1. Overview
Naratale is a collaborative storytelling app for families. Accounts are created by people who are 13 years of age or older; younger children play together with a parent or guardian on that adult's account. This Privacy Policy explains what information we collect, how we use it, when we share it, and what choices you have when you use the Naratale mobile app and related services.
By using Naratale, you agree to this Privacy Policy. If you do not agree, do not use the service.
2. Who Can Use Naratale
Naratale accounts are for people aged 13 and older. We do not knowingly allow children under 13 to create accounts, and we do not knowingly collect account information from them. Children under 13 can take part in stories on a parent's or guardian's account. When the account holder selects the child profile, analytics are switched off and purchases, online play and social features require a grown-up check. During onboarding we ask users to confirm they are at least 13 years old and to accept the current Terms of Service and Privacy Policy.
3. Information We Collect
3.1 Account and identity information
- Email address
- Display name
- Profile image or avatar you choose to use
- Authentication identifiers from Google Sign-In or email sign-in
- Consent records for age confirmation, Terms acceptance, and Privacy Policy acceptance
3.2 Story and gameplay information
- Story titles, metadata, card sequences, settings, and completion state
- Audio recording references and locally stored recording paths
- Player profiles you create in the app
- Favorites, Star Dust balance, login streaks, purchases, and unlocked content
- Online play and invite data needed to support friends, rooms, and shared sessions
- Reports you send about another player or a shared story, and the list of players you have blocked
3.3 Shared and public content
If you choose to share a story or take part in online features, other users may be able to see content you intentionally publish or share, including story titles, story content, profile display information, friend codes, invitation state, and other multiplayer/session details needed for the feature to work.
3.4 Device, diagnostics, and analytics data
- Device type, operating system, app version, language, and settings
- Crash reports from the app. They go to a crash-reporting service that we host ourselves (GlitchTip) and carry no name or email address. They are sent whether or not analytics consent has been given, so that we can find and fix faults.
- Product analytics in the app, collected through PostHog only after you grant analytics consent, and never while the child profile is selected
- On our web pages for story, join, and invitation links, anonymous counts of page views and button taps through PostHog. These pages set no analytics cookies and store no identifier in your browser.
3.5 Purchase information
On Android and iOS, in-app purchases and subscriptions are processed by the Google Play Store or Apple App Store. We use RevenueCat to validate and manage store entitlements. We receive purchase status, product identifiers, entitlement state, and transaction-related metadata, but we do not receive your full card number.
4. How We Use Information
- Provide account access, story creation, syncing, playback, and sharing features
- Support online rooms, friend connections, and invitations
- Deliver purchases, subscriptions, rewards, and premium content
- Protect the app, detect abuse, and enforce our Terms
- Fix bugs and keep the app stable using crash reports, and measure usage in the app when analytics consent has been granted
- Review reports about players or shared stories, and act on them by removing content or restricting accounts
- Respond to support, legal, privacy, and deletion requests
5. Storage and Retention
- Account data, story metadata, and app state are stored in Supabase.
- On Android, story recordings may be saved on your device in public audio storage through MediaStore.
- On iOS, recordings are stored inside the app sandbox.
- Solo story recordings stay on your device by default. A solo recording is uploaded to our cloud storage (Supabase) when a parent chooses to create a shareable link.
- During an in-app online voice call, the participants' audio is carried by our own voice server (a self-hosted LiveKit server running on the same infrastructure as our backend); it is not sent to a third-party voice provider. The call is not recorded by default. A mixed audio recording is made only while every participant in the call has explicitly allowed story recording. If anyone withdraws that choice, leaves, or joins without allowing it, the recording stops, and any participant can stop it at any time. The recording is saved privately in our storage under the host's account so each participant can save their story, and it is deleted with the host's account. Sharing a saved story still requires a separate action.
- Shared recordings are accessed through unguessable, revocable links; revoking a link removes its cloud copy when it is no longer referenced. An online story's private call recording may remain available to its participants separately from a shared link.
- We keep data for as long as needed to operate the service, satisfy legal obligations, resolve disputes, and prevent abuse.
- When you delete your account, we aim to remove or anonymize account-linked data unless we must retain limited records for legal, tax, fraud-prevention, or dispute-resolution reasons.
6. Sharing and Third Parties
We do not sell your personal information. We share information only when needed to run the service or when required by law.
- Supabase: backend hosting, authentication, database, storage, and edge functions
- Google: sign-in, Android platform services, and Google Play billing where applicable
- Apple: App Store billing where applicable
- RevenueCat: purchase validation and entitlement management
- PostHog: product analytics in the app after consent, and anonymous cookieless counts on our link pages
7. Your Choices and Rights
- You can review or update some profile information inside the app.
- You can disable analytics collection by not granting analytics consent or by withdrawing that consent where available.
- You can report or block another player from the online lobby or your friends list, review your blocked players in your profile, and report a shared story from its web page.
- You can request account deletion inside the app or through https://naratale.app/delete-account.
- Depending on your location, you may also have rights to access, correct, export, or erase personal data, and to object to certain processing.
8. Important Subscription Note
Important: Deleting your Naratale account does not automatically cancel store-managed subscriptions. If you subscribed through Google Play or the App Store, you must cancel the subscription through that store account.
9. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No system is perfectly secure, so we cannot guarantee absolute security.
10. International Transfers
Your information may be processed in countries other than the one where you live, depending on the infrastructure and providers used to operate the service. When we do this, we rely on appropriate safeguards where required by law.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we may notify you in the app or by other reasonable means. Continued use after the updated policy becomes effective means you accept the changes.
12. Contact