1. Introduction
Once Upon a Workday ("we," "us," or "our") is committed to protecting the privacy of our users and their families. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at onceuponaworkday.com and our story creation services (collectively, the "Service").
We are especially mindful that our Service involves information about children. We apply protections modeled on the Children's Online Privacy Protection Act (COPPA) to children's information, and we comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.
2. Information We Collect
Account Information
- Email address and display name
- Authentication credentials (managed by our authentication provider)
- Language preference
Family Member Information
- Names, ages, and roles (parent, child, sibling, etc.) of family members you add
- Photos you upload for character illustration
- AI-generated appearance descriptions derived from uploaded photos
Story Content
- Profession and work scenario selections
- Generated story text and AI-created illustrations
- Voice recordings you create for story narration
- Ratings and reviews you leave on stories
Usage Information
- Story creation history and reading activity
- Feature usage patterns
- Device and browser information for security and compatibility
- A record of each time you agree to our terms or tick a confirmation before a purchase: the wording you agreed to, the date, your IP address and your browser
Print Orders
- The recipient's name, shipping address, phone number and email address
- The email address of a gift recipient, if you ask us to tell them a book is on its way
Family Access
- The email address of each person you invite to read your stories
- Whether and when we emailed the invitation, and when the invitation link was first opened
- When the people you invited read your stories, if you ask to be notified
Payment Information
Payment processing is handled entirely by our payment processor. We do not store credit card numbers, bank account details, or other financial information on our servers. We only receive confirmation of payment status and a customer reference from the processor.
3. How We Use Your Information
Essential Service Operations
- Creating and delivering personalized stories
- Generating AI illustrations based on your selections
- Managing your account, subscription, and billing
- Processing voice recordings for story narration
- Providing customer support
Product Improvement
- Analyzing anonymized, aggregated usage patterns to improve the Service
- Monitoring AI output quality (we review outputs, not your personal data)
- Generating anonymized community statistics (shown on our public Insights page)
- Fixing bugs and improving performance
Communications (with your consent)
- Sending product updates, tips, and story suggestions
- Referral program notifications
- You can opt out of marketing communications at any time from your profile settings
4. What We Never Do
- We never sell your personal data to third parties
- We never sell or share children's information for any commercial purpose
- We never use family photos for AI model training
- We never serve targeted advertisements based on your data
- We never share your stories, photos or voice recordings with anyone except the service providers that help us create and deliver them (section 5), the family members you invite, and the community library if you choose to publish a story
5. Service Providers
We use service providers to run the Service. They process your information only on our instructions, only for the purposes below, and under contracts that require them to protect it.
| Type of provider | What for | What they receive |
|---|---|---|
| Cloud hosting and database | Running the website and storing your account | Account details, the content you create, standard request data (IP address, browser) |
| File storage | Storing photos, illustrations, recordings and book files | The files themselves |
| AI language models | Writing and translating stories, describing a family member's appearance from a photo, and checking photos and text for safety | Story details you enter (names, ages, roles, profession, situation), family photos you upload, and text you write |
| AI image models | Drawing the illustrations | Drawing instructions, appearance descriptions, and the photos or drawn looks you choose to use |
| Speech recognition | Checking voice recordings for safety before they are shared | Your voice recordings |
| Payment processor | Taking payments | Your email address and name; card details go directly to the processor, never to us |
| Printing and shipping partner | Printing and delivering books you order | The recipient's name, address, phone number and email address, and the book itself, including its pictures |
| Address lookup | Completing and checking shipping addresses | The address you type |
| Email delivery | Sending account, order, invitation and notification emails | The recipient's email address and the message |
| Sign-in and security | Signing in with Google (if you choose it) and stopping automated sign-ups | Your Google account email, name and picture; browser signals |
| Notification services | Sending notifications you turn on | The notification text |
You can ask us for the names of our current service providers at privacy@onceuponaworkday.com.
6. Children's Privacy
Our Service is designed for parents to create stories for their children. We do not knowingly collect information directly from children under 13. All family member information (including children's names, ages, and photos) is provided by the parent or legal guardian.
- Parents provide and control all information about their children
- Children's data is used solely for story personalization
- We never sell or commercially exploit children's data, and we share it only as described in section 5
- Parents can review, update, or delete their children's information at any time
- Photos of children are processed for illustration purposes only and are never used for AI training
7. Your Rights
Depending on your location, you may have the following rights:
To exercise any of these rights, visit your profile settings or contact us at privacy@onceuponaworkday.com.
All Users
- Access: Request a copy of all personal data we hold about you
- Correction: Update or correct your information via your profile
- Deletion: Request deletion of your account and all associated data
- Data Export: Download your data in a portable format
- Opt-out: Withdraw consent for marketing communications at any time
EU/EEA Residents (GDPR)
- Right to restrict processing of your data
- Right to data portability
- Right to object to processing based on legitimate interests
- Right to lodge a complaint with your local data protection authority
California Residents (CCPA/CPRA)
- Right to know what personal information we collect and how it is used
- Right to delete your personal information
- Right to opt out of the sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising your privacy rights
8. Cookies
We use only essential cookies required for the Service to function:
We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.
- Authentication cookies: To keep you signed in
- Language preference: To remember your selected language
- Referral tracking: To credit referral bonuses when you sign up through a share link
9. Data Retention
- Active accounts: Your data is retained for as long as your account is active
- Deleted accounts: Personal data is permanently deleted 30 days after you ask to delete your account, or when your paid plan ends if that is later. We keep an anonymous record of the account (no name, email or content) for reporting, and payment records as required by law. Library stories you choose to keep stay published under our Community Library account, credited to your name or to “a Once Upon a Workday family”, as you choose
- Soft-deleted family members: Photos and data are purged from our systems within 30 days
- Voice recordings: Retained while your account is active; deleted with your account
- Payment records: Retained as required by law (typically 7 years for tax purposes)
10. Data Security
We implement industry-standard security measures to protect your data:
- All data is encrypted in transit (HTTPS/TLS)
- Database access is restricted with Row Level Security (RLS)
- Uploaded photos are moderated by AI for safety
- Voice recordings are reviewed by AI for appropriate content
- Administrative access is restricted and logged
11. International Data Transfers
Your data may be processed in the United States, where most of our service providers are, and other countries where they operate. When we transfer data internationally, we ensure appropriate safeguards are in place as required by applicable law, including Standard Contractual Clauses for EU data transfers.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will also notify you via email.
13. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:
Email: privacy@onceuponaworkday.com