FableFolk is a bedtime storytelling service. It's designed for use by parents and other adults responsible for the child at bedtime. The child never signs in, never sees the dashboard, and never types a thing.
This page is a plain-English account of what we collect, why, who else sees it, and what you can do about it.
Who we are
FableFolk is operated by The Fable Folk Ltd, a company registered in England and Wales. Contact for privacy questions: hello@thefablefolk.com.
What we collect
From you (the parent):
- Email address (for sign-in and account recovery)
- Billing details, processed by Stripe (web) or Apple/Google (in-app purchases). We never see your card number
- Optional: name and phone if you choose to share them
About your child, entered by you:
- Their first name and age
- Pronouns
- Free-text details you choose to add: interests, loves, fears, comfort objects, recent events, sayings
- The stories generated for them and any notes you save
Automatically:
- Server logs (IP address, browser type, basic error info)
- Audio briefing files cached so we don't re-generate them
Why we collect it
- To generate stories tailored to your child
- To remember past chapters so the next one ties back
- To bill your subscription
- To send you authentication emails (magic links)
- To respond when you contact us
- To diagnose bugs and operate the service
We don't sell your data. We don't use it for advertising. We don't train any of our own AI models on it.
Who else sees it
FableFolk runs on a handful of processors. Each receives only what they need to do their job:
- Supabase: stores your account, profiles, stories, and cached audio. Hosted in the EU.
- Vercel: runs the website and the bedtime flow.
- Anthropic, OpenAI, Google: generate the story text from the prompt we build using your child's profile. These providers state they don't train on API data by default and we don't opt in to training.
- ElevenLabs and OpenAI: generate the spoken audio briefing from the script we produce.
- Stripe: processes web subscriptions and stores card details on its own (PCI-compliant) systems.
- RevenueCat: relays App Store and Google Play subscription events to us. (Web subscriptions don't go through RevenueCat.)
- Resend: sends authentication emails on our behalf.
- PostHog: captures anonymised product analytics (which pages parents visit, where flows drop off) and session recordings so we can identify friction in the app. All form input values (email, child profile fields, canon notes, payment details) are masked in recordings, so we can see clicks and page navigation but not what any user typed. Hosted in the EU.
- Meta (Facebook / Instagram), Google, and TikTok advertising pixels: help us measure whether our own ad campaigns on those platforms actually lead to sign-ups. They drop cookies that record which page you visited on our site and whether you started a trial. They do not read anything you type or anything about your child. You can decline these in the cookie banner on your first visit, and change your choice at any time from the footer.
Some of these processors are based outside the UK/EU. Where data leaves the UK we rely on Standard Contractual Clauses and the processors' own UK/EU adequacy decisions.
Children's privacy
FableFolk is built for parents. The child does not have an account, does not see the interface, and is not asked for any information directly. The details you share about your child are processed on your authority as their parent or guardian. You can edit or delete them at any time.
If you become aware that we hold child data you didn't authorise, email us at hello@thefablefolk.com and we'll remove it.
Your rights
Under UK GDPR you have the right to:
- See what we hold about you and your child
- Correct it if it's wrong
- Ask us to delete it
- Object to or restrict our processing
- Take a copy of it elsewhere
- Complain to the Information Commissioner's Office (ICO) at ico.org.uk
To use any of these, email hello@thefablefolk.com. We'll reply within 30 days.
How long we keep it
We keep your account and your stories for as long as you have a FableFolk account. When you delete the account we delete the account, the children, the stories and the audio. Backups age out within 30 days.
Billing records are kept for 6 years to satisfy UK tax law.
Security
We use HTTPS everywhere, store secrets in encrypted environment vaults, and limit who on the team can see production data to the people who run the service. No system is perfectly safe, but we keep ours boringly conventional rather than trying anything clever.
Cookies and local storage
We use three categories of cookies and browser storage:
- Strictly necessary — the sign-in session cookie, and a piece of browser local storage that remembers which child you picked last. These cannot be turned off; without them the app cannot sign you in or resume where you left off.
- Analytics— PostHog, which captures anonymised product analytics and input-masked session recordings (see "Who else sees it" above). We use these to spot friction and fix bugs.
- Advertising measurement — Meta, Google, and TikTok pixels, which measure whether our own ad campaigns on those platforms lead to sign-ups. We do not run ads inside FableFolk itself; these pixels only measure the effectiveness of our marketing on other sites.
Analytics and advertising cookies only load if you accept them in the cookie banner shown on your first visit. You can change your choice at any time — from the footer, or right here:
Changes
When this policy changes meaningfully, we'll update the date at the top and send you an email if you have an account.
Contact
Email hello@thefablefolk.com for anything privacy-related. We'd rather hear from you than have you go to the ICO first.
This is a v1 plain-English policy. It is intended to be a fair description of how FableFolk handles data; before public launch it will be reviewed by a UK privacy specialist.