Privacy Policy

Effective and last updated: July 22, 2026. This policy applies to the A Grand Story iOS app, website, private podcast delivery, voice invitations, and support services.

Who operates A Grand Story

A Grand Story is a service of Speedboat Design LLC, a United States company. Speedboat Design LLC is the controller of the personal information described in this policy unless another company, such as Apple, acts under its own privacy policy. Privacy questions and requests can be sent to hello@agrandstory.com.

Information we collect

• Adult account and support information: email address, authentication identifiers, support messages, and optional contact details an adult supplies.
• Adult-provided child information: a child name or nickname, optional age, and story topics selected by the adult account holder. Children do not create accounts, purchase subscriptions, or directly submit this information.
• Family and storyteller information: names or labels, relationships, invitations, permission records, and family membership details.
• Voice and story information: voice recordings, transcripts used to validate recordings, derived voice-conditioning data, generated audio, selected stories, and private podcast-feed records.
• Purchase and entitlement information: Apple transaction or entitlement records used to verify access. Apple processes payment-card information; we do not receive full payment-card details. Limited legacy Stripe records may remain for people who previously subscribed on the web.
• Technical and security information: app-install and device identifiers, app version, request and error records, authentication and anti-abuse signals, and IP-derived network information processed by our hosting providers.
• Analytics: limited app events such as onboarding steps, category or episode identifiers, playback, and generation outcomes, together with a random app-install identifier. Analytics must not contain names, email addresses, transcripts, audio, or free-text family details.
• Website and waitlist information: pages and aggregate performance measurements collected through Vercel, and an email address if an adult asks for the App Store launch notice. The public website does not load Microsoft UET or Clarity and does not intentionally set advertising or attribution cookies.

How and why we use information

• Provide accounts, private stories, voice generation, family sync, invitations, podcast delivery, purchases, support, export, and deletion controls.
• Personalize stories using only the family details the adult chooses to provide.
• Verify storyteller permission, prevent impersonation and abuse, protect family content, investigate failures, and enforce service rules.
• Measure reliability and improve the app using minimized analytics that exclude family content.
• Send an immediate waitlist confirmation and the requested App Store launch notice. We do not use the request as permission for unrelated marketing.
• Meet legal, accounting, security, and regulatory obligations.

Voice and AI processing

A storyteller's voice may be recorded in the app or through a private invitation. We ask for permission before a voice is prepared. Recordings are uploaded securely to validate and transcribe the sample and to create a voice representation used to generate private family stories. A Grand Story currently runs its voice-generation and transcription models in its own Modal-hosted environment rather than sending family audio to a general-purpose AI chat service.

A voice is intended only for the family account and uses authorized by the consenting storyteller. We do not sell voice data, use it for advertising, or use family recordings to train a general-purpose model. Users may not upload or clone a voice without the speaker's permission. Contact us if consent is withdrawn or a voice was submitted without authority.

Children's Privacy

A Grand Story is designed to be set up and managed by an adult. Before child information is added, the adult is asked to confirm that they are the parent or legal guardian and consent to the selected details being used for private story personalization. We do not ask children to create accounts, provide email addresses, make purchases, upload photos, or provide free-text profiles.

We do not show third-party advertising to children or use child information for behavioral advertising. A parent or guardian can review, correct, export, or delete child information in the app where available or by emailing us. A parent may refuse further collection and request deletion without losing access to unrelated support requests, subject to information that must be retained by law.

Lawful bases for EEA and UK processing

Where European Economic Area or United Kingdom data-protection law applies, our lawful bases are: performance of a contract for account, story, subscription, sync, and support functions; consent for optional voice preparation and adult-provided child personalization where consent is required; legitimate interests in security, fraud prevention, service reliability, and minimized measurement; and legal obligation for required records. Consent may be withdrawn for future processing, but withdrawal does not make earlier lawful processing unlawful.

Service providers and disclosures

We disclose only the information reasonably needed for providers to perform services for us. Current or planned production providers include:

• Apple: app distribution, Sign in with Apple, purchases, device services, and Apple-controlled analytics.
• Supabase: authentication, database sync, and storage.
• Modal: hosted compute, transcription, voice preparation, and story-audio generation.
• TelemetryDeck: minimized app-product analytics using a random install identifier.
• Vercel: website hosting, serverless functions, aggregate web analytics, and performance measurement.
• Resend: account, support, waitlist, and service email delivery.
• Stripe: management of limited legacy web subscriptions; new iOS subscriptions are sold through Apple.
• Google Fonts: delivery of website font files, which can expose ordinary request information such as IP address and browser details to Google.

We may also disclose information when required by law, to investigate fraud or security incidents, to protect users, or as part of a business transaction subject to appropriate safeguards. We do not sell personal information. We do not disclose personal information for cross-context behavioral advertising.

Retention and deletion

• Account, family, voice, and generated-story data is retained while needed to provide the account and until the adult deletes it or requests deletion, subject to legal and security exceptions.
• Voice-invitation uploads are removed after import or after the invitation expires and the short operational cleanup period ends.
• Local copies remain on a device until removed in the app, the app's data is erased, or the app is deleted. Server deletion cannot erase copies another person independently exported or saved.
• Waitlist details are used for the requested launch notice and then removed from the active waitlist after the notice and an operational cleanup period.
• Support, security, transaction, consent, and deletion records may be retained as needed to resolve requests, prevent abuse, establish permission, comply with law, and document completed deletion.
• Provider backups and logs expire according to provider backup and security cycles. We do not restore deleted family content except when technically necessary to recover from a security or service incident.

Your privacy rights

Depending on where you live, you may have rights to access, obtain a copy of, correct, delete, or restrict personal information; object to certain processing; withdraw consent; and receive portable data. You may also appeal a denied privacy request and lodge a complaint with your local data-protection authority. California and other state residents may have additional rights, including information about categories collected and disclosed and freedom from discrimination for exercising a privacy right.

Send requests to hello@agrandstory.com. We may verify that the requester is the adult account holder, storyteller, parent, guardian, or authorized agent before acting. We do not charge for ordinary requests, but applicable law may allow limits for repetitive or manifestly unfounded requests.

International transfers

Speedboat Design LLC and several service providers operate in the United States. Information from the EEA, UK, or other regions may therefore be processed in the United States or another country where a provider operates. Where required, we rely on contractual protections such as approved standard contractual clauses, provider participation in an applicable data-transfer framework, or another lawful transfer mechanism.

Security and incidents

We use measures designed to protect family content, including encrypted transport, authenticated access, private family identifiers, restricted service credentials, and deletion controls. No system is perfectly secure. If a legally reportable breach occurs, we will notify affected people and regulators as required.

Changes and contact

We may update this policy when the service, providers, or law changes. Material changes will be dated and communicated where required. Questions, accessibility requests, and privacy requests can be sent to hello@agrandstory.com.