Privacy Policy

Once Upon Us makes picture books starring your family. To do that, you tell us about your kids and your days, and a few AI services help write, paint and read the story. This page explains what that involves, in plain words.

Once Upon Us is made by Mind On Fire LLC ("we"). Questions go to hello@onceuponus.page.

The short version

• The app is for parents and guardians. Kids don't have accounts. You decide what we know about them.
• We use what you share to make your family's books, keep the service safe, and run it. We don't sell it, we don't use it for ads, and we don't train AI on it. The AI services we use don't train on it either.
• Your books are private to your family and the grown-ups you invite.
• "Delete everything" in Family settings removes it all, for good, whenever you like.

What we collect

Your account. When you sign in with Google or an email code, we get your name, email address and profile picture (if Google has one) from our sign-in provider. We keep when you signed up, when you last signed in, and when you agreed to this policy.

Your family. Whatever you type: your family's name, the names, nicknames, ages and pronouns of the people in it, how the kids look, and things they love.

Your stories. What you tell us for each book (what happened, where, the lesson you're working on, change requests and notes), and the books we make from it: the words, the pictures, the narration and every earlier version.

Photos, only when they're turned on. Early-access families describe their kids in words; photo uploads and the voice feature are off for now. When photos are on for your family, we store the photos you pick, a small thumbnail, and the date and place each photo was taken if the photo itself says so.

Voice, only when it's turned on. The voice feature lets anyone in the room say "next page" or "again!". While the microphone is on, the audio streams to OpenAI, which turns it into words so the app can act on them. We never record or store the audio.

How the app is used. A record of each AI request made for your family (which service, how long it took and what it cost), and simple events about what happens in the app: a book was asked for, a page was turned, a story was read to the end. Events carry ids, counts, times and yes/no flags, never names, story text, photos, audio or email addresses. They live in our own database. There are no third-party trackers, ad pixels or session recordings, in the app or on onceuponus.page.

Where you came from. If you join the early-access list from a link that says where it came from (like a newsletter), we keep that source and the referring website's name with your spot on the list, and copy it onto your family when you join. The site sets no cookies, and browsers that send Do Not Track or Global Privacy Control are left out of this.

Safety records. When our safety check stops something you typed, we keep which field it was and the kind of problem (for example, "violence"), never the words themselves. We keep the network address a request came from for up to 24 hours to limit sign-in guessing and sign-ups from one place.

Cookies. One cookie keeps you signed in, and two short-lived ones finish signing in. That's all.

The early-access list. If you join the list on onceuponus.page, we keep your email address to send you your invitation.

Who helps make each book

Each of these services only gets what it needs for its job, under business terms that don't let them use it to train their models:

• Anthropic (Claude) writes each story. It sees your story details, and your family's names and descriptions.
• OpenAI paints the pictures, reads the story aloud, checks typed words for safety, and writes the story when Claude is unavailable. It sees the story's words and scenes, descriptions of how people look, and everything you type (for the safety check); photos and voice only when those are on.
• Cloudflare runs the app, stores your family's books privately, and carries story-writing requests to Anthropic and OpenAI through its AI Gateway. It holds everything above, for you.
• WorkOS handles signing in. It sees your name and email address.
• Google, only if you choose "Continue with Google". It sees what you already share with Google to sign in.
• fal brings a few pages to life as short clips. It sees a finished page picture. (Clips are off during early access.)

Story writing goes through Cloudflare's AI Gateway with zero data retention turned on and request logging off. For pictures, narration and the safety check, OpenAI may keep what we send for up to 30 days to watch for abuse, then delete it. We keep photos and voice off for early-access families until OpenAI has approved zero data retention for our account, which means it keeps none of it.

We don't use Google's AI (Gemini) at all.

How we use it

• To make, show and read your family's books.
• To keep the service safe: we check typed words with OpenAI's moderation service before they reach the storyteller, and we limit how much any one family or network can do.
• To run the service: fix problems, watch costs, and know when something breaks.
• To write to you about your account or early access. No marketing email without asking.

We don't sell or rent your information, we don't use it for advertising, and we don't train AI on it.

We look at a family's data only to fix a problem you've asked us about, to keep the service safe, or when the law requires it.

Children

Once Upon Us is for grown-ups. Children don't sign up or sign in. As a parent or guardian, you choose what to tell us about your kids, and you agree, when you start, that we may use it (and share it with the services above) to make their books. You can see and change everything about your kids in the app, and delete any of it at any time.

If you think a child has given us information without a parent, write to hello@onceuponus.page and we'll delete it.

How long we keep things

• Your books, family details and photos: until you delete them. Deleted stories sit in "Recently deleted" until you remove them for good.
• "Delete everything" (Family settings, for the family's owner) removes every photo, drawing, story, picture and narration, your family's usage events and safety records, and your account (unless you also belong to another family), right away.
• Backups: our database keeps rolling backups for up to 30 days, so deleted information is gone from them within 30 days.
• Network addresses for sign-in limits: 24 hours.
• The early-access list: until you ask us to take you off it.

Your choices

You can see, change or delete everything about your family in the app. To get a copy of your family's information, or for anything the app doesn't do, write to hello@onceuponus.page. We'll answer within 30 days. Depending on where you live (for example, California or the EU), you may have more rights over your information; we'll honor them.

Keeping it safe

Everything is sent over encrypted connections and stored privately with Cloudflare. Pictures and narration are only served to your signed-in family. No system is perfect, and if something goes wrong that affects your family, we'll tell you.

Where it's kept

We're in the United States, and so are the services we use. If you're elsewhere, your information is processed in the US.

Changes

If we change this policy in a way that matters, the app will ask you to read it and agree again before you make another book. The date at the top says when it last changed.

Contact

Mind On Fire LLC · hello@onceuponus.page