StudyTale Privacy Policy
Adopted: September 28, 2026 / Revised and effective: October 25, 2026
StudyTale lets adults create books for their families and read with children. This policy explains our handling of information in the app, on our website and in support requests. Please also read our Terms of Use. Accepting the Terms does not, by itself, give permission for photos, third-party AI processing or optional analytics.
Contents
1. Operator and contact
Personal information business operator and data controller: tempi株式会社 (tempi Inc.)
- Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan
- Representative: Yota Ishikawa
- Privacy contact: lab@tempi.co.jp
- Telephone: +81 70-8470-4644 (070-8470-4644 within Japan)
- Contact form
You can contact us by email or post without using the form. Please mention “StudyTale”.
2. Information and its sources
| Information | Source and content |
|---|---|
| Account | Authentication identifiers, name/display name, email (including Apple's private relay email) and tokens from Apple/Google sign-in; the time of your adult declaration. We do not receive your provider password. |
| Family and group | Group names, memberships, invitations and reader profiles entered by adults: name or nickname, birth year and month, interests, first and learning languages. We do not request the day of birth. |
| Characters and books | Selected photos and drawings you upload, names, traits, descriptions, creation/editing requests, generated text, images and narration, related settings, features noted from photos of people, and your confirmation (with its time) that no one under 16 appears in a photo or that the person is 16 or over. We do not collect your whole photo library, microphone recordings or voice clones. |
| Purchases and permissions | Purchase identifiers, products, subscription/trial/renewal status from Apple/RevenueCat, and allowance records. The version, language, text hash, time and withdrawal of AI/image permissions and Terms acceptance. We do not receive card numbers. |
| Communications and operations | Connection IP addresses, technical device/OS/app information, authentication/processing results, times, latency, costs and errors; optional data described in Section 9 when enabled. |
| Support | Names, reply addresses, messages, attachments, optional company names/telephone numbers and correspondence that you provide. |
We do not use facial recognition or compare facial features to identify people. AI does analyse images to describe appearance and create character reference images. We try to remove location and similar data from photos when sending them, but cannot guarantee it in every case. Please also check backgrounds and name badges before uploading.
Photos of children (under 16) are not sent to OpenAI. Unless you confirm the person is 16 or over, a photo of a person is sent only to Cloudflare's AI to check safety and write down features such as hairstyle, hair, skin and eye colour, glasses, clothes and expression. The photo is not stored and is discarded right away. You can review and edit the notes, and only the confirmed notes are used to draw the character. Photos of people confirmed to be 16 or over, and photos of toys, pets and drawings, are sent to OpenAI themselves, for a closer likeness. When a photo seems to show a person, the app checks it on your device (the image is not sent anywhere for this check) and asks you to confirm that no one under 16 appears in it, recording when you confirmed. Because the on-device check is not perfect, OpenAI's safety check also rejects photos showing someone who looks under 16.
3. Purposes and legal bases
We use information as necessary to:
- Authenticate users and manage accounts, groups, invitations, sharing, synchronisation and offline reading.
- Generate and check the safety of age-, interest- and language-appropriate books, characters, translations and narration.
- Verify purchases, manage allowances and restoration, and handle refunds, misuse and support.
- Maintain security, diagnose problems, operate the service reliably and perform permitted optional usage analysis.
- Handle rights requests, legal obligations, disputes, necessary notices and proof of permissions.
We do not use it for advertising, behavioural targeting, sale to data brokers or commercial behavioural profiling of children. We do not sell personal data or combine it with other companies' advertising data.
Where a legal basis is required, including in the EEA or UK, adult account and purchase processing relies on contract performance; optional analytics and image processing rely on consent; necessary security and diagnostics rely on legitimate interests subject to balancing individual rights; and legal compliance relies on legal obligations. Personalisation involving a child's data requires consent from the individual or an authorised parent/guardian, as appropriate to age and capacity. A contract with an adult does not provide the basis for every processing operation involving a child. This service does not make decisions based solely on automation that produce legal or similarly significant effects.
Do not enter school names, addresses, health/disability information, religion or other sensitive information. We do not require information unnecessary for a feature and handle requests concerning sensitive information submitted in error through our contact point.
4. Children and permission
Account creation, purchases and data-entry operations are for people who are at least 18 and legally adults where they live. We require an adult self-declaration to create an account. This does not mean that identity or parental authority has been verified. The free library can be read without an account.
An authorised parent/guardian should register a child's profile. Obtain necessary permission for other people. Explain to children, in an age-appropriate way, what you are making and who will see it. The app is not designed to ask children themselves to submit their names or photos.
Before personalised AI use, we show the information sent to AI service providers (Sections 5 and 6), its purposes, overseas processing, retention and group sharing, and obtain express permission. Photos and drawings require additional image permission. New covered requests are refused without permission for the current version. Text descriptions and official characters provide alternatives to images.
You can withdraw AI or image permission in Settings > Account. This stops new covered submissions from that account. It does not automatically cancel already accepted work or processing another member permits. Contact us under Section 12 to delete existing shared content or stop processing concerning a child more broadly. Withdrawal does not affect prior lawful processing or restrict access to the free library or your rights.
5. AI use and retention
To make books, we send necessary inputs and related outputs to these AI service providers.
| Provider | Used for | Main information sent |
|---|---|---|
| Anthropic | Family books' stories, translations and furigana; descriptions of the sounds their pictures play when tapped; safety checks of requests and text | The reader's name, age, interests and languages; character names and traits; your requests; book text |
| OpenAI | Pictures (illustrations, covers and characters); safety checks of photos and descriptions of appearance; free-library books' text | Picture instructions (family names are not sent: characters are called "Character 1" or "the child"), character trait notes, the photos described in Section 2 |
| TypeSafe | Finding the parts of a picture a child can tap | Illustrations and English descriptions without names |
| Cloudflare | Safety checks of children's photos and noting their features (Section 2) | Photos of people (not stored) |
| ElevenLabs | Narration and sound effects | Book text (which can contain names) and sound descriptions |
Neither we nor these providers use what we send to train AI models. Not training does not mean not keeping. Providers may keep records for a period for safety, abuse monitoring and legal compliance. Periods differ by provider and follow each provider's terms linked in Section 6. ElevenLabs keeps generation history.
6. Providers and external services
| Provider and principal processing locations | Purposes | Provider information |
|---|---|---|
| Anthropic / US and other locations | Writing, translating and safety-checking family books' text, and describing the sounds their pictures play when tapped (Section 5) | Privacy |
| OpenAI / US and other locations | Drawing pictures, safety checks of photos and descriptions of appearance, free-library books' text (Section 5) | Privacy |
| TypeSafe / US | Finding the parts of a picture a child can tap (Section 5) | Privacy |
| ElevenLabs / US, UK and other locations | Narration audio and sound effects | Privacy |
| Cloudflare / Japan, US and other network locations | Communications, delivery, storage, image transformation, processing and security; safety checks of children's photos and noting their features (photos are not stored or used for AI training) | Privacy and subprocessors |
| PlanetScale / database in Tokyo, Japan; operations/support in the US and elsewhere | Account, shared content, permission and purchase databases and backups | Privacy |
| RevenueCat / US and other locations | Purchase verification, access, restoration and fraud prevention | Privacy |
| Apple / Japan, US and other locations | Sign-in and App Store payment, renewal and refunds (Apple also processes information for its own services) | Privacy |
| Google / US and other locations | Sign-in and the contact form (Google also processes information for its own services) | Privacy |
| PostHog / US | Usage analysis, when permitted | Privacy |
| Sentry (Functional Software) / US and other locations | Diagnostics and security | Privacy |
Authorised staff of ours or providers may review information as necessary for generation, operation, security or legal compliance. We notify you of provider changes as appropriate and obtain legally required permission before new processing.
7. Group sharing and other disclosure
Groups have up to 30 members. Members share the bookshelf, books, characters, reader profiles (including names, birth year/month, interests and languages), member display names and information such as whether a subscription enables creation. New members can also see existing shared content. We do not publish email addresses or card numbers in member lists. Original uploads are not a shared photo library, but derived appearances, names, reference images and illustrations form part of shared content.
Give invitation codes/links only to people you trust. We cannot fully prevent recipients' downloads or screenshots. We do not republish personal books or photos in the public library or other groups without permission.
We may disclose information as permitted by applicable law for legal requirements, lawful rights requests, protection of life or physical safety, business succession and similar circumstances. Disclosures requiring consent are preceded by the necessary information and consent.
8. Information about overseas processing
Section 6 services involve transmission from Japan to the US and elsewhere, overseas maintenance/support and subprocessors. Distributed processing and providers' support/subprocessor locations mean it may not be possible to identify every individual processing country in advance. The table and provider subprocessor information identify expected locations; contact us for the latest information available to us.
For transfers based on consent under Article 28 of Japan's APPI, this information is accessible from permission screens before you decide. The US has no single comprehensive federal personal data law covering all sectors; sectoral and state laws apply, and its framework differs from Japan's. The UK has UK GDPR and related laws. See also the Japanese Personal Information Protection Commission's foreign-system research. Information about recipients' access restrictions, purpose limitations, subprocessors and deletion is based on their publications linked in Section 6. This does not mean we have independently audited all overseas locations.
Transfers relying on equivalent protective measures require continuing checks and provision of information, and we review processing where necessary protection cannot be secured. Transfers from the EEA/UK require applicable adequacy decisions, standard contractual clauses or another valid mechanism, with necessary supplementary measures. Adequacy for Japan does not authorise every subsequent onward transfer.
9. External transmissions, optional measurement and local storage
This section also explains information sent from devices. Providers' purposes include operating and securing their services and complying with law.
| Destination | Information sent and our purposes | Choice |
|---|---|---|
| Our API and Cloudflare | Requests, selected inputs/images, credentials and connection information such as IP. App/site functions, delivery and security. | Necessary communications; separate permission for images and other covered processing. |
| Apple and Google | Authentication communications when you select sign-in; Apple purchase/restoration communications. | Needed for the authentication/purchase function you select. |
| RevenueCat | App user ID, purchase and technical device/app information. Subscription verification and restoration. | Needed for purchase functionality. |
| PostHog, through us | Types and times of adult creation/purchase interactions and a random identifier. Understanding feature use. | Only when enabled in an adult account's settings; off by default. |
| Sentry | Crashes, error types/locations, device/OS/app details and technical identifiers. Diagnostics. | Device diagnostics has a separate optional setting, off by default. Restricted server error records are processed for reliable operation. |
Analytics does not identify you by name or email, and we do not pass your IP address to PostHog. Reading interactions, text you enter and photos are not sent. Because random identifiers are used, we do not call this completely anonymous. Sentry does not receive screenshots, text you enter, credentials or AI responses.
The two optional settings can be changed separately in Settings > Account. Turning either off stops subsequent covered transmissions. Neither SDK starts when signed out. Withdrawal alone does not automatically delete previous records; contact us for deletion.
Devices store authentication, language and reading preferences, offline books and image/audio caches. Website fonts are served by us; the site sets no advertising or analytics cookies. Linked Apple, Google and other sites apply their own practices.
10. Retention and deletion
10.1 Retention criteria
| Information | Period or ending condition |
|---|---|
| Original photos/drawings | Deleted when the creation screen closes or the character is saved (if you close it while the character is still being drawn, as soon as the drawing finishes). Leftovers are normally deleted within an hour; failures can delay this. Retention by AI service providers is described in Section 5. |
| Characters in progress (redrawn pictures and notes) | A new character is saved automatically when its first picture is finished. A redrawn picture waits in the Characters tab until you use or delete it, and is deleted after 24 hours if not chosen. Notes are deleted when you close the creation screen (or, while a redrawn picture is waiting, together with it). |
| Account, authentication, permissions and subscription status | While needed to provide the account; removed from our active database on account deletion. Specific records needed for disputes or legal duties may be retained for limited purposes and periods. |
| Shared profiles, characters, books and generated audio | While provided as the group's bookshelf, until individual/group deletion. Subscription cancellation alone does not delete them. Unnecessary content can be deleted, and an annual operational review also considers retention necessity. |
| AI cost/latency records and received billing notifications | 90 days, followed by scheduled deletion. Stories and photos are not stored as the content of cost records. |
| Support and rights-request records | Our operational standard is normally one year after resolution, with reason and duration limited for ongoing disputes or legal retention. Verification documents are kept only as long as necessary for verification. |
| External service records | AI service providers: Section 5. Analytics and diagnostic records are subject to each service's settings and legal duties; we review whether they are still needed and delete them. For deletion requests, we identify relevant records and ask providers to act too. |
| Database recovery copies | Kept for two days, separate from ordinary use. On recovery, deleted information is kept from returning to ordinary use. |
We do not retain data for permanent storage as an end in itself. We delete it or make it no longer attributable to individuals when purposes end, on requests or as required by law. Separately required accounting records are retained for the legally required period; book inputs/photos are not retained as accounting evidence.
10.2 Deleting, leaving and cancelling
Content deletion is limited to its creator, group owner or other authorised roles. Deleting a profile/character does not remove names or images already incorporated into books. You can delete your account in Settings > Account.
Account deletion removes authentication, sessions, personal settings and related records, and leaves all groups. Where members remain, shared content is not automatically erased in full; it remains without its link to the deleted creator account. Ownership passes to the longest-standing remaining member, with user ID breaking a tie. A group is deleted when its last member leaves.
Parents who do not want their child's information retained may contact us under Section 12 whether or not they have an account or owner permissions. We do not refuse a statutory deletion request solely because information is shared by a group. We also consider others' rights and legal retention obligations.
Media deletion includes asynchronous processing. Requests to delete information at providers or revoke Apple authentication can be delayed by communication failures. Already running generation cannot necessarily be cancelled immediately. Contact us if deletion is not reflected so we can investigate. Deleting an account/app or leaving a group does not cancel an Apple subscription.
10.3 Copies on other devices and delivery systems
Signing out, leaving or deleting an account triggers removal of app-managed local content and image caches on that device. Other devices reflect changes on their next connection/synchronisation. We cannot immediately erase offline devices, copies made by users or all OS-managed storage remotely. Links to pictures and audio expire after up to about seven days; until then, a person who knows a link may open it. Where required, we also contact recipients concerning deletion or other action.
11. Security and incidents
We use authentication and group access controls, encrypted communications, expiring links, management of secret credentials and restrictions on diagnostic information. The operator is responsible for handling information and reviewing access, providers, unnecessary data deletion and incident communication/recovery. We cannot guarantee that we or providers will never have an incident or retain any data.
We investigate suspected breaches, contain harm and take corrective action, and report to authorities/notify affected people as required by applicable law. This includes reportable incidents in Japan and, where applicable, GDPR notification to authorities normally within 72 hours, subject to the conditions and deadlines of each jurisdiction.
12. Individual and parental rights
Contact us for notification of purposes, access to held data and disclosure records, correction, addition, deletion, cessation of use or third-party disclosure. Where applicable, we also address copies/portability, restriction, objection, withdrawal and freedom from discriminatory treatment. Parents can request review or deletion of their child's information and cessation of further processing.
We identify the relevant account, group and information and request only necessary identity, representative or parental-authority verification. Do not send passwords or payment details. Requests are normally free, and we normally respond within one month or a shorter applicable legal deadline. Where an extension is legally permitted, we explain it and the expected time within the original deadline. If we cannot fully comply, we explain why and the available procedures.
You may complain to a competent authority, including Japan's Personal Information Protection Commission, your EEA supervisory authority or the UK's ICO.
13. Regional protections
We apply age, consent and notice requirements relevant to where children live. Under US COPPA, information entered by a parent is distinguished from information collected online from a child. Adult self-declaration does not fulfil direct-notice or verifiable-parental-consent requirements where those apply. We do not condition participation on more information than reasonably necessary, or retain covered information longer than needed for its purpose.
The EEA and UK require understandable child-facing explanations, applicable consent ages, privacy-protective defaults and legally required representation and related arrangements. We have not appointed an EEA or UK representative as of the effective date; we will publish contact details when appointed. App distribution settings alone do not mean that every local arrangement has been completed.
Where US state or other laws apply, we address access, correction, deletion, objection/appeal and age-appropriate protections. We do not sell personal data or share it for targeted advertising. For Japan's 2026 APPI amendments, we distinguish promulgation from commencement of individual provisions and respond as they take effect.
14. Changes, language and history
Japanese is the authoritative version; this English version translates the same content. This does not limit mandatory rights where you live. We give advance notice of material changes and effective dates on this site and, as appropriate, in the app or otherwise. Processing requiring new consent begins only after consent is obtained.
On revision, this page will state the effective date and principal changes. We retain prior versions, which may be requested through our contact point. September 28, 2026: initial adoption. October 15, 2026: added Anthropic for family books' text and TypeSafe for finding the parts of a picture a child can tap, and simplified technical explanations. October 25, 2026: added Anthropic describing the sounds family books' pictures play when tapped.