Privacy Policy

1. Who We Are

Willownook (“we,” “us,” or “our”) operates Willownook, a web application that generates personalized children's stories for caregivers. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have.

If you have questions, contact us at privacy@willownook.com.

2. Information We Collect

Information you provide

• Account information: email address and password (managed by Supabase Auth).
• Story intake data: child's age, optional first name, interests, and the parenting topic you want the story to address. We do not require a child's last name, date of birth, photo, or any government identifier.
• Payment information: billing details are collected and stored by Stripe, Inc. We never see or store your full card number.

Information collected automatically

• IP address, browser type, and device type for security and abuse prevention.
• Story generation logs (timestamps, plan tier, error states) for product analytics and quota enforcement.

Information we do not collect

• We do not knowingly collect any personal information directly from children. All account holders must be 18 or older.
• We do not sell your data to third parties, ever.

3. How We Use Your Information

• To create and deliver your personalized stories.
• To enforce story quotas based on your subscription plan.
• To process payments and manage your subscription through Stripe.
• To respond to support requests.
• To detect and prevent fraud, abuse, and security incidents.
• To improve the quality of story generation through aggregate, de-identified analytics.

We do not use your intake data or generated stories to train AI models unless you have explicitly opted in.

4. AI-Generated Content

Willownook uses the OpenAI API to generate story text and illustrations. Your intake data (child age, interests, and topic) is sent to OpenAI as part of the generation request. OpenAI's use of this data is governed by their API data usage policy. By default, OpenAI does not use API inputs or outputs to train their models.

Willownook is an educational support tool. Stories are AI-generated and have not been reviewed by licensed therapists, psychologists, or pediatricians. They are not medical or therapeutic advice.

5. Children's Privacy and COPPA

Willownook accounts are intended for caregivers aged 18 and older. We do not knowingly create accounts for or collect personal information directly from children under 13.

The optional child name you enter in the story intake form is used solely to personalize the story text. It is stored as part of your story record in your account and is never shared, indexed, or used for advertising.

If you believe we have inadvertently collected personal information from a child under 13, please contact us immediately at privacy@willownook.com and we will delete it promptly.

6. Sharing and Third Parties

We share your data only with the following service providers, under their own privacy policies and data processing agreements:

• Supabase — database and authentication hosting.
• Vercel — application hosting and edge infrastructure.
• OpenAI — AI story and illustration generation.
• Stripe — payment processing and subscription management.
• Cloudflare — image storage (R2) and CDN delivery.

We do not sell, rent, or trade your personal information to any other third party for commercial purposes.

7. Data Retention

We retain your account data and stories for as long as your account is active. If you delete your account, all personal data — including your email, intake history, and generated stories — will be permanently deleted within 30 days, except where retention is required by law (for example, payment transaction records required for tax purposes, retained for up to 7 years).

8. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data (GDPR Article 17, CCPA). Use the account deletion option in Settings, or email privacy@willownook.com.
• Object to or restrict certain processing of your data.
• Data portability — request a copy of your stories in JSON format.

To exercise any of these rights, contact us at privacy@willownook.com. We will respond within 30 days.

9. Cookies and Tracking

We use cookies solely for authentication session management (via Supabase Auth). We do not use third-party advertising cookies, tracking pixels, or behavioral analytics at this time.

10. Security

We use industry-standard measures including HTTPS encryption, database row-level security (RLS), and server-side authentication to protect your data. No system is perfectly secure. If you discover a vulnerability, please report it to privacy@willownook.com.

11. Changes to This Policy

We may update this policy as the product evolves. We will post the updated policy here with a new “Last updated” date. If a change materially affects your rights, we will notify you by email.