Last updated: 20 October 2026
Stories That Remember ("we", "us", "our") makes personalised children's stories from the details you share with us about your child. This policy explains what we collect, why, and what rights you and your family have over it.
Stories That Remember is run by Stories That Remember Limited, a company registered in England and Wales (company number 17529438). Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the data controller for the information described in this policy.
For privacy questions or to exercise your rights, contact us at privacy@storiesthatremember.com.
| Category | What |
|---|---|
| Account details | Your email address and password (password is hashed by our authentication provider — we never see it in plain text). Confirmation that you are 18 or over. |
| Child profile details | Name, age, and your relationship to the child; free-text answers you give during the story questionnaire (memories, obsessions, upcoming excitements, personality, and physical description including hair, eyes, ethnicity, and build). |
| Story content | The stories generated for your family, and short structured notes ("story references") kept so future stories can build on earlier ones. |
| Anything else you choose to share | Parents sometimes mention sensitive real-world context (e.g. a hard week at school) to help the story reflect what's going on. See Section 6. |
| Avatars and pictures | Your child's storybook avatar (a drawing of them as a storybook character), avatars of anyone else you choose to have drawn as themselves, and the pictures in illustrated stories and keepsakes. All of these are drawn by AI from the written descriptions you give. We never ask for, or accept, photos of your child. |
| Keepsake orders | For printed books: the story, the illustration style you choose, any dedication you write, the appearance details you confirm for each illustrated character, the finished pages, the recipient's name and postal address, and any delivery note. |
| People in your stories | You can describe other people who appear in the pictures, such as family, friends or a pet, so they're drawn as themselves: their first name, how they're related to your child, and how they look (for example skin tone, hair and glasses). Anyone you don't describe is drawn in the background and we keep no details about how they look. |
| Chat assistant messages | If you use the chat assistant on our Contact page, the messages you type, the replies, and a scrambled (one-way hashed) version of your IP address, used to limit how many messages can be sent. We never store your actual IP address. Please don't share personal details about your child there. |
| Safety records | If a story is held back by our safety checks: the story, the request that produced it, and why it was flagged. For a serious safety concern only, also the relevant answers you gave in the questionnaire. See Section 7. |
| "Let me know" requests | If you live outside the UK and ask us to let you know when we open in your country: your email address and the country you tell us. |
| Payment details | Handled directly by our payment processor (Stripe) — we do not store your card details ourselves. [Payments not yet live.] |
We use a small number of specialist providers to run the service. None of them may use your family's data for their own purposes.
| Provider | What they process | Location |
|---|---|---|
| Anthropic | Conversation transcripts, questionnaire answers and story requests, to generate and safety-check story text; the pictures we draw, to check each one for safety and accuracy before you see it; and messages sent to our website chat assistant | United States |
| Supabase | Account and database hosting | Frankfurt, Germany (EU) |
| Vercel | Website and serverless function hosting | Washington, D.C., USA |
| Google (Gemini API) | Written appearance descriptions of your child and anyone else you choose to have drawn as themselves, short descriptions of each scene, and earlier drawings of the same characters, to draw avatars and pictures. We don't send names or photos. | United States and other countries where Google operates |
| Stripe | Payment details (planned, not yet live) | [TBC] |
| Lulu Press, Inc. | The finished book, recipient name and postal address, to print and deliver keepsakes | United States (Durham, North Carolina) |
| Resend | Your email address, to send account emails such as sign-up confirmation, and to pass on "let me know" requests to our team | Ireland (EU) |
| Google Workspace (Google Ireland Limited) | Emails you send us, and our replies | Ireland (EU); may also be processed in the United States |
We use Anthropic's Claude API to write and check stories, and Google's Gemini API to draw pictures. Under both companies' paid API terms, what we send is not used to train their models or improve their products. Google keeps it for a limited time only to detect misuse. You can read the current terms at anthropic.com/legal and ai.google.dev/gemini-api/terms.
Where a provider is based outside the UK/EEA — this currently includes Anthropic, Google, Vercel and Lulu, while Supabase hosts your data in Frankfurt, Germany (EU) — we rely on appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses. [Data Processing Agreements with each provider are being finalised — see internal action log.]
We never sell your family's data, and we don't share it for advertising.
We keep as little as we can, for as short a time as we can. Here's how that works:
Safety records. Routine safety flags are kept for 90 days. Where an account is reviewed for a safeguarding concern, the relevant information is kept for up to 12 months if no further action is needed, or up to 6 years if the account is closed for serious misuse or the matter is reported to an authority (longer only if an authority asks us to). While a review is ongoing, we can't delete the account on request until the review is complete.
Some questions — like your child's ethnicity — help us describe them accurately in the story and draw them accurately in their avatar and pictures. This is optional. You don't have to share it, and leaving it out won't stop you creating a story.
Parents also sometimes mention something difficult going on for their child — a hard day, a big change at home, something unkind that happened. We understand this is offered in good faith, as context. Our system is specifically instructed to take only the general emotional shape of anything sensitive you share (for example, "going through a big change") and never to reproduce the specific words, incident details, or other people involved — either in the story, or in what we keep afterwards.
If you describe someone else for a keepsake, such as a friend of your child's, please only share what you're confident they and their family would be happy for us to use to draw them. You never have to: anyone you don't describe is simply drawn in the background.
Please only share what you're comfortable with. Sensitive information is never required to create a story.
Every story, avatar and picture is checked by an automated safety system before you see it, and every printed keepsake is also checked by a member of our team before it goes to print. If something is held back, we keep a record of what was flagged and why, including the story and the request that produced it, and it may be reviewed by our Designated Safeguarding Lead. Only where the concern is serious (for example, anything sexual involving a child) do we also keep the relevant answers you gave in the questionnaire, which we otherwise never store. Apart from that, someone at Stories That Remember only reads your questionnaire answers or stories, or looks at your pictures, when checking a printed keepsake you've ordered, or when you ask us to help.
If we have a serious concern that a child may be at risk, we may share relevant information with the police, the National Crime Agency, children's social care or other appropriate authorities. The law allows us to do this, and in some cases not to tell you first, where telling you could put a child at risk or harm an investigation. Our Safeguarding Statement explains more.
Your child is who this service is about, but they are not our customer and do not use the questionnaire, sign up, or manage any settings themselves — you do, as the account holder. This is a deliberate design choice, and it shapes how this policy applies: your child's information is provided, viewed, and controlled entirely through your account.
If your child is old enough to want to exercise their own data protection rights directly with us in future, we'll have a process for that — for now, please contact us and we'll help.
Under UK GDPR, you can ask us to:
Some of these rights have limits. For example, we may not be able to delete information we need to keep for child safety, or share it with you where that could put a child at risk or harm an investigation.
To do any of these, contact us using the details in Section 1. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time.
Access to your data is protected by row-level security at the database layer, meaning your account's data is only ever returned to your own authenticated session — not just filtered by the app, but enforced by the database itself. All traffic to the site is encrypted (HTTPS). Passwords are hashed, never stored in plain text.
A small number of named people at Stories That Remember can access account data where it's needed to check a keepsake you've ordered, review a safety flag, or help when you ask us to.
See our separate Cookies Policy for details on the (very few) things we store in your browser.
If we make material changes, we'll update the date at the top of this page and, where appropriate, let account holders know directly.
privacy@storiesthatremember.com
Safeguarding concerns: safeguarding@storiesthatremember.com