SoftSteps Privacy Policy
Last updated: [DATE]
This policy explains what SoftSteps ("we," "us") collects when you use our
website at [DOMAIN] (the "Service"), why, and what choices you have.
1. Who this applies to
SoftSteps is meant to be used by adults — parents, guardians, or other
caregivers — on behalf of a child. You must be at least 18 (or the age of
legal majority where you live) to create an account. Children do not
create their own accounts or provide their own information to us directly.
2. Information we collect
Account information
Email address and password. Passwords are handled by our authentication
provider (Supabase) — we never see or store them in plain text.
Profile information you provide
- Your name
- Your child's first name and age
- A photo of your child, if you choose to add one (optional)
- Your preferred language
Content you create
- The topic and any details you enter to generate a custom story
- The stories and illustrations generated for your account
Payment information
We don't collect or store your card details ourselves. Payments are
handled entirely by Stripe — see Stripe's privacy policy for how they
handle it.
Technical information
Standard data collected automatically by our hosting provider (IP
address, browser type, general usage patterns), and used, among other
things, to prevent abuse — for example, limiting how many stories one
account can generate per day.
Advertising information *[include this section only once/if the Meta
Pixel or Conversions API is actually implemented]*
If you arrive at SoftSteps through an ad, we may use advertising
identifiers and event data (like "signed up" or "purchased a story") to
measure how our ads perform, through tools including the Meta Pixel and
Conversions API.
3. How we use this information
- To generate and deliver personalized stories and illustrations
- To create and maintain your account, and let you access stories you've saved
- To process payments
- To send account-related emails — confirmation, receipts, password resets
- To send occasional reminder emails if you started unlocking a story and
didn't finish. Every one of these carries an unsubscribe link, and opting out
stops them without affecting your receipts or account emails
- To keep the Service secure and prevent abuse
- To improve the product
- For advertising, only with your interaction with our ads as described above
4. Who we share information with
We don't sell personal information. We share it only as needed to run the
Service, with:
- Supabase — database hosting, account authentication, and photo storage
- Anthropic — writes the text of custom stories. Only what's needed for
that story is sent (your child's first name, age, and the topic/details
you entered) — not your email, password, or payment information
- [Image generation provider, e.g. OpenAI] — generates personalized
illustrations using your uploaded photo as a reference, for accounts
where this feature is active
- Stripe — payment processing
- [Email provider, e.g. Resend/SendGrid] — delivers account emails
- Meta — only if you've interacted with our advertising, to measure ad
performance *[include only if implemented]*
- Law enforcement or regulators, only if we're legally required to
Each of these companies has its own privacy policy governing how it
handles data on our behalf.
5. Children's privacy
Children do not create accounts, log in, or provide information to us
directly — a parent or guardian does, on their behalf, and that
information stays under the account holder's control (viewable and
editable anytime from Edit Profile; deletable on request).
If you believe a child has provided us with information directly, without
a parent or guardian's involvement, contact us at [SUPPORT EMAIL] and
we'll delete it.
6. Your choices and rights
- Access & correction — update your profile anytime from Edit Profile.
- Deletion — you can delete your account and its data yourself, at any
time, from Edit Profile → Delete account. This removes your account, your
child's profile and photo, and your stories. Some records are retained
where we're legally required to keep them (e.g. payment records held by
our payment processor for tax and accounting purposes). You can also
email [SUPPORT EMAIL] if you'd rather we handle it for you.
- California residents have rights under the CCPA/CPRA to know,
delete, and opt out of the sale of personal information — we don't sell it.
- EU/UK residents have rights under the GDPR to access, correct,
delete, and port their data, and to object to certain processing.
7. Data retention
We keep your information while your account is active, and for a
reasonable period afterward, unless you ask us to delete it sooner.
8. Security
We use industry-standard safeguards — encrypted connections (HTTPS) and
database rules that keep each account's data separate from every other
account's. No system is perfectly secure, and we can't guarantee absolute
security.
9. International data transfers
Our service providers may process data in the United States or other
countries outside your own. *[Add Standard Contractual Clauses or
equivalent language here if you'll have meaningful EU/UK usage.]*
10. Changes to this policy
We'll update the date at the top when we make changes, and post the
revised policy here. For significant changes, we'll also email you.
11. Contact us
Questions about this policy: [SUPPORT EMAIL]