Little Tales Co.Little Tales Co. — Privacy Policy
Last updated: 11 September 2026.
1. Who we are
Little Tales Co. ("we", "us", "our") operates the Little Tales Co. app and website at https://littletalesco.com (the "Service"). The Service helps a parent or carer collect stories in their own voice — or a grandparent's or friend's voice — and turn them into something a child can listen to, including through a Yoto player.
Little Tales Co. is the registered business name of Tomas Draper (sole trader), ABN 78 443 483 135. Privacy contact: [email protected]
We are not currently registered for GST, so no GST is charged on subscriptions or credit packs. All prices are in Australian dollars.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
2. Who the Service is for, and a note on children
Accounts are for adults. You must be 18 or over to create an account and to subscribe. Children do not have accounts, logins or profiles of their own, and we do not knowingly collect personal information directly from a child.
Parents and carers do tell us about their children so the Service can personalise stories — for example a child's first name, an age band, and story preferences. That information is provided by the adult, and the adult is responsible for having the authority to provide it.
This matters for the way we treat audio recordings. If a recording is made with a child present or with a child speaking, the recording may contain a child's voice. We treat those recordings with additional care (see §5 and §7) and we only accept them where the adult account holder has the consent of everyone recorded, or the legal authority to record them.
3. What we collect
You give us:
- Account details: name, email address, password (stored only as a secure hash).
- Family details: the names and age bands of the children you are making stories
for, and your story and voice preferences.
- Audio recordings and story text you create, upload or record.
- Invitations you send, and the details of the people you invite (name, email).
- Yoto account authorisation, if you choose to connect a Yoto player.
- Messages you send us for support.
We collect automatically:
- Technical and usage information: device and browser type, pages or screens
used, actions taken, approximate region, and error and performance data.
- Cookies and similar technologies needed to keep you signed in and to measure
whether the Service is working. We do not use advertising cookies.
We receive from others:
- Payment confirmations and subscription status from Stripe. **We never receive
or store your full card number** — card details go directly to Stripe.
- Delivery and bounce information about emails we send.
We do not collect government identifiers, and we do not ask for your date of birth, home address, or a child's full name, school or location.
4. Why we collect it, and our legal basis
| Purpose | What we use | |---|---| | Provide the Service: record, store, organise and play stories | Account, family, recording data | | Generate AI stories when requested | The story prompt you or the Service builds — this can include a child's first name, age band and preferences | | Sync content to your Yoto player, if you connect one | Your Yoto authorisation and the story audio you choose to send | | Operate subscriptions and process payments | Account email, subscription status, Stripe identifiers | | Send service email (password reset, verification, receipts, invitations) | Email address | | Support, safety and abuse prevention | Account and usage data | | Understand whether the Service works, and improve it | Usage and diagnostic data |
We do not sell your personal information, and we do not use your recordings or your child's details for advertising.
5. AI-generated stories, and where that happens
When an AI story is requested, we send a text prompt to our AI provider to generate the story. That prompt is sent to DeepSeek (api.deepseek.com), and because DeepSeek processes data outside Australia, this is an overseas disclosure (see §6).
What we send: the story prompt — which may include the child's first name, their age band, the type of story, and any preferences or wildcards the adult chose.
What we do not send: your audio recordings, your email address, your password, payment details, or your account identifiers.
A note on this choice. Story generation is currently performed by DeepSeek, which processes data outside Australia. We have deliberately limited what is sent to the smallest useful set of details, and we do not send recordings, email addresses, passwords, payment details or account identifiers. This is the single biggest privacy question in this policy, and parents may ask about it directly.
6. Who else handles your information (overseas disclosure)
We use service providers to run the Service. Each one only receives what it needs.
- Stripe (payments and subscriptions) — United States and global.
Receives: your email and payment details, entered directly with Stripe.
- Resend (sending our service email) — United States.
Receives: the recipient's email address and the message contents (for example a password-reset link, or an invitation).
- Cloudflare (DNS, secure network routing, inbound email routing, and
website analytics) — global network, with data processed at edge locations.
- DeepSeek (AI story text generation) — China. See §5.
- Yoto (only if you connect a player) — United Kingdom. Receives the audio you
choose to send and the minimum needed to upload it to your account.
Our application data — including your account and your recordings — is hosted on infrastructure we control, located in Australia.
Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the APPs.
7. How we protect it
- All traffic to the Service is encrypted in transit (TLS).
- Passwords are stored only as a salted hash — we cannot read them.
- Recordings are stored in private object storage and are served through
time-limited, signed links rather than being publicly readable.
- Access to production systems is restricted, credential-based, and logged.
- We keep backups so we can restore the Service after a failure.
No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.
8. How long we keep it
- Active accounts: as long as your account is open.
- Free-tier recordings: retained for 30 days. After that, recordings are
removed unless you have an active subscription.
- Paid subscriptions: for as long as you subscribe, then removed in line with our
deletion process.
- Deleted content: removed from live systems promptly, and from backups as those
backups expire.
- Billing records: kept as long as tax and accounting law requires.
Recordings and story content for a cancelled paid account are deleted from live systems within 30 days. Encrypted backups are cycled and expire within 90 days, after which that data is no longer recoverable.
9. Your rights and choices
You can ask us to:
- give you access to the personal information we hold about you;
- correct anything inaccurate;
- delete your account and the recordings in it;
- stop using your information for a particular purpose, where we can still
provide the Service;
- tell you how a decision affecting you was made.
Email [email protected] and we will respond within a reasonable period (and within 30 days where the APPs require it). Some information may be retained where the law requires it, such as billing records.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
10. Children's privacy
Because we hold information about children that is provided by their parent or carer, we:
- only accept it from an adult who has the authority to provide it;
- do not let children create accounts, log in, or receive marketing;
- do not use children's details to train AI models, or for advertising;
- take extra care with any recording that may contain a child's voice; and
- will delete a child's information on the request of their parent, carer or
guardian.
Australia is developing a Children's Online Privacy Code under the Privacy Act reforms. We will review our practices against the Code as it takes effect and update this policy if anything needs to change.
11. Cookies
We use essential cookies and storage to keep you signed in and to operate the Service securely, and limited analytics to understand whether features work. We do not use advertising or cross-site tracking cookies.
12. Changes
If we make a material change to this policy, we will tell account holders by email or an in-app notice before it takes effect, and update the date at the top.