隱私政策

Last updated: August 28, 2026

1. Introduction

VocaStory ("we," "us," or "our") operates the VocaStory mobile application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting the privacy of all our users, with special attention to the privacy and safety of children.

Company: VocaStory
Contact: vocastory-support@pdev.cfd
Bundle ID: com.gcdm.vocastory

2. Information We Collect

2.1 Parent/Guardian Information

  • Account Information: Email address, display name, and authentication credentials when you create an account.
  • Voice Data: Audio recordings you voluntarily provide for the voice cloning feature. These recordings are encrypted and used solely to generate a voice model for story narration.
  • Payment Information: Subscription transactions are processed through Apple App Store and Google Play Store. We do not store credit card numbers or payment details directly.
  • Usage Data: App interaction data, story preferences, and feature usage statistics (only if analytics is enabled in settings).
  • Device and Attribution Data: After an adult passes the parental gate, AppsFlyer may process a device or advertising identifier, install source, app launches, and basic interactions to measure our own promotional campaigns. On iOS, tracking is enabled only after the adult grants permission through App Tracking Transparency.

2.2 Children's Information

We collect the minimum amount of children's information necessary to provide age-appropriate stories:

  • Child Profile: First name (or nickname), age group, and preferred story themes. This information is provided by the parent/guardian, not collected directly from children.
  • Play History: Story listening history and completion data, stored to provide usage insights to parents.
  • Creative Content: Drawings or images selected by a parent or child for drawing-to-story features, as well as story prompts and generated content.

We do NOT collect: precise location data or contact information directly from children. We do not use child profiles, drawings, stories, or voice data for targeted advertising, and we do not show third-party advertising to children.

3. How We Use Your Information

  • Voice Cloning and Narration: Your voice recording is uploaded to Fish Audio, our third-party AI voice provider, where it is used to build a voice model for your account. To narrate a story, the story text is sent to the same provider to be read in that voice. Voices created before we changed provider are still served by ElevenLabs, and a small number of earlier voices run on our own self-hosted service. We ask for your explicit consent in-app before the first time a recording is uploaded. Voice data is encrypted in transit and at rest, is never used for advertising, and is deleted when you delete the voice or your account.
  • Story Generation: Story settings and text prompts you provide (such as the main character's name, age group, themes and keywords) are sent to Google Gemini, our third-party AI story provider, solely to generate age-appropriate, personalized stories. In-app, we ask for your explicit consent before the first time this data is sent.
  • Voice Dictation: When you use the microphone dictation feature, that recording is sent to OpenAI (Whisper), our third-party transcription provider, solely to convert your speech to text. We ask for your explicit consent in-app before the first use.
  • Story Illustrations: Story text is sent to OpenAI, our third-party image-generation provider, solely to create illustrations for your stories.
  • Service Improvement: Aggregated, anonymized usage data helps us improve story quality and app features.
  • Parental Controls: Usage data is presented to parents through the parental dashboard for monitoring screen time and listening habits.

4. Third-Party Services

We use the following third-party services, each with their own privacy policies:

  • Supabase: Cloud database and authentication. Data stored in secure, encrypted databases with Row Level Security.
  • Google Gemini: AI story generation and story illustrations. Story settings and text prompts (theme, age group, language, main character name, keywords) are shared, with your prior in-app consent. Google processes this data under its data processing terms, which provide protection equivalent to this policy.
  • OpenAI: Speech-to-text (Whisper) for voice dictation and image generation for story illustrations, with your prior in-app consent for dictation. OpenAI does not use API data to train its models and processes it under data processing terms that provide protection equivalent to this policy.
  • Fish Audio: AI voice cloning and story narration. Your voice recording, and the text of the story to be narrated, are shared with your prior in-app consent. Fish Audio processes this data under its data processing terms, which provide protection equivalent to this policy, and does not use it for advertising.
  • ElevenLabs: AI voice cloning and narration for voices that were created before we changed provider. For those voices only, the same data is shared under data processing terms that provide protection equivalent to this policy.
  • Firebase: Push notifications and analytics (if enabled). Used to deliver story completion notifications and reminders.
  • RevenueCat: Subscription management. Processes subscription status without accessing personal data.
  • AppsFlyer: Install attribution and measurement of our own promotional campaigns, only after an adult passes the parental gate. It may process device identifiers, install source, app launches, and basic interaction events. Declining tracking does not limit core story creation or playback features.

All third-party API calls are routed through our secure backend (Supabase Edge Functions). API keys are never exposed to client applications.

5. COPPA Compliance

VocaStory is designed to comply with the Children's Online Privacy Protection Act (COPPA):

  • We require verifiable parental consent before collecting any information related to children under 13.
  • Child profiles are created and managed exclusively by parents/guardians.
  • Social features, external links, purchases, analytics, and attribution are protected by parental controls or an adult PIN gate where applicable.
  • We do not display advertisements to children or use children's data for marketing purposes.
  • Parents can review, modify, or delete their child's information at any time through the app settings.

6. GDPR Compliance

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR):

  • Legal Basis: We process data based on your consent (voice recording, analytics) and contractual necessity (account management, story delivery).
  • Data Minimization: We collect only the data necessary to provide our services.
  • Right of Access: You can request a copy of all data we hold about you.
  • Right to Erasure: You can request complete deletion of your account and all associated data.
  • Right to Portability: You can request your data in a machine-readable format.
  • Data Protection Officer: Contact vocastory-support@pdev.cfd for any GDPR-related inquiries.

7. Data Retention and Deletion

  • Active Accounts: Data is retained for as long as your account is active.
  • Voice Data: Voice recordings and cloned voice models are deleted immediately upon your request or when you delete a voice profile.
  • Account Deletion: Standard account deletion has a 7-day grace period during which you can sign in to cancel the request. After the grace period, the account and associated personal data are permanently deleted. The app also offers an immediate deletion option that skips the grace period and cannot be undone.
  • Inactive Accounts: Accounts inactive for 24 months will receive a notification before data is archived or deleted.

8. Data Security

  • All data is encrypted in transit using TLS 1.3.
  • Voice data and personal information are encrypted at rest using AES-256 encryption.
  • Database access is protected by Row Level Security (RLS) policies ensuring users can only access their own data.
  • Authentication uses industry-standard JWT tokens with automatic refresh.
  • Parental controls are protected by PIN codes that are securely hashed and never stored in plain text.

9. Your Rights

You have the right to:

  • Access all personal data we hold about you and your children
  • Correct inaccurate personal data
  • Delete your account and all associated data
  • Export your data in a portable format
  • Opt out of analytics data collection
  • Revoke consent for voice data processing
  • Lodge a complaint with a supervisory authority

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the app and sending a notification. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

  • Email: vocastory-support@pdev.cfd
← Back to Home