Privacy Policy

1. Introduction

Taleworthy ("we", "us", "our") operates the Taleworthy mobile application. This Privacy Policy explains how we collect, use, and protect your information when you use our app.

We believe in plain language. This policy is written to be read, not to obscure. If anything is unclear, contact us at privacy@taleworthy.app.

2. Data We Collect

Without an Account

When you use Taleworthy without linking an account, we collect only what is necessary to operate the app:

• Anonymous device UUID — a random identifier generated locally on your device. This is not your device's hardware ID; it is generated by the app and can be reset by deleting and reinstalling.
• Push notification token — only if you grant permission for push notifications. Used solely to send you story recommendations.
• User mode preference — whether you use the app as a speaker or a browser (set during onboarding, stored with your anonymous ID).
• IP address hash — your IP address is hashed and rotated daily. The raw IP is never stored; the hash is used solely for rate limiting.

With a Linked Account

If you choose to link an account (optional, required only for cross-device sync and Premium features):

• Email address — used for account authentication and, if you opt in, for product announcements.
• Favorites and collections — stories you save are stored server-side so they persist across devices.
• Search query length — we record the character count of your searches for usage analytics. The full text of your search queries is processed transiently by our AI provider (OpenAI) to generate results, but is never stored by us.

3. How We Use Your Data

We use the data described above for the following purposes:

• Providing search results and story recommendations personalized to your preferences
• Processing subscription purchases and verifying entitlements
• Sending push notifications (only if you have opted in)
• Crash reporting and maintaining app stability
• Anonymous usage analytics to understand how features are used and improve the app
• Rate limiting to ensure fair access for all users

We do not use your data for advertising, we do not sell your data, and we do not share your data with third parties for their own marketing purposes.

4. Third-Party Services

Taleworthy uses the following third-party services to operate. Each service processes only the data necessary for its stated purpose:

Links to each provider's privacy policy are available on request at privacy@taleworthy.app.

5. Data We Do NOT Collect

Taleworthy does not collect:

• IDFA (Identifier for Advertisers) or any other advertising identifiers
• Cross-app tracking data or browsing history outside the app
• Location data (precise or coarse)
• Contacts, photos, camera, or microphone data
• Health or fitness data
• Any data from children under 13 (see Children's Privacy section)

PostHog analytics uses anonymous IDs only — there is no device fingerprinting or connection between your analytics events and your identity.

6. Data Retention

We retain data only as long as necessary:

• Active account data — retained while your account exists. Deleting your account permanently removes your personal data from our systems.
• Deleted account audit records — when you delete your account, a minimal audit record is retained for 90 days for fraud prevention, then permanently purged.
• Anonymized engagement data — when an account is deleted, your favorites and collection interactions are transferred to an anonymous profile (a "shadow profile") to preserve aggregate usage statistics. This anonymized data contains no information that can identify you and may be retained indefinitely. It cannot be traced back to you.
• Push tokens — removed when you disable notifications or delete the app.

7. Your Rights

You have the following rights regarding your data:

• Access — view your saved stories and collections in the Library tab at any time.
• Deletion — delete your account permanently via Profile > Delete Account. This is immediate and cannot be undone. It removes your email, account data, favorites, and collections.
• Portability — Premium subscribers can export their saved stories via the Export function in the app.
• Analytics opt-out — to opt out of PostHog analytics, contact us at privacy@taleworthy.app.

For any data rights request not handled within the app, contact us at privacy@taleworthy.app and we will respond within 30 days.

8. Children's Privacy

Taleworthy is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@taleworthy.app and we will delete that information promptly.

9. Security

We take reasonable measures to protect your information:

• All data is encrypted in transit using TLS/HTTPS.
• Database access is controlled by Row Level Security policies — each user can only access their own data.
• Service role keys that have full database access are never included in the mobile app bundle. All privileged operations occur server-side in our Edge Functions.
• Raw IP addresses are never stored — only daily-rotated hashes used for rate limiting.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to using industry-standard practices to protect your information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — changes that affect how we collect or use your data in significant ways — we will notify you via an in-app banner the next time you open the app.

Continued use of Taleworthy after changes to this policy constitutes your acceptance of the updated terms. The effective date at the top of this page will always reflect when the policy was last updated.

11. Contact

Questions, concerns, or data rights requests: