Privacy Policy

Kimoa is a family bedtime story app. It is rated 4+ in the App Store, but the account holder must be a parent or guardian who is at least 13 years old, or 16 years old in the EU or UK where required by local law. Kimoa is not in Apple's Kids category, and it does not create child accounts or child profiles.

1. Who We Are

Kimoa is operated by Every Toys Dream LLC. In this policy, "Kimoa," "we," "us," and "our" refer to Every Toys Dream LLC and the Kimoa app and website.

2. Information We Collect

We collect the following categories of information when you use Kimoa:

• Account information: your email address, hashed password, active sessions, and account-related verification or reset records.
• User-generated content: story prompts you type, generated story text, generated cover images, and generated audio narration.
• Usage data: story generation counts, per-request cost telemetry, operational logs, error logs, and analytics events such as screens viewed and features used.
• Device and technical data: data collected through the PostHog React Native SDK for app analytics, such as device model, operating system version, app version, and an anonymous device identifier. We do not collect IDFA and we do not use cross-app tracking identifiers.
• Support communications: information you send us when you contact support or make a privacy request.

3. How We Use Information

We use personal information to:

• create and manage your account;
• authenticate sign-in and keep your account secure;
• generate stories, cover images, and narrated audio you request;
• store and sync your stories and media files;
• measure service usage, performance, reliability, and cost;
• send transactional emails such as verification codes, password reset codes, password-change confirmations, and account-deletion confirmations;
• respond to support, privacy, deletion, GDPR, and CCPA requests;
• detect abuse, enforce our Terms of Service, and protect the service.

4. Legal Bases for Processing

If you are in the EEA, UK, or another jurisdiction that requires a legal basis, we rely on:

• Contract performance: to create your account, provide Kimoa, generate stories, store your content, and deliver requested features.
• Consent: where you voluntarily provide prompts, request AI generation, or contact us for support.
• Legitimate interests: to secure the service, prevent abuse, troubleshoot issues, analyze service performance, and improve the product in a privacy-conscious way.
• Legal obligations: where we must retain, disclose, or delete information to comply with applicable law.

5. Third-Party Processors

We use third-party service providers to operate Kimoa. These providers process information on our behalf for the purposes described below:

• Convex for backend database, authentication, sessions, stories metadata, and server functions. Privacy Policy: convex.dev/privacy
• Cloudflare R2 for object storage of generated cover images and narrated audio files. Privacy Policy: cloudflare.com/privacypolicy
• PostHog Cloud for product analytics in the mobile app. We use PostHog for analytics only, not advertising identifiers. Privacy Policy: posthog.com/privacy
• Resend for transactional email delivery, including verification, password reset, account-deletion confirmation, and password-change confirmation emails. Privacy Policy: resend.com/legal/privacy-policy
• Google Gemini API for AI generation of story text and cover images. Your prompts and generated output pass through Google's API when generation is requested. Privacy Policy: policies.google.com/privacy
• ElevenLabs for AI voice narration. Story text is sent to ElevenLabs to create audio narration. Privacy Policy: elevenlabs.io/privacy
• DeepSeek as a server-side fallback text-generation provider when configured. Prompts may pass through DeepSeek's API when it is used. Privacy Policy: deepseek.com/privacy

6. Cookies, Website Analytics, and Tracking

The current public Kimoa website is primarily informational and does not currently include third-party advertising trackers or website analytics. The site does, however, load certain technical assets from third-party providers, including Google Fonts and the Tailwind CSS CDN, which may receive standard request data such as your IP address, browser information, and the page requesting the asset. The Kimoa mobile app uses PostHog analytics as described above. If we later add website analytics, non-essential cookies, or similar tracking tools, we will update this Privacy Policy before or when those tools are enabled.

7. Children's Data and Family Use

Kimoa is intended for family bedtime use, but the account holder must be an adult parent or guardian. We do not knowingly collect personal information directly from children. The service is used by the adult account holder, who may create or read a story for a child. Kimoa does not create child accounts or child profiles.

Kimoa is not enrolled in Apple's Kids category and is not presented to App Review as a child-directed app whose primary user is a child. If we learn that we collected personal information directly from a child without the required legal basis, we will delete that information.

8. Data Retention

We keep personal information for the following periods unless a longer retention period is required by law:

• Account data and stories: until you delete the story, delete your account, or ask us to delete your information.
• Anonymized generation logs used for performance or cost analysis: up to 90 days, then aggregated or deleted.
• Error logs: up to 90 days.
• Analytics data: according to our PostHog retention settings and PostHog's service practices.
• Support and legal requests: for as long as reasonably necessary to respond and document the request.

9. Account Deletion and Data Deletion Requests

You can delete your account in the Kimoa app by going to Account → Delete Account. When you do, we trigger server-side deletion of your account and associated Kimoa data, including your user record, stories, generated media stored in Cloudflare R2, active sessions, and pending verification records. A confirmation email is sent after the request is processed.

You can also request deletion by emailing support@kimoaplay.com. We aim to complete account and deletion requests within 30 days, unless we need a longer period to verify identity, comply with law, or complete a narrowly tailored retention obligation.

10. International Data Transfers

Kimoa and our service providers may process information in the United States and, depending on the provider, in other regions including the European Union. By using Kimoa, you understand that your information may be transferred to and processed in countries that may have different data protection laws than your home country.

11. Your Privacy Rights

Depending on your location, you may have the right to request:

• access to the personal information we hold about you;
• correction or rectification of inaccurate information;
• deletion or erasure of your personal information;
• portability of certain information you provided to us;
• objection to certain processing or restriction of certain processing;
• withdrawal of consent where processing relies on consent.

To exercise these rights, email support@kimoaplay.com. We may need to verify your identity before fulfilling a request. If you are in the EEA or UK, you may also have the right to complain to your local supervisory authority.

12. Security

We use reasonable technical and organizational safeguards designed to protect personal information. No system can be guaranteed completely secure, and you use Kimoa at your own risk.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the effective date above and may provide additional notice through the app, on the website, or by email when appropriate.

14. Contact Us

For privacy questions, data requests, deletion requests, GDPR requests, CCPA requests, or general support, contact us at support@kimoaplay.com.