Privacy Policy

1. Who we are

Grow Story Time is a family entertainment web app for creating, saving, reading and listening to stories.

Grow Story Time is a family entertainment service operated by Red Ox Ventures LLC.

This policy explains how the current product collects, uses, stores, and shares information when a family uses the service.

2. Who the service is for

Grow Story Time is designed for parents, guardians, and other adult caregivers. Children may listen to stories and take part in the experience with their family, but they should not create an account on their own or provide information directly without adult supervision.

The account belongs to the adult. When an adult provides information about a child, the adult represents that they have authority to do so.

Grow Story Time is family entertainment. It is not an educational service, therapeutic platform, psychological tool, medical service, parenting-advice service, or diagnostic or treatment service. It does not provide emergency services.

References to ‘learning and growing’ are part of the brand's emotional and narrative promise and do not constitute a guarantee of educational, behavioral, psychological, or medical outcomes.

3. Information we collect

Depending on the features a family uses, we may process these categories of information:

• Account and authentication: account identifier, sign-in provider, email address when available, and verification status. We do not store a Google account password or a password for email-link sign-in.
• Family and children: adult names; a child's name or nickname; date of birth when provided; calculated age; and an optional visual profile selection.
• Content the family writes: family situations, needs, fun details, names, places, friends, and other information the family chooses to include when searching for, recommending, or creating a story.
• Stories and library: created stories, versions, saved stories, favorites, editorial metadata, and selected narrators.
• Audio: system-generated audio and, when the family chooses to record, personal voice recordings and related metadata.
• Technical and security data: session cookies, a temporary visitor identifier, hashes used to limit abuse — including a hash derived from the network address — and technical records needed to operate and protect the service.
• Product metrics: visits, flow steps, playback, listening percentages, timings, and other limited operational events. The audited telemetry does not include a free-text field for storing what a family writes in a story.
• Referrals and attribution: referral code, campaign, and normalized referring site when available.
• Family invitations: information and cryptographic proofs needed to invite or join accounts to a family, including information related to the invited email address when applicable.
• Subscription, when a family subscribes to Premium: a customer and subscription identifier from our payment processor, the plan, its status, the currency, and the start and end dates of the period. We do not receive or store your card number, expiry date, or security code: those details are entered on a page hosted by the payment processor and never pass through our servers.

Before registration, certain drafts may remain temporarily in the browser. If a visitor generates a first story without an account, the server temporarily keeps that story so it can be associated with the account if the visitor decides to register.

4. How we use information

We use information to provide the features a family requests and to operate the service, including to:

• create, recommend, and personalize stories;
• calculate an appropriate age from a date of birth when one is provided;
• maintain the family profile, library, favorites, narrators, and version history;
• generate text and audio and play requested narrations;
• temporarily recover drafts and a visitor's first story during the registration flow;
• authenticate accounts, separate content between families, and protect private content;
• prevent abuse, excessive automation, and unauthorized resource use;
• measure product operation, detect failures, and understand where an experience stops;
• attribute referrals and campaigns; and
• respond to support and privacy requests when a confirmed channel is available.

We do not use children's information for targeted advertising. The current product also does not implement behavior-based targeted advertising to families.

5. Artificial intelligence

Grow Story Time uses Google Vertex AI and Gemini models for story generation and recommendation features. When a family requests one of these functions, the content needed to produce the response is sent to Google. This may include the situation described by the family, details included in the prompt, story parameters, and related context.

The current product does not train its own model on family content. Google's current Vertex AI data-governance documentation states that Google will not use Customer Data to train or fine-tune AI/ML models without the customer's prior permission or instruction. Some Vertex AI configurations may temporarily retain data for abuse monitoring or caching; this policy does not promise zero retention unless the applicable configuration and service guarantee it.

Product telemetry is designed not to copy free-text story content into usage events. Even so, families should avoid including sensitive information that is not necessary for the story or recommendation they request.

6. Audio and recordings

System-generated audio is produced from story text using Google Cloud Text-to-Speech and is stored so the family can play it later. Google's current Cloud Text-to-Speech documentation states that the service does not log customer text or audio data.

Personal recordings are human recordings voluntarily made by a family. The current system explicitly treats them as human recordings: recording a voice does not constitute or imply consent to clone, enroll, or synthesize that voice as an AI voice.

Human narrations are kept as private family content. Audio files are stored in object storage, while the database stores the metadata and references needed to locate and play them.

7. Information about children

An adult may provide a child's name or nickname, date of birth, age, family situations, and other child-related details to adapt recommendations and stories to the child's stage and context. The adult may also add names, friends, places, or other elements that make a story feel familiar.

We use this information to calculate age when appropriate, select content, generate or recommend stories, maintain the family library, and produce requested audio.

We do not sell children's personal information and we do not use it for targeted advertising. Information needed to provide the experience may still be processed by service providers that perform essential functions such as authentication, AI, voice, hosting, database, and storage.

The adult may request access, correction, a copy, or deletion of information about a child through the channel listed in Contact. The current product does not implement a separate verifiable parental consent mechanism; this policy does not claim that such a mechanism exists.

8. When we share information

Selling information is not the same as using service providers to operate the product. We do not sell personal or children's information. The product audit confirmed these provider categories:

• Authentication: Google/Firebase Authentication, for Google or email-link sign-in and identity verification.
• AI: Google Vertex AI/Gemini, for story generation and recommendation.
• Voice: Google Cloud Text-to-Speech, to produce synthesized audio at the family's request.
• Hosting and execution: Google Cloud Run.
• Database: PostgreSQL on Google Cloud SQL.
• Storage: Google Cloud Storage.
• Web resources: Google infrastructure used for Firebase in the browser and Google Fonts on pages that load those fonts.
• Payments, when a family subscribes to Premium: Stripe, to process the subscription charge, store the payment method, issue receipts, and manage the subscription. Stripe processes that information as its own controller, under its own privacy policy.

What our payment processor is NOT sent: not a child's name, not their age, not what a family tells us about them, not the text of a story, not audio, not a recording. It receives only what is needed to charge: the account's confirmed email address, the plan, and what it needs for the payment, the tax, and the receipt.

The audit did not identify a separate analytics provider or a separate email provider for the sign-in link: product metrics are stored in the product's own infrastructure and the sign-in link is handled through Firebase Authentication.

We may also disclose information when reasonably necessary to comply with a valid legal obligation, protect the safety or rights of people and the service, or manage a legitimate corporate transaction. A corporate transaction does not by itself authorize uses that are incompatible with this policy.

9. Cookies and local storage

The service uses cookies and browser storage for specific purposes:

• Session: a signed cookie lets the server recognize an authenticated account across requests. Your session remains open until you sign out or its access configuration expires.
• Temporary visitor: a signed cookie containing a random value lasts 6 hours. It recognizes the same visitor during the first experience and applies usage limits; it does not grant access to a family. Stories created without an account do not depend on this cookie to survive: they are kept for 30 days and reached through each story's own link.
• Referrals: an attribution cookie may remember the referral code, campaign, and referring site for 30 days before registration.
• Drafts: localStorage may keep the Create draft on the device for up to 6 hours.
• Flow continuation: sessionStorage may temporarily keep information in that browser tab so the person can return to the correct point after a registration detour.
• Email-link sign-in: the browser may temporarily store the email address needed to complete email-link sign-in and remove it after the flow is completed.
• Language: interface language is reflected in the /es/ or /en/ route; we do not use a separate language-preference cookie.

10. Data retention

We keep data according to its purpose. This table explains retention periods and the categories that currently have no automatic deletion:

11. Security

We use technical and organizational measures intended to protect information. Measures confirmed in the current product include Google/Firebase identity verification, signed session cookies, sensitive cookies configured so JavaScript cannot read them, server-side family separation, ownership checks for private content, and separation between the administrative Studio and the public family service.

Human recordings are restricted by the data model to private content. The product also limits anonymous attempts using identifiers and hashes that are not used as family identity.

No storage or transmission system can guarantee absolute security. We do not publish secrets, credentials, or exploitable internal implementation details in this policy.

12. Family rights and choices

A family may request, as applicable, access to its information, correction, a copy, deletion, and an explanation of how information about children is used. A person may also withdraw consent where processing depends on consent and request an appeal where applicable law provides that right.

Some item-level deletion exists today. There is no automatic tool that deletes the sign-in account, every relational row, every stored object, and every possible copy in one operation. Comprehensive privacy requests are handled through the channel listed in Contact once that channel is configured.

13. U.S. state privacy

Depending on a person's state of residence and applicable law, they may have rights concerning personal information, such as knowing or accessing certain data, correcting it, deleting it, obtaining a copy, and opting out of certain sales or targeted advertising.

As a product practice, we aim to offer families reasonable access, correction, copy, and deletion options even when the precise scope of a legal right depends on residence. Grow Story Time does not sell personal or children's information and does not use children's information for targeted advertising.

This section includes families in Texas without stating that any particular statute does or does not apply to Red Ox Ventures LLC in a specific situation. Where an appeal right applies, it may be submitted through the privacy channel listed in Contact.

14. International transfers

Grow Story Time uses Google infrastructure and service providers. Although the primary audited configuration uses Google Cloud resources in the United States, this policy does not guarantee that all information remains exclusively in the United States. A provider may process information from other locations according to its infrastructure, configuration, and applicable terms.

We do not promise geographic residency that the system and contracts do not guarantee.

15. Changes to this policy

We may update this policy when the product, its providers, or our practices change. The last-updated date will appear at the top once it has been confirmed.

If a change materially changes how we process information about children, we will review whether additional notice or new consent is required before applying the change.

Before activating information-processing features that do not exist today, we will review this policy so it continues to describe the product that is actually offered.

16. Contact

Grow Story Time
Red Ox Ventures LLC

For privacy, access, correction, copy, deletion, or appeal requests, email hello@growstorytime.com.

Where an appeal is available, it may be submitted through the same contact channel.