Privacy Policy and Terms of Service

DreamWeaver is a children's AI storytelling app designed for children aged 2-10, used under parental supervision. We are the data controller under UK GDPR.

Contact: info@dreamweaverai.co.uk

From parents: your email address (for account creation and consent verification only).

From child profiles: first name only, age group (e.g. "4-5 years"), avatar choice (animal + colour), reading level.

That is all.

• xWe do NOT collect: last names, dates of birth, photos, or location data
• xWe do NOT collect: device identifiers linked to children
• xWe do NOT collect: children's email addresses or contact details

Child profile data is used solely to personalise stories for your child - their name appears in stories, their age group determines vocabulary and themes, and their avatar appears as their story companion.

Parent email is used for account management and COPPA verifiable parental consent verification only. We do not use child data for advertising, profiling, or analytics of any kind.

Before any child profile is created, we verify parental consent using the COPPA "email plus" method (accepted by the FTC): we verify your email address and require you to tick an explicit consent checkbox.

Consent is recorded with a timestamp, your region, and the policy version - creating a tamper-proof audit trail as required by COPPA 2025 and UK GDPR Article 8.

Under UK GDPR you have the right to:

• +Access your personal data
• +Correct inaccurate data
• +Erase your data (right to be forgotten)
• +Restrict how we process your data
• +Data portability (receive data in machine-readable format)

Under COPPA you have the right to:

• +Review your child's personal information
• +Delete your child's personal information
• +Refuse further collection of your child's information

To exercise any right, use Account Settings in the app, or email info@dreamweaverai.co.uk. We respond within 30 days.

We do not sell, rent, or share child personal data with any third parties for commercial purposes. We use:

• -Firebase (Google) - backend database, authentication, storage. COPPA and GDPR compliant.
• -Sentry - crash reporting. Configured to exclude all child PII.
• -AI providers - story generation. Only age group and story parameters sent; no child PII in prompts.

All data is encrypted in transit using HTTPS/TLS. Data at rest is encrypted by Firebase's managed encryption.

Child profile data is stored in private collections accessible only to the verified parent account.

We retain your data for as long as you maintain an active account. When you delete your account, all personal data is permanently deleted within 30 days.

Anonymised, non-identifiable statistics may be retained for operational purposes.

We apply all 15 standards of the ICO's Age Appropriate Design Code:

• +High privacy settings on by default
• +Minimum data collection (data minimisation)
• +No profiling of children
• +No behavioural advertising
• +No geolocation tracking
• +No nudge techniques or dark patterns

DreamWeaver uses AI to generate stories, illustrations, and narration. All content passes through safety filters before being shown to children.

No child personal data is sent to AI providers. Prompts contain only the selected world, mood, and character type - never the child's real name or details.

Parents can report inappropriate content using Report Content in parental settings.

Questions about this policy or your data rights?

Email: info@dreamweaverai.co.uk

We respond within 30 days.