Privacy Policy · Once Upon Us

Once Upon Us makes picture books starring your family. To do that, you tell us about your kids and your days, and a few AI services help write, paint and read the story. This page explains what that involves, in plain words.

Once Upon Us is made by Mind On Fire LLC ("we"). Questions go to hello@onceuponus.page.

The short version

The app is for parents and guardians. Kids don't have accounts. You decide what we know about them.
We use what you share to make your family's books, keep the service safe, and run it. We don't sell it, we don't use it for ads, and we don't train AI on it. The AI services we use don't train on it either.
Your books are private to your family and the grown-ups you invite. Books you share can be read by the people you send them to.
"Delete everything" in Family settings removes it all, for good, whenever you like.

Optional story reminders. The family's owner can ask for up to two gentle notes about starting or returning to a story. They are off until that owner chooses them in Family settings. We keep the browser's time zone to send between 9 a.m. and 7 p.m., wait at least 48 hours without activity, and space notes at least three days apart. Only the owner receives them. Turn them off in settings or with the unsubscribe link in any reminder. These are separate from book-ready emails and product news, contain no child names or private book details, and never make a new book automatically.

The free story library. Public stories use fictional families. If you choose “Save for tonight,” this browser stores only the public story IDs on your device so you can find them again. You can remove a favorite with the same button or clear your browser’s site data. Saving does not create an account or send your favorites to us. A reading invitation uses only time spent on visible pages in the current visit; it does not create a profile or block the rest of a story.

What we collect

Crashes and errors. Sentry helps us find and fix problems in the web, iPhone, iPad and Mac apps and the service behind them. Reports contain code locations, app release information, and technical details such as operating system, device model, failure counts and timing. We remove raw error messages, request bodies, private URLs, account and family identifiers, names, email addresses and story content before sending diagnostic events. We do not send photos, audio, screenshots, screen recordings or console logs to Sentry. The Apple SDK uses a random installation identifier to count healthy and crashed app sessions; we do not connect it to your account or use it for advertising. Sentry stores diagnostics in the United States under our project's retention settings. These diagnostics are separate from the family books and account records removed by “Delete everything.”

Your account. When you sign in with Apple, Google or an email code, we get your name, email address and profile picture (if Google has one) from our sign-in provider. If you choose to hide your email with Apple, we get a private address that Apple forwards to you. We keep when you signed up, when you last signed in, and when you agreed to this policy.

Your family. Whatever you type: your family's name, the names, nicknames, ages and pronouns of the people in it, how the kids look, and things they love.

Your stories. What you tell us for each book (what happened, where, the lesson you're working on, change requests and notes), and the books we make from it: the words, the pictures, the narration and every earlier version.

Photos, only when they're turned on. Photo uploads may not be on for your family yet; until they are, you describe your kids in words. When photos are on for your family, we store the photos you pick, a small thumbnail, and the date each photo was taken if the photo itself says so. We don't keep where a photo was taken: the app never sends it, and the photo files we keep carry no location.

Voice, only when it's turned on. The voice feature lets anyone in the room say "next page" or "again!", and lets a child say what a new story should be about (Wish a Story): only the idea a grown-up checks and approves on screen is kept, as that book's request, like anything you type. While the microphone is on, the audio streams to OpenAI, which turns it into words so the app can act on them. We never record or store the audio. The voice feature stays off until OpenAI has approved zero data retention for our account, which means it keeps none of the audio.

Recorded voices, from grown-ups only. With "Read by Dada", a grown-up in your family can record themselves reading a book, and you can send a link to someone you choose (a grandparent, say) so they can record one too. We store those recordings with your books, along with the name each reader gave. They are never sent to any AI service. Nothing a guest records plays for your kids until you approve it. We never ask children to record, and we don't keep the voice feature's audio at all.

Printable books. When you make a printable book, we store its PDF files with your family's books.

Books you send. With "Send this book", you can send one finished book to someone you choose (a grandparent, say) as a private link. Anyone with the link can read that book, with its pictures, narration and things to tap, without an account. They see your family's name and who you said it's for, and nothing else of your family's. We keep who you said it's for (if you say), when you made the link and when it was first opened, never who opened it. A link lasts 30 days. You can turn one off anytime on the book's page, and deleting the book or "Delete everything" turns off all of its links. Links are kept out of search engines, and the preview a messaging app shows for one never has your kids' names, the book's title or its pictures.

How the app is used. A record of each AI request made for your family (which service, how long it took and what it cost), and simple events about what happens in the app: a book was asked for, a page was turned, a story was read to the end, a book you sent was opened. Events carry ids, counts, times and yes/no flags, never names, story text, photos, audio or email addresses. They live in our own database. There are no third-party trackers, ad pixels or session recordings in the signed-in app or private readers. The public marketing website uses Google Analytics, described below.

Where you came from. If you join the early-access list from a link that says where it came from (like a newsletter), we keep that source and the referring website's name with your spot on the list, and copy it onto your family when you join. We note which page you first landed on when you join the waiting list. Our own site statistics use a random visit identifier in this tab, not tracking cookies. Browsers that send Do Not Track or Global Privacy Control are left out of this measurement.

Safety records. When our safety check stops something you typed, we keep which field it was and the kind of problem (for example, "violence"), never the words themselves. We keep the network address a request came from for up to 24 hours to limit sign-in guessing and sign-ups from one place.

Website analytics. Google Analytics runs by default on onceuponus.page to measure public page visits, campaign sources, form progress and interactions with our sample stories and films. It receives sanitized public page paths, referring website origins, browser/device and network information, and cookie identifiers. Event and user-level data in Google Analytics is set to expire after two months, without extending the user-data period for new activity; aggregate reports can remain longer. It does not receive names, email addresses, photos, private story content, private links, URL query strings or fragments from our events. We disable automatic form/link measurement, Google signals and advertising personalization. You can turn it off at any time using “Analytics preferences” in the website footer; this does not affect the site or app. Do Not Track and Global Privacy Control keep analytics off. Our separate first-party statistics continue unless your browser sends one of those signals. Google Analytics is never loaded in the signed-in app or private readers. How Google uses information.

Cookies and your choice. One cookie keeps you signed in, and two short-lived ones finish signing in. Google Analytics on the public website uses analytics cookies with a 30-day lifetime. Your analytics preference is saved in your browser. Change it at any time using “Analytics preferences” in the website footer; declining stops further measurement and removes the analytics cookies. Previously collected reports are not removed by changing this setting.

The early-access list. If you join the list on onceuponus.page, we keep your email address to send you your invitation, and one reminder if it goes unused for a few days. If you pick a lesson and art style for your first book, we keep those with your spot.

Who helps make each book

Each of these services only gets what it needs for its job, under business terms that don't let them use it to train their models:

Anthropic (Claude) writes each story. It sees your story details, and your family's names and descriptions. When photos are on, it also looks at the photos you pick, to describe what each one shows and what each person looks like.
OpenAI paints the pictures, looks at each finished picture next to your family's character drawings (to check everyone still looks like themselves) and finds things in it to tap, adds page details to each story (how a page moves, a question to ask, things to tap), checks typed words for safety, and writes the story when Claude is unavailable. It sees the whole story, including your family's names, descriptions of how people look, the finished pictures and character drawings, and everything you type (for the safety check); your photos only when photos are on (to draw your family from them), and the voice feature's audio only when voice is on.
Inworld reads the story aloud in the storyteller's voice. It sees the words on each page, including your family's names as they appear in the story.
Cloudflare runs the app, stores your family's books privately, and carries story-writing, picture and narration requests to Anthropic, OpenAI and Inworld through its AI Gateway. It holds everything above, for you, and is our backup for sending email.
WorkOS handles signing in. It sees your name and email address.
Resend sends our emails to you: your invitation, a welcome, and notes like "your book is ready". It sees your email address and the message, which never has your kids' names or your books' titles. It tells us whether a message was delivered, bounced or marked as spam, and we stop emailing an address that bounces or complains. We don't track whether you open our emails or click their links.
Apple, only if you choose "Continue with Apple". It sees what you already share with Apple to sign in.
Google, only if you choose "Continue with Google". It sees what you already share with Google to sign in.
fal brings a few pages to life as short clips. It sees a finished page picture. (Clips are off during early access.)

Story writing and pictures go through Cloudflare's AI Gateway with request logging off, and we request zero data retention from Anthropic and OpenAI. Availability depends on the provider, model and route; a request header alone is not a guarantee. Family photos and private drawings made from them use separate, reviewed gateway routes with logging and caching disabled. If that route is missing or its model has not been reviewed, our app refuses the request before sending the photo and makes the page without it. Provider exceptions still apply: OpenAI says an image flagged as potential child sexual abuse material may be retained for manual review even under zero data retention. We cannot promise exception-free deletion by an AI provider. Photo uploads are available to invited families under these controls and exceptions. Your uploads and books remain in our private app storage as described below. See OpenAI's data controls and Cloudflare's Unified Billing retention terms.

Narration goes through the same gateway to Inworld, which sees the words on each page; zero data retention does not cover it. A finished picture or recording can remain in Cloudflare's gateway storage for up to a day, independently of the private copy we store with your family's books. Your uploaded photos and books stay in our private storage until deleted as described below; provider zero data retention does not mean that the app stores nothing. For the safety check, OpenAI may keep what we send for up to 30 days to watch for abuse, then delete it. The voice feature stays off until OpenAI has approved zero data retention for our account.

We don't use Google's AI (Gemini) at all.

How we use it

To make, show and read your family's books.
To keep the service safe: we check typed words with OpenAI's moderation service before they reach the storyteller, and we limit how much any one family or network can do.
To run the service: fix problems, watch costs, and know when something breaks.
To write to you about your account or early access. No marketing email without asking.

We don't sell or rent your information, we don't use it for advertising, and we don't train AI on it.

We look at a family's data only to fix a problem you've asked us about, to keep the service safe, or when the law requires it.

Children

Once Upon Us is for grown-ups. Children don't sign up or sign in. As a parent or guardian, you choose what to tell us about your kids, and you agree, when you start, that we may use it (and share it with the services above) to make their books. You can see and change everything about your kids in the app, and delete any of it at any time.

If you think a child has given us information without a parent, write to hello@onceuponus.page and we'll delete it.

How long we keep things

Your books, family details and photos: until you delete them. Deleted stories sit in "Recently deleted" until you remove them for good.
Links to books you send: 30 days, or until you turn one off on the book's page or delete the book, whichever comes first.
"Delete everything" (Family settings, for the family's owner) removes every photo, drawing, story, picture, narration, recorded voice, printable book and link to a book you sent, your family's usage events and safety records, and your account and your co-parents' accounts (except one that also belongs to another family), right away.
Backups: our database keeps rolling backups for up to 30 days, so deleted information is gone from them within 30 days.
Network addresses for sign-in limits: 24 hours.
The early-access list: until you ask us to take you off it.

Your choices

You can see, change or delete everything about your family in the app. To get a copy of your family's information, or for anything the app doesn't do, write to hello@onceuponus.page. We'll answer within 30 days. Depending on where you live (for example, California or the EU), you may have more rights over your information; we'll honor them.

Keeping it safe

Everything is sent over encrypted connections and stored privately with Cloudflare. Pictures and narration are only served to your signed-in family, and, for a book you send, to whoever has its link until it's turned off or runs out. No system is perfect, and if something goes wrong that affects your family, we'll tell you.

Where it's kept

We're in the United States, and so are the services we use. If you're elsewhere, your information is processed in the US.

Changes

If we change this policy in a way that matters, the app will ask you to read it and agree again before you make another book. The date at the top says when it last changed.

Contact

Mind On Fire LLC · hello@onceuponus.page