Privacy Policy
Version 3.0
Applies from: 7 October 2026
This policy explains what personal data Booklly collects on the website booklly.com and in the Booklly app for iPhone and iPad, why, who receives it, and what you can do about it.
1. Who is responsible
The controller of your personal data is:
Računalniško programiranje Janko Tomšič s.p.
-
Address: Pugljeva ulica 1, 8000 Novo mesto, Slovenia
-
Registration number: 9072756000
-
Email: hello@booklly.com
-
Phone: +386 31 247 225
-
Contact form: https://booklly.com/contact-us
In this policy "Booklly", "we" and "us" mean this business. We have not appointed a data protection officer, because the law does not require one for a business like ours. Write to the email address above about anything in this policy.
2. The short version
-
Booklly is for adults. Children do not have accounts. Information about a child comes from you, the parent or guardian.
-
A Kid Profile's name, date of birth and photo are never sent to AI providers. The child's age in years, gender and interests are.
-
Whatever you type into a story idea or a character is sent to AI providers as you wrote it, and it can end up in a public story. Do not type personal details there.
-
Every story you confirm is published in the public Booklly Library. We do not display your name or username on it.
-
We use providers in the United States and other countries outside the EU.
-
Outside the United States, analytics in your browser and in the app run only after you allow them. On the website in the United States, plain usage statistics, error reports and page speed measurement run by default, on our legitimate interest. Session recordings and the link to your account start there only after you choose "Accept all", and "Reject all" turns analytics off. Section 12.3 has the details.
-
Once you allow analytics, they are linked to your account identifier, never to your email address.
-
Whatever you choose, our servers record some events, such as a story being created or a payment. Unless you allowed analytics, they are recorded without your account identifier. Section 3.8 has the details. You can object to them: section 11.1 explains how.
-
If you withdraw your analytics consent or delete your account, we delete the analytics linked to your account within 30 days.
-
We do not sell personal data and we do not show advertising from other companies.
-
You can ask us at any time to delete your account, to remove a story that contains personal data, or to send you a copy of your data.
3. What we collect
3.1 Your account
| Data | When |
|---|---|
| Email address and password. We store the password only in hashed form. | When you sign up with email |
| Your name and email address as released by Google or Apple. With Google also the address of your profile picture. With Apple the email can be a private relay address. | When you sign in with Google or Apple |
| Username | During onboarding |
| Language preference | When you sign up or change it |
| Two-factor authentication setup | If you turn it on |
| IP address and browser or device type of your sign-in sessions | Each time you sign in |
| Email preferences: story updates, content updates, product news | During onboarding and in your settings |
| Your analytics choice: allowed or not, whether you made it on the website or in the app, when it last changed, and, where the website or the app reports it, which version of our consent text you were shown | When you make or change the choice while signed in |
| A note that you object to our server-side analytics, and when you objected | When you object (section 11.1) |
3.2 Kid Profiles
If you add a Kid Profile we store the child's first name, gender, date of birth, interests, preferred story language and an optional photo. You provide this information. We do not collect anything from the child.
An interest you type yourself is checked by an AI model. If it is approved, it is offered as a suggestion to other users, without your name. Do not type personal details as an interest.
3.3 What you write and create
-
Story ideas, character names and descriptions, and series and season ideas.
-
The stories, series, illustrations and audio that Booklly produces for you, and the choices you made for them.
-
Your favourites.
-
Which Library stories you opened in the current month, if you are on the Free plan. We need this to count the monthly allowance.
-
Story Credits you received and spent.
3.4 Payments
Stripe collects your card details and billing address when you subscribe. We do not receive your full card number. We store your Stripe customer number, your plan, its status and renewal dates, any promotion code you used, and the billing events Stripe sends us. These billing events include your name, email address and billing address.
3.5 Messages, reports and the waiting list
-
Contact form: your name, email address, subject and message.
-
Story reports: the story, the reason you chose, any details you add, and your account.
-
Creators you hide in the app.
-
Waiting list: your email address.
-
Invitations: the email address of the person you invite to a Family or a group account. The invitation email shows your email address to that person. Please invite only people who expect it.
3.6 Family and group accounts
If you are in a Family, the other member sees your username, email address, stories, series, favourites and Kid Profiles. The other member can also edit and remove your Kid Profiles.
If you are a member of a group account, such as a school's, its administrators see your username, email address and the credits you use from the shared pool.
3.7 Technical data
-
Server logs: IP address, time, the page or function requested, your account identifier if you are signed in, and error details. We shorten email addresses in log entries where we can.
-
Rate limiting: to stop abuse we count requests by account identifier or IP address. For password reset requests we count by email address.
-
The country your request comes from, taken from your IP address. We use it to choose the currency and the cookie rules that apply to you.
-
In the app: a random identifier for the installation, the push notification token, the app version, and the platform.
3.8 Analytics
Analytics show us how Booklly is used. This section describes our product analytics, which we run on PostHog. Google Analytics, Sentry and Vercel Speed Insights are separate tools on the website. Sections 8.4 and 12.2 list them.
There are two kinds of product analytics.
What your browser or the app sends. This is sent only while analytics are allowed on that device, and on the website in the United States until you turn them off. Section 12.3 covers the website and section 13 covers the app. It includes pages and screens viewed, clicks, actions such as starting playback, searching or sharing, listening time, the identifiers of the stories and series involved, device and browser type, and error reports.
What our servers record. Our servers record that something happened in Booklly, for example that a story was created, a subscription started or a payment succeeded. They record this for everyone. Your analytics choice decides whether these events are linked to you. The two paragraphs "If you have not allowed analytics" and "Subscriptions and payments" below explain how.
How you are identified. Events are linked to your account identifier only while you are signed in and after you allowed analytics yourself: with "Accept all" or the cookie preferences on the website, or with "Allow" in the app. The account identifier is a random string. It is not your name or email address. Product analytics are never linked to your email address or your username. Before you sign in, your browser or the app uses a random identifier of its own. When you sign in, what that browser or app sent before is joined to your account identifier. When you sign out, it starts a new random identifier.
On the website in the United States, the statistics that run before you choose are not linked to your account. If you then choose "Accept all", what this browser sent before is joined to your account identifier at that moment.
With your account identifier we keep a few facts about the account: its language, its plan and the plan's status, whether it has a Kid Profile, how and when you signed up and on which platform, and whether the account belongs to the Booklly team.
What product analytics never contain. No event carries your email address, your name or username, a child's name, gender or date of birth, the idea you typed, the text of a story, a comment, the words of a search, or any other text you typed. Where such a thing matters we send a fact about it instead: that a search had 12 characters and found 5 stories, or that a piece of feedback has a comment. An event about a Kid Profile carries the profile's identifier, the number of interests, whether the profile has a photo, and its story language. An event about a story created for a child says that a Kid Profile was used and carries the story's age group. It does not carry the child's age or which profile it was.
Two things come close to that list. The address of a story or series page is made from its title, and it is sent with the page address (see "On the website" below). And an error report carries the technical message of the error, which our code or your browser writes and which we do not check word by word.
On the website. Page addresses are cleaned before they are sent. Sign-in codes, tokens, checkout session numbers, search words and other free text are removed. Kept are campaign parameters such as utm_source, a referral code, the click identifiers that advertising platforms add to a link, and the settings our own pages put in an address, such as a library filter, a sort order or a page number. The address of a story or series page is sent as it is. It is made from the title, for example /stories/adventure/the-dragon-who-lost-his-roar, so if a title contains a name, that name is in the address too. The title that your browser shows in the tab is not sent. A click is recorded with the kind of element and its technical names, never with its text. We also record how far you scroll and how fast pages load.
Google Analytics receives the page address cleaned in the same way, so the address of a story or series page is in it too. It does not receive the title of the page: every page is sent with the same title, "Booklly". We have switched off Google signals and ad personalisation in the Google Analytics tag on our pages.
Approximate location on the website. PostHog works out an approximate location from your IP address. It stores the country, the region, the city, the postal code, and the latitude and longitude of that area with the events your browser sends, and with your account identifier once your analytics are linked to it. It does not store the IP address. The location describes the area that your internet provider's address belongs to, not where you are. The app sends no location, and the events our servers record carry none.
Session recordings on the website. Only after you choose "Accept all", or turn analytics on in the cookie preferences, does PostHog record your visit, wherever you are. We use the recordings to see how a page was used and to find faults. A recording shows the layout of the pages, your clicks, scrolling and pointer movement, the cleaned addresses of the requests the page makes, and the technical messages that the page writes to the browser's console. Those messages can name something that is on the page. All text on the page and everything typed into a form field is replaced with placeholder characters before the recording leaves your browser. Pictures placed in the page, including Kid Profile photos and profile pictures, are left out. Story artwork that is drawn as a background can appear. The content of the requests the page sends and receives is never recorded. A recording is linked to your account identifier if you are signed in. Recordings are kept for 30 days. Sentry also records replays, as section 8.4 describes.
If you have not allowed analytics. Our servers still record what happens in Booklly, but they do not link it to you. Such an event is recorded without your account identifier and without the identifier of any story, series or Kid Profile. It gets random identifiers of its own, so in the analytics tool it is not connected to your other events and creates no profile, and we keep no key that would let us find it again. It carries no exact time of its own: the analytics tool notes when it arrives, usually seconds later. Running numbers are rounded: the number of Story Credits left is put into a range, and the time a story took to make is rounded to 10 seconds. What remains are general values: what happened, whether it happened on the website or in the app, and values such as the plan, the story's language, length, category and age group, the sign-in method, the reason chosen in a report, the number of Story Credits a story cost, and yes-or-no facts such as whether a story was made for a Kid Profile. We use these events for totals, for example how many stories were created in a week.
These events are still personal data in law, and we treat them as such. We do not try to find out whose they are. But Booklly is small. An unusual combination of values at a quiet hour, for example a Slovenian story of one length for one age group on the Free plan, could be compared with our own records and point to one account.
This applies as long as you have not made a choice, after you turn analytics off, and on the website in the United States until you choose "Accept all". You can object to these events: section 11.1 explains how.
Subscriptions and payments. For each subscription our servers record when it starts, is paid, changes, is refunded and ends, with the plan, the amount, the currency, whether it began with a trial, whether you came through a content creator's link, and Stripe's short code for why a payment was made or a subscription ended. We use these events to work out revenue, recurring revenue and how many subscribers leave. They carry no Stripe number, no email address and no card or billing details. They carry a key that we compute from the subscription's number at Stripe with a secret that only we hold. Without that secret nobody else can compute the key or turn it back into the number, so neither PostHog nor Stripe can tell which subscription it belongs to. If you have allowed analytics, these events are linked to your account identifier. If you have not, they are recorded without it, with the time Stripe gives for each payment, and are grouped under the key, so that the payments of one subscription count as one subscriber.
These events are pseudonymised, not anonymous. We hold the secret and the subscription's number, so we could find the events of your subscription. If you allowed analytics while subscribed, the same key is also on events linked to your account identifier, until those are deleted when you withdraw your consent or delete your account (sections 12.3 and 10.1). You can object to these events: section 11.1 explains how.
Sections 8.4, 12 and 13 say more about when analytics run and who receives them.
3.9 Data we receive from others
-
Google and Apple, if you sign in through them: see section 3.1.
-
Stripe: payment confirmations and subscription status.
-
Another user, if they invite you or name you in a story idea: see section 11.
3.10 What you have to provide
You need an email address, or a Google or Apple sign-in, and a username to have an account. Without them we cannot give you one. A Kid Profile is optional. Payment details are required only for a paid plan or trial.
4. Children
Booklly is used by adults. We do not offer accounts to children and we do not knowingly collect personal data from children. If you believe a child has created an account, write to us and we will delete it.
4.1 Kid Profiles
You add a Kid Profile as the child's parent or guardian, or with that person's permission. We use it to fit stories to the child's age and interests and to show the profile to you and your Family member. We do not use it for advertising, we do not sell it, and we do not build a marketing profile of your child.
4.2 What reaches AI providers and what does not
When you create a story for a Kid Profile:
| Kid Profile detail | Sent to AI providers |
|---|---|
| First name | No |
| Date of birth | No. We send the age in whole years. |
| Photo | No |
| Gender | Yes |
| Interests | Yes |
The hero of a story gets an invented name. Your child's name appears in a story only if you type it yourself, into an idea or a character. In that case it is sent to the AI providers and can appear in the published story, its title, its web address and its audio.
In the app you confirm once that story content goes to AI providers, and we keep a record of that confirmation.
4.3 Where a child's first name does go
- To our email provider, in the email that tells you a story for that child is ready.
It does not go to PostHog. Section 3.8 says what an analytics event about a Kid Profile carries.
4.4 Removing a Kid Profile
When you remove a Kid Profile, its photo is deleted and the profile disappears from your account. The remaining details are erased when you delete your account, or earlier if you ask us at hello@booklly.com.
5. Why we use your data and on what legal basis
| Purpose | Data | Legal basis under the GDPR |
|---|---|---|
| Creating and running your account, signing you in | Account data | Contract, Art. 6(1)(b) |
| Creating stories, series, illustrations and audio from what you type | Ideas, characters, stories | Contract, Art. 6(1)(b) |
| Fitting a story to a child | The child's age, gender and interests | Legitimate interest, yours and ours, in the personalised story you asked for, Art. 6(1)(f) |
| Publishing stories in the Library, and using stories that contain no personal data in our advertising | Stories. They are not meant to contain personal data. | Legitimate interest in running a shared library and promoting Booklly, Art. 6(1)(f). If a story contains personal data, we rely on this only until the person concerned or a parent objects. See section 6. |
| Subscriptions, credits, payments | Payment and plan data | Contract, Art. 6(1)(b) |
| Invoices and tax records | Billing records | Legal obligation, Art. 6(1)(c) |
| Service emails: confirmation, password reset, billing, answers to your messages | Email address, message content | Contract, Art. 6(1)(b) |
| Story-ready emails and push notifications | Email address, push token, story title, the child's first name in the email | Legitimate interest in telling you that what you ordered is ready, Art. 6(1)(f). You can turn the emails off. Push needs your permission on the device. |
| Newsletters | Email address, username, chosen topics, plan | Consent, Art. 6(1)(a) |
| Sharing your own content and details within a Family or group account | Username, email, stories, favourites | Contract, Art. 6(1)(b) |
| Showing Kid Profiles to your Family member, and sending an invitation to a person you name | Kid Profiles, the invited person's email address | Legitimate interest in the sharing you asked for, Art. 6(1)(f) |
| Handling reports and telling people our decisions | Reports, stories, account data | Legal obligation under the Digital Services Act, Art. 6(1)(c) |
| Checking stories before publication and enforcing our terms | Stories, ideas, account data | Legitimate interest in a safe library, Art. 6(1)(f), and contract, Art. 6(1)(b) |
| Security, fraud and abuse prevention, rate limiting, error diagnosis | Logs, IP address, account identifier, email address | Legitimate interest in a secure and working service, Art. 6(1)(f) |
| Checking and improving the quality of generated stories | Ideas, prompts and outputs of story production | Legitimate interest in improving the service, Art. 6(1)(f) |
| Analytics and session recordings that your browser or the app sends after you allow them, and linking analytics to your account identifier | Usage data, session recordings, approximate location on the website, account identifier | Consent, Art. 6(1)(a) |
| On the website in the United States, until you choose: usage statistics not linked to your account, error reports and page speed measurement | Usage data, approximate location, device and browser data | Legitimate interest in knowing how the website is used and keeping it working, Art. 6(1)(f). This is not consent. "Reject all" stops it. See section 12.3. |
| Remembering your analytics choice with your account, so that our servers can follow it and we can show what you chose | The choice, where you made it, when it last changed, the version of the consent text | For a choice to allow analytics, our obligation to be able to show that you consented, Art. 6(1)(c) with Art. 7(1). For a choice not to allow them, legitimate interest in applying it everywhere, Art. 6(1)(f). |
| Usage statistics that our servers record without your account identifier | Events without your account identifier or any story, series or Kid Profile identifier, with random identifiers and rounded values: what happened, plan, language, age group, story length and similar general values. See section 3.8. | Legitimate interest in knowing how much Booklly is used and what to improve, Art. 6(1)(f). You can object, section 11.1. |
| Revenue statistics | Subscription and payment events: plan, amount, currency, and a key computed from the subscription's number with a secret only we hold. See section 3.8. | Legitimate interest in knowing our revenue and how many subscribers stay, Art. 6(1)(f). You can object, section 11.1. |
| Deleting your analytics at PostHog when you withdraw consent or delete your account, and keeping a record that we did | Account identifier, the reason, the dates | Legal obligation to erase, Art. 6(1)(c) with Art. 17 |
| Answering legal claims and requests from authorities | What the case requires | Legal obligation, Art. 6(1)(c), or legitimate interest, Art. 6(1)(f) |
The confirmation screen in the app is an extra step that Apple requires before content goes to AI providers. It is not the legal basis for creating stories.
6. Public stories and advertising
Every story you confirm, and every series episode you start, is published in the public Booklly Library when it is ready. Booklly does not offer private stories.
What is public: the title, cover, summary, characters, illustrations, text and audio of the story. Visitors who are not signed in see the opening of the text. Registered users and subscribers can read and listen to all of it. Search engines and AI crawlers can index public pages.
What we do not display: your username, your email address, the Kid Profile, and the idea you typed. The web addresses of a story's images and audio contain your internal account identifier, which is a random string.
We use stories in our own advertising, for example in short videos on social media. To make these we may process a story's text and illustrations with AI video and voice tools.
A story should not contain personal data. If we know that one does, we do not use it in advertising. We remove it from the Library and from advertising when you, your child or the person concerned asks. We do this without undue delay, and within 7 days at the latest. Write to hello@booklly.com with the link.
Once a story is removed, its page is no longer available, so search engines drop it over time. On request we ask search engines to remove it sooner. We cannot recall copies that search engines, AI crawlers or other people made while the story was public.
Do not type health, religion or similar sensitive details into an idea. If we find them in a story, we remove the story.
7. What we send to AI providers
| What | Who receives it | Why |
|---|---|---|
| The child's age in years, gender and interests, the category, your story idea, character names and descriptions, and titles and summaries of your recent stories | The text model providers | Writing the story |
| The story text, title and character names | The text model providers | Editing for safety and age fit, and working out characters, dialogue and scenes |
| Interests you type yourself | The text model providers | Checking that the interest is suitable |
| Character names and descriptions of how a voice should sound | TypeSafe AI | Choosing a narration voice for each character |
| Character and scene descriptions, and the character images already generated | OpenAI and Google | Illustrations |
| The story text, split by speaker | ElevenLabs | Narration |
| The narration audio | AssemblyAI | Timing the text to the audio |
| Prompts and outputs of story and series production | Braintrust | Checking quality and finding faults |
With each request to a text or voice-casting model, and in our quality records at Braintrust, we include your internal account identifier. It is a random string. It is not your name or email address.
We never send AI providers your email address, your password, your payment details, or a Kid Profile's name, date of birth or photo.
The providers process this content to return a result to us. Under their terms they may keep requests for a limited time to detect abuse. We set up our accounts so that providers do not use this content to train their models. We do not train AI models on your content ourselves.
8. Who receives your data
We do not sell personal data. We share it only with the providers below and in the cases listed in section 8.6.
Most of these providers act on our instructions under a contract. Each of them is bound to protect your data at least as well as this policy does and to use it only for the purpose listed. Stripe, Google Analytics, Cloudflare and Product Hunt also use data for their own purposes under their own privacy policies.
8.1 Hosting and infrastructure
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | Everything stored in your account, including Kid Profiles and stories | EU, Ireland |
| Vercel | Hosting of the website and its server functions, background jobs, the gateway to AI models, performance measurement | All requests including IP address, server logs, the content of story production jobs | United States |
| Upstash | Rate limiting | Account identifier or IP address. Email address for password reset requests. | EU, Germany (Frankfurt) |
| Cloudflare | Bot check on the contact form and the web report form | IP address and browser signals | United States |
8.2 AI providers
| Provider | What it does | Where |
|---|---|---|
| Google, OpenAI, Anthropic and DeepSeek models, reached through Vercel's AI Gateway | Text generation | United States |
| TypeSafe AI | Voice casting | United States |
| OpenAI | Illustrations | United States |
| Illustrations | United States | |
| ElevenLabs | Narration | United States, EU |
| AssemblyAI | Audio timing | United States |
| Braintrust | Quality records of story production | EU, with account administration in the United States |
Section 7 lists what each of them receives. We may change which models we use. This table is updated when a new provider is added.
8.3 Payments and email
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Stripe | Checkout, billing, invoices, tax calculation | Email address, account identifier, billing address, card details, plan | Ireland, United States |
| Resend | Sending our emails and holding newsletter contacts | Email address and the content of each email. For newsletter subscribers also username, chosen topics and plan. | United States |
8.4 Monitoring and analytics
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Sentry | Error reports. On the website also session replay. | From our servers: error details with your account identifier and email address, and for security events also IP address and browser type. From your browser: error details, and session replays only after you choose "Accept all". Replays hide text and media. From the app: error details with your account identifier only. | EU, Germany. Sentry is a US company. |
| PostHog | Product analytics, session recordings on the website, revenue statistics | From your browser and the app, if you allow analytics, and on the website in the United States also before you choose: usage events, on the website with an approximate location, and session recordings only after you choose "Accept all". From our servers: events about what happened in Booklly, including subscription and payment events with plan, amount and currency. They are linked to your account identifier only if you allowed analytics yourself. See section 3.8. | EU, Frankfurt in Germany. PostHog is a US company. |
| Google Analytics | Website traffic statistics. Google also uses this data for its own purposes. | Pages viewed with their cleaned address and the fixed title "Booklly" (section 3.8), device and browser data, a cookie identifier, IP address | Ireland, United States |
Error reports from our servers are sent to Sentry without asking for consent, because we need them to keep the service working and secure. Your analytics choice, described in section 12.3 for the website and in section 13 for the app, decides three things: whether analytics tools run in your browser or in the app, whether your visits on the website are recorded, and whether the events our servers record are linked to your account identifier. On the website in the United States, plain statistics, error reports and page speed run until you choose. The events that our servers record without your account identifier, and the subscription and payment events, are sent to PostHog whatever you choose, unless you object (section 11.1). Section 3.8 says what they contain and section 5 on what legal basis.
8.5 Sign-in, push notifications and embedded content
| Provider | What it does | What it receives |
|---|---|---|
| Google, Apple | Sign-in, if you choose it | The fact that you signed in to Booklly |
| Expo and Apple | Delivering push notifications to the app | Push token, notification title and text |
| Product Hunt | A badge image in the website footer, loaded from Product Hunt's servers | IP address and browser type |
Push notifications contain a story or series title, or the username of a person who invited you. They never contain story text or a Kid Profile's name.
8.6 Other cases
-
Your Family member and the administrators of your group account see what section 3.6 describes.
-
People at Booklly who administer the service can see accounts, stories, ideas, Kid Profiles, messages and reports when they need to, for support, moderation and fault finding.
-
We disclose data to authorities or courts when the law requires it.
-
If Booklly is sold or merged, your data passes to the new operator, who must keep to this policy. We will tell you beforehand.
9. Transfers outside the EU
Many of our providers are based in the United States or process data there. This includes the production of stories, which runs on servers in the United States.
For these transfers we rely on:
-
the European Commission's adequacy decision for the EU-US Data Privacy Framework, for providers certified under it,
-
the European Commission's Standard Contractual Clauses for all other transfers, together with additional safeguards where needed. The same clauses apply to certified providers if the adequacy decision stops applying.
Some providers store our data in the EU but are US companies, for example PostHog and Sentry. Access to that data from the United States, for example by their support staff, is covered by the same safeguards in each provider's data processing agreement.
Write to us if you want a copy of the safeguards that apply to a particular provider.
10. How long we keep data
| Data | How long |
|---|---|
| Account data | Until you delete your account |
| Kid Profiles | Until you delete your account. A removed profile's photo is deleted at once. Its other details are erased on request or with the account. |
| Drafts, archived drafts and anything never published | Until you delete your account |
| Published stories | Kept after you delete your account, without any link to your username or sign-in details. See section 10.1. |
| Invoices and the records needed to support them, including the billing events from Stripe | 10 years after the end of the year they relate to, as the Value Added Tax Act requires |
| Subscription history and Story Credit records | 5 years after the subscription ends, the general limitation period for claims |
| Contact messages and story reports | 3 years after the matter is closed |
| Waiting list email addresses | Until you are invited, and no longer than 12 months |
| Invitations that were not accepted | 12 months |
| Push tokens | Until you sign out or delete your account, or 90 days after the app last used them. Delivery records are kept 30 days. |
| The record that you confirmed sharing with AI providers | 5 years after it was given, as evidence |
| Rate limiting counters | A short time, normally a day or less |
| Server logs and error reports | Up to 90 days |
| Records of story production: prompts, outputs, job history | Up to 12 months |
| Your analytics choice, and a note of your objection | Until you change it or delete your account |
| Session recordings at PostHog | 30 days |
| Analytics events and profiles at PostHog, including subscription and payment events | Up to 7 years. This is the fixed period for which PostHog keeps them on our plan. Those linked to your account identifier are deleted earlier, within 30 days, when you withdraw your consent or delete your account. |
| Google Analytics | 2 months, the data retention period set in Google Analytics |
| The record that we deleted your analytics at PostHog | 3 years after the deletion was completed, as evidence that we did it. Then the record is deleted automatically. |
10.1 Deleting your account
You can delete your account in the app under Profile, then Delete account. On the website, write to hello@booklly.com from the email address of your account and we delete it within 30 days. In the app, a subscription that will renew has to be cancelled first. If you write to us, we cancel it for you.
When your account is deleted:
-
Your username, sign-in details, Kid Profiles and their photos, favourites, email preferences, your saved analytics choice and any objection, push tokens, Family and group memberships and the pending invitations you sent are deleted. Your newsletter contact is removed from our email provider. If you signed in with Apple, we revoke that connection.
-
Stories and series that were never published are deleted together with their illustrations and audio.
-
Stories in the public Library stay. They are no longer connected to your username or your sign-in details. If you want one removed, ask us before you delete your account. If you ask afterwards, send us the link and we remove a story that contains personal data.
-
If you had a subscription, the billing records we must keep stay linked internally to the same account identifier for the period in the table above. Stripe keeps its own payment records under its policy.
-
Reports you filed stay, without a link to you. The record of your AI confirmation stays for the period in the table above.
-
Your analytics profile at PostHog, the events linked to your account identifier and your session recordings are deleted. We send the request to PostHog ourselves, without you having to ask, and it is carried out within 30 days. Events that were recorded without your account identifier cannot be picked out as yours after that. They stay for the period in the table above, and so do the subscription and payment events recorded under their key. Events about the account that arrive after the deletion, for example the end of a subscription that was running out, are recorded without your account identifier. Payment records at Stripe and our own billing records stay, as the bullet above says.
Deletion cannot be undone.
11. Your rights
Under the GDPR you have the right to:
-
get access to your data and a copy of it,
-
have wrong data corrected,
-
have your data deleted,
-
have its use restricted,
-
receive the data you gave us in a common machine-readable format, or have it sent to another provider,
-
withdraw a consent at any time. This does not affect what happened before you withdrew,
-
object to uses of your data that we base on legitimate interest. Section 11.1 explains this right separately.
If someone invited you. We received your email address from the person who invited you. We use it only to send the invitation, and we delete it after 12 months if you do not accept.
If you are named in a story. We received that information from the person who typed the idea. Write to us and we remove the story.
On the website you can change your username, email address, Kid Profiles and email preferences in your account. In the app you can change Kid Profiles, email preferences and your password. For everything else, write to hello@booklly.com. We answer within one month. If a request is complex we may need up to two more months, and we will tell you so. We may ask you to confirm your identity.
Exercising your rights costs nothing, and we will not treat you worse for it. In the app you confirm once that story content goes to AI providers. Without that confirmation the app cannot create stories. You can still read and listen.
You also have the right to complain to a data protection authority, in the country where you live or in Slovenia:
Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, Slovenia. Email: gp.ip@ip-rs.si. Phone: +386 1 230 97 30. Website: https://www.ip-rs.si
11.1 Your right to object
You can object at any time, on grounds relating to your particular situation, to any use of your data that we base on legitimate interest (section 5). If you object to the use of your data for advertising, we always stop, whatever the grounds.
You can object, for example, to:
-
the publication of a story that contains personal data (section 6),
-
the usage statistics that our servers record without your account identifier, and the subscription and payment events (section 3.8),
-
on the website in the United States, the statistics, error reports and page speed measurement that run before you choose. To stop them at once, choose "Reject all" or turn analytics off under Cookie preferences.
To object, write to hello@booklly.com from the email address of your account, or use the contact form at https://booklly.com/contact-us.
When you object to our server-side analytics, we switch them off for your account. From then on our servers send no analytics event about your account to PostHog: none linked to you, none without your account identifier, and no subscription or payment event. Your objection does not change the analytics choice on your devices. You make that one in the cookie preferences and in the app.
Your objection does not delete what was recorded before it. Those events stay for the period in section 10. This includes the events recorded without your account identifier, the events linked to your account identifier while you allowed analytics, and the subscription and payment events recorded under your subscription's key. From your objection on, our servers send no analytics event about your account.
Withdrawing your consent is a separate step. If you allowed analytics and then turn them off, in the cookie preferences or in the app, we delete your analytics profile at PostHog and the events linked to your account identifier within 30 days (section 12.3). An objection does not do this. Withdrawing your consent does not stop the events our servers record without your account identifier. Only an objection does. If you want both, object and turn analytics off.
12. Cookies and similar technology on the website
12.1 Necessary cookies
These are needed for the website to work. They do not need consent.
| Cookie | Purpose | Lifetime |
|---|---|---|
sb-…-auth-token | Keeps you signed in | Up to 400 days, renewed while you use Booklly |
cc_cookie | Remembers your cookie choice and which version of the banner text you answered | 400 days |
x-booklly-geo | Remembers which cookie rules apply to your region | 1 hour |
platform_language | Remembers your language | 1 year |
content_language_offer_dismissed | Remembers that you dismissed a language suggestion | 1 year |
auth_redirect_to | Returns you to the right page after you confirm your email | 1 hour |
waitlist_override_code | Remembers an invitation code | 7 days |
booklly_ref | Remembers the referral link that brought you to Booklly, so the content creator who shared it is credited when you sign up | 30 days by default (Booklly can set it between 1 and 365 days) |
sidebar_state | Remembers whether a side panel is open | 7 days |
We also keep some settings in your browser's storage: playback progress, autoplay and full-screen settings, a sleep timer, and which stories you viewed or marked on this device. We use the last one so that a view or a play is counted only once. When you are signed in, we also note there which analytics choice of yours we have already saved with your account, so that it is sent only once. This information stays in your browser.
Stripe sets its own cookies on its checkout and billing pages.
12.2 Analytics cookies
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
Cookies whose names start with ph_ | PostHog | Product analytics and session recordings | 1 year |
_ga, _gid and cookies whose names start with _ga_ | Google Analytics | Traffic statistics. Google can also use this data for its own purposes. | Up to 2 years |
PostHog also keeps entries whose names start with ph_ in your browser's local and session storage. Its script is loaded only once analytics are allowed, or on the website in the United States until you turn them off. Your browser sends PostHog's data to booklly.com, to addresses that start with /ingest, and we pass it on to PostHog's servers in the EU. We pass on your IP address, so that PostHog can work out the approximate location described in section 3.8, but none of our cookies and none of your sign-in details.
Sentry keeps the state of a session replay in your browser's session storage until you close the tab. We also use Vercel Speed Insights to measure page speed. It sets no cookies.
12.3 Your choice
Outside the United States, analytics are off until you choose "Accept all" in the cookie banner or turn them on in the cookie preferences. Before that, none of the tools in section 12.2 is loaded, nothing is stored in your browser for them and nothing is sent to them.
In the United States, plain analytics run by default: PostHog usage statistics that are not linked to your account, Google Analytics, error reports to Sentry and Vercel Speed Insights. We rely on our legitimate interest in knowing how the website is used and keeping it working (Art. 6(1)(f) GDPR). This is not your consent, and we do not record it as your choice. Session recordings, by PostHog and by Sentry, and the link between analytics and your account start only after you choose "Accept all". "Reject all" turns all analytics off.
When you accept, we record the page you are on as it is at that moment: the page view, and what is on the screen then, with the time of your click. Nothing you did on the page before the click is sent.
Your choice decides three things:
-
whether the analytics tools in section 12.2 run in your browser at all: their cookies, the events and error reports your browser sends, and page speed measurement,
-
whether your visits are recorded,
-
whether the events that our servers record are linked to your account identifier. Only a choice you made yourself links them.
It does not stop our servers from recording some events. Section 3.8 explains what they record without your account identifier, and what they record about subscriptions and payments. Section 11.1 explains how to object to them.
When you are signed in, we save your choice with your account: whether you allowed analytics, whether you chose on the website or in the app, when, and which version of our consent text you were shown. Our servers need it when you are not on the website, for example when a story is finished or a payment arrives, and it lets us show what you chose. We keep one saved choice per account: the latest one, whether you made it on the website or in the app. A "no" on one device therefore counts as withdrawing your consent for the whole account. While you are using Booklly, our servers follow the choice of the browser or app you are using at that moment. Nothing is saved until you choose. The default in the United States is never saved as a choice.
You can change your choice at any time through the Cookie preferences link in the website footer. When you turn analytics off, PostHog, Sentry, Google Analytics and Vercel Speed Insights stop at once, without a reload. PostHog also forgets which visitor this browser was and removes what it stored in the browser.
If you had allowed analytics on your account, turning them off while you are signed in, on the website or in the app, also deletes your analytics profile at PostHog, the events linked to your account identifier and your session recordings. We send the request to PostHog ourselves and it is carried out within 30 days. If you turn analytics off while signed out, this happens the next time you sign in on that browser. It does not delete the events that were never linked to your account, or what Google Analytics and Sentry received before.
We do not use advertising cookies and we do not track you across other websites.
13. The iPhone and iPad app
-
The app stores your sign-in session in the device's secure Keychain.
-
It stores preferences on the device: language, appearance, reader and player settings, where you stopped listening, recent searches, drafts of creation forms, and a cache of Library data that expires after 7 days. Signing out clears what belongs to your account.
-
The app does not download stories for offline use.
-
It does not ask for access to your camera, microphone, contacts or location. A Kid Profile photo is chosen through the system photo picker, so the app sees only the photo you pick.
-
Push notifications are optional. If you allow them, we store the push token and a random installation identifier with your account. We send notifications only about your own stories, series and Family invitations. You can turn them off in the device settings.
-
Usage statistics and crash reports in the app are off until you allow them. The app asks once. You can change your answer at any time under Profile, then Privacy. The choice belongs to this installation of the app and stays when you sign out.
-
While they are on, the app sends: that the app was installed, updated, opened, brought to the front or put in the background; which screens you open, by the general name of the screen; which stories and series you open and listen to, by their identifiers; listening time and player actions; searching, without the words, filtering and sharing; the onboarding steps you finish or skip; the walls and prompts you were shown; your answer to the push notification question; the opening of a notification or a link, without its address; and crash and error reports. With them go a random identifier of the installation, your account identifier while you are signed in, the app version, the system and its version, whether the device is an iPhone or an iPad, its screen size, and its language and time zone settings. Usage statistics go to PostHog and crash reports to Sentry. Section 3.8 says what product analytics never contain.
-
Usage statistics from the app carry no location: PostHog does not work one out from the IP address. The app does not record the screen.
-
When you turn them off, the app stops at once, discards what it had not yet sent and deletes the identifier it used. If you had allowed them on your account, we also delete your analytics profile at PostHog and the events linked to your account identifier, within 30 days, as section 12.3 describes. If you turn them off while signed out, this happens the next time you sign in on that device.
-
The app does not use the advertising identifier and does not track you across other companies' apps and websites.
-
Every request from the app carries the app version, so that our servers can respond correctly. Once you have answered the analytics question, every request also carries your answer, and while you are signed in we save it with your account, with the version of the question you answered. Our servers use it as section 12.3 describes. Whatever you answer, our servers count some events, such as a story being created, without linking them to you. Section 3.8 explains this, and what applies to subscriptions and payments. Section 11.1 explains how to object to it.
14. Emails
-
Service emails are always sent: email confirmation, password reset, security codes, billing notices, Family and group invitations, and replies to your messages. Stripe sends invoices, receipts and failed-payment notices itself.
-
Story updates tell you when a story or series is ready. They are on by default. You can turn them off in your settings.
-
Content updates and product news are newsletters. They are off unless you turn them on, and every newsletter has an unsubscribe link.
15. Security
We protect your data with encryption in transit, access controls in the database, optional two-factor authentication for users and mandatory two-factor authentication for administrators, rate limiting, and logging of security events. Kid Profile photos are kept in private storage and are shown only through links that expire.
No system is fully secure. If you find a weakness, please tell us at hello@booklly.com.
16. Automated decisions
We do not make decisions about you by automated means that have legal effects or similarly significant effects on you.
Two things are automated. An AI editor checks and rewrites stories before publication. A story with three open reports from three different accounts is hidden until a person at Booklly has reviewed it. Section 11.4 of our Terms of Service explains how to object to a moderation decision.
17. If you live outside the EU
We apply this policy to everyone.
If you live in the United Kingdom, you have the same rights under UK data protection law, and you can complain to the Information Commissioner's Office.
If you live in the United States: we do not sell personal information and we do not share it for targeted advertising. Booklly is for adults. We do not knowingly collect personal information from children under 13. Information about a child is provided by the parent or guardian.
18. Changes to this policy
We update this policy when the service or the law changes. Each version has a number at the top and the page shows when it was last updated. If a change is important, for example a new purpose or a new kind of recipient, we tell you by email or in the product before it applies.
19. Contact
Računalniško programiranje Janko Tomšič s.p., Pugljeva ulica 1, 8000 Novo mesto, Slovenia. Email: hello@booklly.com