Feedback and support data

If you contact us or submit feedback, we may process:

• your email address;
• support message;
• screenshots or attachments you choose to send;
• rating or quality feedback;
• issue category;
• device and app version information;
• support history.

Do not send sensitive personal information unless needed for your support request.

4.7 Optional future features

If we introduce optional features such as cloud backup, multi-device sync, premium natural voices, translation, teacher mode, or parent corrections, we may process additional data needed for those features. We will explain this in the app and update this Privacy Policy where required.

---

5. Data we try not to collect

StoryTap is designed to avoid unnecessary children’s data.

We do not intentionally require:

• child accounts;
• child full names;
• child email addresses;
• child phone numbers;
• child face scans;
• child voice recordings;
• precise GPS location;
• contact list access;
• public child profiles;
• social messaging between children;
• behavioral advertising identifiers;
• third-party advertising SDKs.

If a scanned page or support attachment accidentally includes such information, we will process it only as necessary to provide the Service, support the user, comply with law, protect rights, or delete it.

---

6. How we use data

We use personal data for the following purposes:

| Purpose | Examples | Legal basis under GDPR | |---|---|---| | Provide the Service | Account, login, local book setup, scan analysis, package generation, entitlement checks | Contract or steps before contract | | Process scans | Analyze page image, extract text, detect objects, generate tap responses and games | Contract; legitimate interests; consent where required | | Manage purchases and credits | Subscriptions, scan packs, free credits, restore purchases, credit ledger | Contract; legal obligation; legitimate interests | | Keep the Service safe | Abuse prevention, rate limiting, fraud prevention, safety validation | Legitimate interests; legal obligation where applicable | | Support users | Respond to messages, investigate bugs, handle refunds or complaints | Contract; legitimate interests | | Improve reliability | Crash reports, error rates, performance, failed scan analysis | Legitimate interests | | Comply with law | Tax, accounting, consumer law, legal requests | Legal obligation | | Send service messages | Important account, billing, security, or policy updates | Contract; legal obligation; legitimate interests | | Optional marketing | Product updates or launch communications if you opt in | Consent or legitimate interests where permitted |

We do not use scanned pages for third-party advertising.

We do not sell personal data.

---

7. How page analysis works

When you ask StoryTap to analyze a new page:

1. The app compresses or prepares the image.
2. The image is uploaded to StoryTap’s backend over HTTPS.
3. The backend checks entitlement and scan credits.
4. The backend sends the image or derived data to an AI analysis provider or vision/OCR provider.
5. The provider returns structured output such as text, objects, bounding boxes, labels, and game prompts.
6. StoryTap validates the output and safety flags.
7. StoryTap returns an interactive page package to your device.
8. The app stores the scanned image and package locally.
9. Raw uploaded images are deleted from temporary server storage by default after processing, unless temporary retention is required for debugging, security, legal compliance, or you explicitly opt in to sending data for support.

After that, saved page interactions normally happen locally on your device.

---

8. AI providers and training

StoryTap may use third-party AI, OCR, vision, translation, or text-to-speech providers to provide page analysis or optional premium features.

We will aim to use providers and configurations that do not use your uploaded scans to train their general models unless you have explicitly opted in or unless we update the policy and obtain any legally required consent.

Before public launch, StoryTap should publish or maintain a subprocessor list identifying key providers used for hosting, AI analysis, purchases, analytics, crash reporting, and support.

---

9. Children’s privacy

StoryTap is intended to be set up and controlled by a parent, guardian, teacher, or other responsible adult.

We do not ask children to create accounts or provide contact details.

Where parental consent is required by law, the adult who installs, sets up, purchases, or manages StoryTap confirms that they are the parent, guardian, teacher, or authorized adult and that they consent to the processing needed to provide the Service.

Parents can:

• control what is scanned;
• review generated pages before child use;
• delete local books and pages;
• request account deletion;
• contact us about privacy questions;
• withdraw consent where processing is based on consent.

If you believe a child provided personal data to us without appropriate permission, contact us and we will take reasonable steps to delete or restrict that data.

---

10. No ads and no behavioral advertising

StoryTap does not use third-party advertising or behavioral advertising in child-facing experiences.

We do not sell or share children’s data for advertising.

We do not use scanned book pages to target ads.

If this changes in the future, we will update this policy and obtain any legally required consent before using such features. The current product direction is no ads.

---

11. Local storage and deletion

StoryTap stores scanned books locally by default. You can delete:

• a page;
• a book;
• all local app data;
• cached audio;
• local settings;
• local packages.

Deleting local data removes it from that device. It may not delete:

• server-side account data;
• app store purchase records;
• payment provider records;
• backups outside StoryTap’s control;
• support messages you sent;
• data retained for legal, tax, accounting, security, or dispute purposes.

To delete server-side account data, use the in-app account deletion flow if available or contact us.

---

12. Retention

We keep data only as long as reasonably necessary for the purposes described in this policy.

Indicative retention rules:

| Data type | Typical retention | |---|---| | Raw uploaded scan image | Temporary processing period only by default; deleted after analysis unless needed for support, debugging, security, or legal reasons | | Local scanned image | Until you delete the page, book, local data, or app from your device | | Interactive page package | Until you delete the page, book, local data, or app from your device | | Account data | While the account is active, then deleted or anonymized after account deletion unless retention is required | | Purchase and credit ledger | As needed for subscriptions, restore purchases, accounting, tax, fraud prevention, disputes, and legal compliance | | Support messages | As needed to resolve the issue and maintain reasonable support records | | Crash and diagnostic logs | For a limited operational period, then deleted or aggregated | | Security logs | For a limited period needed to protect the Service and investigate abuse |

Exact retention periods may depend on provider settings, legal requirements, and technical implementation.

---

13. Sharing personal data

We may share personal data with service providers that help us operate StoryTap, such as:

• cloud hosting providers;
• database and storage providers;
• AI, OCR, translation, or TTS providers;
• app store and purchase entitlement providers;
• authentication providers;
• crash reporting and diagnostics providers;
• customer support tools;
• security and abuse-prevention providers;
• professional advisors, accountants, auditors, insurers, or lawyers;
• authorities where required by law.

Service providers must process personal data only for our instructions or as otherwise legally permitted.

We do not sell personal data.

We do not create a public searchable library of scanned book pages.

---

14. International transfers

TEKBIZ OÜ is established in Estonia. Some providers may process data in the European Economic Area, the United States, or other countries.

Where personal data is transferred outside the EEA, we will use appropriate safeguards where required, such as adequacy decisions, standard contractual clauses, provider data processing agreements, or other lawful transfer mechanisms.

---

15. Security

We use reasonable technical and organizational measures to protect personal data, such as:

• HTTPS for network transfers;
• access controls;
• secure storage of secrets;
• temporary processing of raw scans by default;
• upload size limits;
• validation and safety checks;
• no public blob URLs for user scans;
• minimized logs;
• deletion controls;
• provider access restrictions.

No system is perfectly secure. You are responsible for securing your device, app store account, login method, backups, and local files.

---

16. Your GDPR rights

If GDPR applies to you, you may have the right to:

• be informed about processing;
• access your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• receive data portability;
• object to certain processing;
• withdraw consent where processing is based on consent;
• not be subject to decisions based solely on automated processing where the law provides that right;
• complain to a data protection authority.

To exercise your rights, contact us at help@storytap.app.

We may need to verify your identity or authority before acting on a request. Some requests may be limited by legal, security, accounting, fraud-prevention, dispute, or technical reasons.

If you are in Estonia, you may contact the Estonian Data Protection Inspectorate. If you are elsewhere in the EEA, you may contact your local supervisory authority.

---

17. US children’s privacy note

If StoryTap is made available to users in the United States and is directed to children under 13 or knowingly collects personal information from children under 13, the Children’s Online Privacy Protection Act and its rules may apply.

StoryTap is designed so that parents, not children, create accounts and control scanning, purchases, and settings. If required, we will provide direct parental notice and obtain verifiable parental consent before collecting, using, or disclosing personal information from children in a way that requires such consent.

Parents may contact us to review, delete, or stop further collection of a child’s personal information where required by applicable law.

---

18. Website, cookies, and landing pages

If StoryTap operates a website or landing page, we may use essential cookies or similar technologies to operate the site, measure basic performance, prevent abuse, and remember preferences.

We should not use behavioral advertising cookies for child-directed experiences.

If non-essential cookies are used, the website should provide appropriate notice and consent controls where required.

---

19. Marketing communications

We may send service messages about your account, subscription, credits, security, support, or policy changes.

We may send marketing messages only where legally permitted. You can unsubscribe from marketing emails using the unsubscribe link or by contacting us.

We do not send marketing messages directly to children.

---

20. Automated decisions

StoryTap uses automated analysis to generate page packages and safety flags. This affects the generated content and credit consumption but should not produce legal or similarly significant effects about a person.

If an analysis fails or produces incorrect results, you may retry, delete the page, or contact support. Failed analysis should not consume a credit.

---

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice in the app, by email, or by another appropriate method.

The updated policy will apply from the effective date shown.

---

22. Contact

For privacy questions, data requests, or concerns, contact:

TEKBIZ OÜ
Registry code: 17128684
Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
Email: help@storytap.app