Privacy Policy

Dakky (“Dakky”, “we”, “us”) provides an AI-powered bedtime story and routine service for families through our website, web app, and mobile apps (together, the “Service”). This policy explains what we collect, why we collect it, and the choices you have. We wrote it to be readable — if anything is unclear, email us at privacy@dakky.app.

Operator

The Service is operated by DEVINTRY SIA, a company registered in Latvia under registration number 43603092074, with its registered office in Jelgava, Latvia. The postal address for written correspondence is [Postal address — to be added by the founder]. You can reach the operator for any privacy matter at privacy@dakky.app, and for anything else at hello@dakky.app. Automated service messages (receipts, password resets, story-ready notices) come from noreply@dakky.app, an address we do not read replies to.

DEVINTRY SIA is subject to Latvian law. Latvia’s data protection supervisory authority is the Datu valsts inspekcija (the Data State Inspectorate), which you may contact directly if you believe we have not resolved a privacy concern.

The short version

• Accounts belong to parents and guardians — never to children.
• A child profile stores a first name, an age group, and story interests — and, only if a parent saves them, default story options for future stories. No birth dates, photos, location, or contact details.
• We show no ads and allow no third-party tracking of children. Ever.
• Every story passes automated content filtering, and every generated story is labeled “Made with AI”.
• Story text and narration are generated by AI vendors bound to zero data retention — they do not keep or train on your family’s prompts or output.
• Every link out of the app, every purchase, and every settings screen sits behind a parental gate.
• Subscriptions are billed by Apple or Google in the apps, or by Stripe on the web and for every printed book order; we never see or store full card numbers.
• You can delete your account — and all data with it — at any time, in the app or by emailing us.

Children’s privacy (COPPA)

Dakky is designed for use by parents with their children, in line with the U.S. Children’s Online Privacy Protection Act (COPPA). Children cannot create accounts. All accounts are created and controlled by a parent or legal guardian, who decides what information to provide. Our apps are listed under Apple’s Education category (rated 4+, not the Kids Category) and Google Play’s “children and older” target audience, and every screen a child can reach — links out of the app, purchases, and settings — sits behind a parental gate.

The child-related information we store is what a parent enters into a child profile: a first name (or nickname), an age group (one of a small set of bands, such as “3–4” or “6–8”, used to keep stories age-appropriate), and a list of story interests (for example, “dinosaurs” or “space”). If a parent saves default story options (character, setting, mood, lesson) for a child, those are stored against the profile too. We do not collect a child’s birth date, photographs, voice, precise location, or contact information, we do not run third-party analytics or advertising on child-facing screens, and we do not share child data with advertisers or data brokers.

We also publish a short, plain-language direct notice covering what we collect from a child profile, why, and how to control or delete it, in the form COPPA requires. You can also request a copy at any time by emailing privacy@dakky.app.

Parents may, at any time:

• Review or update a child profile’s name, age group, and interests in the app.
• Delete a child profile, or the whole account, from app settings.
• Refuse further collection of a child’s information while keeping the account, by deleting the child profile.
• Ask us in writing what information we hold about a child profile, by emailing privacy@dakky.app.

Age signals

Where a device or store provides an age signal — Apple’s Declared Age Range API or Google Play’s Age Signals — we read it to keep the account experience appropriate and to satisfy state-level age-assurance laws. We do not use age signals for advertising, and a significant change in a device’s reported age range triggers a re-consent step for the parent.

Information we collect from parents

• Account data: email address and a hashed password, or your Google/Apple sign-in identifier if you use social login.
• Child profile data: the first name, age group, interests, and (if saved) default story options you choose to enter, as described above.
• Story and routine data: the stories generated for your family, the options you picked (character, setting, mood, length), narration audio, and routine completion history, so you can re-read and re-use them later.
• Subscription and order data: your plan, subscription status, billing history references, and printed book order and shipping details. In-app subscriptions are billed and managed by Apple or Google; web subscriptions and every printed book order are billed by Stripe. Card details go directly to the store or to Stripe and never touch our servers.
• Technical data: standard server logs (IP address, browser type, timestamps) used for security, debugging, and abuse prevention.
• Push notification data: if you enable push notifications, a device push token and platform (iOS or Android), used to deliver bedtime reminders and story-ready notices. We also record a device fingerprint and platform when a device connects, so we can associate an age signal (see below) with the right device.

How we use information

• To generate and deliver personalized routines, stories, and narration.
• To operate accounts, subscriptions, free-story limits, and book orders.
• To keep the Service safe — including automated content filtering of every story.
• To fix bugs and improve reliability.
• To respond when you contact us.

We do not sell personal information, we do not show advertising, and we do not use child data for AI training or marketing.

AI story generation and narration

Story text is generated through OpenRouter, which routes the request to Google’s Gemini models, with a direct OpenAI fallback if the primary route fails. Narration audio is generated by OpenAI, with Google’s Chirp 3 HD as a fallback for Latvian. Every one of these AI vendors processes story text and narration under contractual terms with zero data retention: they do not store prompts or output beyond generating the response, and they do not train their models on Dakky data.

The prompt sent to these vendors contains only the story options and the child’s first name and interests — never your email, billing details, or any other account data. Generated stories are filtered by our safety rules and content filter before being shown, and every generated story is labeled “Made with AI”.

Service providers

We share data only with the vendors needed to run the Service, each bound by contractual confidentiality and data-protection obligations, and each receiving only what it needs:

• OpenRouter, Google, and OpenAI — AI story text generation and narration, under zero-data-retention terms.
• Amazon Web Services (EU) — transactional email (SES: account, receipt, and story-ready emails) and encrypted-in-transit nightly backup storage (S3, eu-west-1).
• Google (Firebase Cloud Messaging) — delivering bedtime reminder and story-ready push notifications to your device.
• Stripe — payment processing for web subscriptions and every printed book order.
• Apple and Google — billing and management of in-app subscriptions on iOS and Android.
• Peecho and Prodigi — printing and shipping physical book orders.
• Hetzner — application and database hosting, in the EU.
• Sentry — error diagnostics.
• PostHog (EU region) — product analytics on parent-facing screens only, never on child-facing screens and never with child data.

Data retention and deletion

We keep different kinds of data for different periods, and no longer than we need to:

• Account data: until the account is deleted.
• Stories: until the parent deletes them.
• Narration audio: target of 90 days after it was generated; automatic purging on that schedule is not yet implemented, so audio may persist longer until it ships.
• Push tokens and device records: until the device is removed or the account is deleted.
• Book order records: 10 years, to meet Latvian accounting law.
• Age signals: target of 12 months; automatic expiry on that schedule is not yet implemented.
• Server logs: rotated by size (approximately the most recent 30 MB per service, roughly the last few days to weeks of traffic depending on volume), not on a fixed time schedule.

Deleting your account removes your profile, child profiles, and stories from our production systems immediately. Residual copies of the database persist in backups for up to 90 days before automatic expiry; backed-up media files (such as narration audio) do not yet expire automatically and are purged manually on request in the meantime. You can delete your account from app settings (“Delete Account”) or by emailing privacy@dakky.app from your account email. Book order records are kept for the accounting retention period above even after account deletion, as Latvian law requires.

Our full data retention schedule and the reasoning behind each period is published for review as part of our written data retention policy.

Security

Passwords are stored using modern one-way hashing (argon2). Data is encrypted in transit (TLS). Encryption of stored data at rest is on our infrastructure roadmap and not yet in place. Access to production data is restricted and logged, and we maintain a written information security program with an annual risk assessment. No system is perfectly secure, but we treat your family’s data with the care we’d want for our own.

International transfers

Our infrastructure runs on Hetzner servers in the EU, and DEVINTRY SIA is based in Latvia. Nightly database and media backups are stored with Amazon Web Services in its EU (Ireland) region. Some of our AI vendors process data outside the EU/EEA under their zero-data-retention terms and standard contractual safeguards.

Your rights

As a company operating under Latvian and EU law, we recognize your rights under the GDPR: to access, correct, export, or delete your personal data, to restrict or object to certain processing, and to lodge a complaint with the Datu valsts inspekcija. If you live outside the EU, you may have similar rights under your local law. To exercise any of these rights, email privacy@dakky.app. We respond to verified requests within 30 days.

Changes to this policy

If we make material changes, we will notify account holders by email or in-app notice before the changes take effect, and update the effective date above.

Contact

Privacy questions, requests, or concerns: privacy@dakky.app. Anything else: hello@dakky.app.