LunatalePrivacy Policy
Last updated: 11 October 2026
In short: Lunatale has no ads, no tracking and no third-party analytics. We collect only what the app needs to work: an account identifier, the child profile you choose to fill in, what you read and listen to, and your subscription status. We never sell personal data. You can delete your account from inside the app at any time.
- Who we are
- What we collect
- How we use it
- Personalised stories
- Who we share it with
- Children
- How long we keep it
- Your rights
- Security
- Changes
1. Who we are
Lunatale (the iOS app “Lunatale: Bedtime Stories” and this website) is provided by Necip Fazıl Akay (“we”, “us”). We are the data controller for the personal data described here. Questions and requests: necipaky@icloud.com.
Lunatale is meant to be set up and managed by a parent or guardian. In this policy, “you” means that adult.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Account identifier (a random ID) | Created automatically the first time you open the app, even as a guest | Keep your library, daily allowance and subscription together |
| Apple account details: Apple's user identifier, the email address Apple shares (this can be a private relay address) and a sign-in token Apple issues | Only if you choose “Sign in with Apple” | Let you keep your data on a new device; the token lets us cancel the Apple sign-in when you delete your account |
| Child profile: first name or nickname, age, gender (optional), avatar, favourite themes, language | Entered by you; every field can be skipped | Personalise recommendations and stories |
| Time zone | Your device | Reset the free daily story at your midnight |
| Reading and listening activity: stories opened, listening position, saved stories, ratings | Your use of the app | Daily allowance, “continue where you left off”, library and nightly streak |
| Purchases: subscription product, trial and renewal dates | Apple, through our subscription provider | Unlock Premium. We never see your payment details |
| Feedback and account deletion requests: your message, optional rating or reason, app version | You, when you send them | Answer you and improve the app |
| Technical data: IP address, device type, request time | Automatically, in our providers' server logs | Security, abuse prevention and troubleshooting |
Some settings (for example app preferences and reminder times) stay only on your device. Bedtime reminders are local notifications created on your device; we do not use push notification tokens.
We do not collect your location, contacts, photos, microphone recordings or advertising identifier, and we do not track you across other apps or websites.
3. How we use it
- To provide the service you asked for: show and narrate stories, keep your library and progress, apply the free daily allowance, unlock Premium (legal basis under the GDPR: performance of a contract).
- To keep the service safe and working: prevent abuse, fix errors (legitimate interests).
- To answer you when you send feedback or a request (legitimate interests, or contract).
- To meet legal obligations, for example tax and consumer law (legal obligation).
We do not use your data for advertising, we do not build advertising profiles and we do not sell or rent personal data.
4. Personalised stories
When the personalised (interactive) story feature is available and you use it, the story “recipe” you choose, which can include your child's first name, age and the choices made during the story, is sent to an AI service provider to write the story. We ask for your permission in the app before the first story is created. We send only what is needed for the story, we do not let the provider use it to train its models, and created stories are stored in your account so you can open them again. You can delete them together with your account.
5. Who we share it with
We use a small number of service providers who process data on our behalf, under contracts that limit them to providing their service:
- Supabase: database, sign-in and server functions.
- Cloudflare: storage and delivery of story images and audio.
- RevenueCat: subscription management. It receives your account identifier and purchase information from Apple.
- Apple: Sign in with Apple, App Store payments and subscriptions, under Apple's own privacy policy.
- Vercel: hosting of this website.
- AI service provider: only when you create a personalised story (see section 4).
Some of these providers process data outside your country, including in the European Union and the United States. Where the law requires it, these transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
We may also disclose data if the law requires it, or to protect the rights and safety of our users or of us.
6. Children
Lunatale is designed for parents and guardians to use with their children. Accounts are created and managed by the adult, and any information about a child is entered by that adult. Children cannot contact other users, there is no public profile and there is no advertising.
If you believe a child has given us personal data without a parent's knowledge, contact us and we will delete it.
7. How long we keep it
- Account, profile and activity data: while your account exists.
- When you ask us to delete your account (in the app: Parent area → Delete account, or by email), we delete it within 30 days. Server backups that may still contain it are overwritten in the normal backup cycle.
- Feedback messages are kept for as long as they help us improve the app; after account deletion they are no longer linked to you.
- Purchase records may be kept longer where tax or consumer law requires it.
- Server logs are kept for a short period by our providers for security.
8. Your rights
Depending on where you live (for example under the EU/UK GDPR or Türkiye's Personal Data Protection Law No. 6698, “KVKK”), you have the right to:
- learn whether we process your data and get a copy of it,
- correct inaccurate data (most of it you can change yourself in the Parent area),
- have your data deleted,
- object to or restrict processing based on legitimate interests,
- receive your data in a portable format,
- withdraw a permission you gave, at any time,
- complain to a data protection authority (in Türkiye: the Personal Data Protection Authority, KVKK; in the EU: your local authority).
Send requests to necipaky@icloud.com. We answer within 30 days and may ask you to confirm that the account is yours.
9. Security
Data is encrypted in transit (HTTPS). Access to the database is restricted by row-level rules, so each account can only read its own data, and secret keys never ship inside the app. No system is perfectly secure, but we work to protect your data and will inform you as the law requires if something goes wrong.
10. Changes
If we change this policy we will update the date above, and for important changes we will let you know in the app before they take effect.