Privacy Policy

Bedtime Letters is the data controller for the information described here. We are a small UK business. The best way to reach us — about anything on this page, including a request to see or delete your data — is privacy@bedtimeletters.com, and a real person reads it.

We are based in the United Kingdom, and we handle personal data under the UK GDPR and the Data Protection Act 2018.

Everything below comes from you — the parent or guardian. We never collect anything from your child directly.

• Your account: your email address, and a password if you set one. If you sign in with Google, we receive your email address from Google — never your Google password.
• Your child's profile: first name, age, pronouns, interests, favourite things, values you want reflected, things to avoid, any notes you give us about how they experience the world (for example sensory or neurodivergence notes), languages, and the bedtime and timezone you choose.
• Their story world:the stories we write, and a running “story bible” of characters and details so tonight's story remembers last night's.
• Life notes: anything you tell us by replying to a story email or by adding a note in the dashboard, so the stories can follow what is actually happening in their life.
• Delivery data:when a story was emailed, and whether the email was opened. Opens are measured with a small invisible image in the email; if your email app blocks images, we simply don't know.
• Payment data: handled entirely by Stripe. We store only your Stripe customer and subscription reference, your plan and its status. We never see or store your card details.
• Website analytics:anonymous page-view counts, collected without cookies and without anything being stored on your device. We cannot identify you from them. See “Cookies” below.

• To perform our contract with you:your account, your child's profile, the stories, and delivery — this is the product you asked for. Without it there is no story.
• Your explicit consent:notes you choose to give us about your child's health, sensitivities or neurodivergence. These are optional. You can remove them at any time by editing the child's profile, and the next story is written without them.
• Our legitimate interests: keeping the service running, preventing abuse, and understanding at a basic level how the site is used.
• Legal obligation: keeping records of payments for tax and accounting.

Bedtime Letters is a service for parents and guardians. Your child has no account, cannot sign in, and is never contacted by us. The profile you build is used for one purpose: to write their story. We do not build advertising profiles, we do not sell data, and we do not share a child's details with anyone beyond the providers listed below.

You must be 18 or over and the parent or guardian of the child, or have their guardian's permission, to enter a child's details.

We use a small number of service providers. Each one only gets what it needs to do its job.

• Supabase — our database and sign-in system. Your data is stored in the EU (Ireland).
• Vercel — hosts the website and the nightly job that writes and sends the stories.
• Resend — sends the story emails and receives your replies.
• xAI (Grok)— writes the stories. Your child's profile, their story world and your life notes are sent to xAI's API to generate and safety-check each night's story.
• Stripe — takes payments and stores your card details under its own privacy policy.
• Vercel Web Analytics — cookieless page-view counts.

Some of these providers are based in the United States, so your information may be transferred outside the UK. Where that happens, the transfer is covered by the providers' standard contractual clauses and equivalent safeguards.

We do not sell your data, and we do not use it to train our own AI models.

We keep your account, your child's profile and their stories for as long as your account is open — the whole point is that the stories remember. If you delete a child, their profile, story world and stories are deleted with them. If you close your account, we delete your data within 30 days, except payment records we are legally required to keep. Encrypted backups may hold copies for a short period after that before rolling off.

You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to us processing it. You can withdraw any consent you have given at any time. Email privacy@bedtimeletters.com and we will respond within one month.

If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, so we can fix it.

We set a small number of essential cookies to keep you signed in — the site cannot work without them, and UK law does not require us to ask permission for cookies that are strictly necessary.

That is the only thing we store on your device. Our analytics are cookieless: they count page views without storing anything on your device and without following you anywhere else. That is why you have not been shown a cookie banner — we do not set anything that would need your consent.

Data is encrypted in transit and at rest by our providers, and access to the database is restricted so that an account can only ever read its own children and stories. No system is perfect; if something ever goes wrong that affects you, we will tell you.

If we change this policy in a way that matters, we will email you before it takes effect. The date at the top always shows the current version.

See also our Terms of Service.