Woud Privacy Policy

1. Who we are

Woud is operated by Dev Studios Digital (PTY) LTD (“Woud”, “we”, “us”), registered at 249 Rockwood Crescent, Woodlands Lifestyle Estate, Woodlands, Pretoria, 0072, South Africa. For any privacy question or request, contact ops@dev-studios.com.

We are the responsible party under POPIA (and the data controller, in GDPR terms) for the information described here.

2. This app is for children — parents and guardians come first

Woud is intended to be set up and supervised by a parent or guardian (“Guardian”). We are established in South Africa and, at launch, Woud is offered only in South Africa, so the Protection of Personal Information Act, 2013 (“POPIA”) is the privacy law that governs it — with particular care for children's information under section 35. If we later offer Woud in other countries, we will meet the additional requirements those countries impose (such as COPPA in the USA, and the GDPR and children's codes in the EU and UK) before doing so.

Parental consent

Before any story play, Woud asks an adult to complete a parental gate (a simple arithmetic question) and then to give consent explicitly, recording that consent on the device. Adaptive, AI-generated storytelling is additionally only enabled on a paid subscription, which requires an adult's payment method held by Apple — so an adult has verifiably authorised the account before any of a child's typed input is processed. The free tier plays a complete, pre-written story that needs none of this.

By setting Woud up and enabling story play, the Guardian confirms they are the child's parent or guardian and consents to the processing described here.

Parents can, at any time: review the information associated with their account, delete it, refuse further collection, and withdraw consent — see sections 9 and 10.

3. What we collect

• An anonymous account identifier — a Firebase account created on the device. No name or email is required to play. If a Guardian chooses to sign in to keep their stories across devices, we receive an email address (which may be an Apple private-relay address) and, where the provider supplies it, the adult's name.
• Guardian settings — the chosen age band and content preference.
• Child play profile — the pretend in-world name you choose, an age band, and who is “reading tonight”. No real name, birthday, photo, contacts or location. This profile is held on your device; it is not sent to us.
• What happens in the story — choices made, any free text a child types into the optional “Something else…” box, and the resulting story record (the Chronicle).
• Story audio generated for read-along.
• Basic technical logs needed to run the service securely, which include the device's IP address and request times.

We do not collect: real names of children, dates of birth, precise location, contacts, photos, camera or microphone data, health or biometric data, or any advertising identifiers.

4. How we use it

• To run the shared bedtime story and keep it fair between children.
• To make each night age-appropriate using the age band you set.
• To remember your story-world so it continues next time.
• To keep the service secure and working — abuse prevention and debugging.

We do not use your family's information for advertising, marketing profiling, or any automated decision that has a legal or similarly significant effect on a child.

5. How stories are made (AI transparency)

Woud personalises an authored world; the AI does not invent the world from nothing. When a child makes a choice or types an idea, that input and the current story context are sent to Google's AI service (Google Vertex AI) to write the next part, which is then read aloud by a text-to-speech voice.

Your child's input is used to generate that story moment and is not used to train Google's AI models. Google Cloud's Service Specific Terms include a training restriction: Google does not use customer data to train or fine-tune its models without the customer's instruction, and we give no such instruction. The AI is constrained by safety rules that keep content gentle and in-world, and that flag anything needing human review.

6. Who we share it with

• Google provides all of our infrastructure — sign-in, database, computing, AI and text-to-speech — as our processor, under Google's Cloud Data Processing Addendum. Google acts on our instructions, not for its own purposes.
• Apple handles any purchases, and the account and billing data involved, under Apple's own privacy policy. We never receive your card details.
• Legal and safety: we may disclose information where we are required to by law, or where we reasonably believe it is necessary to protect the safety or vital interests of a child or another person.

We do not sell your family's information, and we do not share it with advertisers or data brokers. We have no advertising, analytics or tracking software in the app at all.

7. Where your data is processed

Our core services — the database, the story service, the AI and the text-to-speech voice — run in the European Union (Google Cloud europe-west1).

Sign-in is handled by Google's identity service, which is operated globally and may process account data outside South Africa, including in the United States. Where information is transferred across borders we rely on Google's Cloud Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses and binds Google to comparable protections — the basis contemplated by POPIA section 72 for transfers to a recipient subject to a binding agreement providing adequate protection.

8. How long we keep it

• Your story-world (the Chronicle, profiles, settings): kept while your account is in use, and deleted if the account is inactive for 24 months.
• Free text a child types: used to generate that story moment and not stored as a lasting record; any transient copy is removed within 30 days.
• Technical and security logs (including IP address): up to 30 days, then automatically deleted.
• Story audio cache: removed with your account; unused audio expires after about 90 days.
• Backups: our backups roll over on a 35-day cycle, so deleted information is gone from backups within that period.

When you delete, removal cascades across our live records, derived content, media and logs, and clears from backups within the cycle above. Where the law requires us to keep a record for longer — for example tax or transaction records — we keep only that record, and only for as long as required.

9. Your choices and controls

Right now, in the app:

• Delete everything — Settings → “Forget everything” erases your story-world from our servers.
• Start fresh — Settings → “Start a new account.”

On request to ops@dev-studios.com, you as Guardian can also access the information associated with your account, correct it, delete it and withdraw consent, object to or restrict certain processing, request a portable copy where applicable, and refuse any further collection of your child's information.

So that we never hand a family's information to the wrong person, we will only act on a request sent from the email address signed in to the account, or — if the account has no sign-in — after you confirm details of the account from within the app. We aim to respond within 30 days.

10. Complaints

Please contact us first at ops@dev-studios.com — we would rather fix it. You also have the right to complain to the Information Regulator (South Africa), our supervisory authority. If you live elsewhere, you may instead be able to complain to your local data protection authority.

11. Security

We protect information with authenticated access, encryption in transit, EU-hosted infrastructure, least-privilege service accounts, and by not collecting what we do not need. No system is perfectly secure, but we design to minimise what could ever be exposed.

12. Changes to this policy

If we make a material change we will update the “Last updated” date above and show a prominent notice in the app. Where a change materially affects how we handle children's information, we will ask the Guardian to consent again before it takes effect for their account.

13. Contact

Dev Studios Digital (PTY) LTD · 249 Rockwood Crescent, Woodlands Lifestyle Estate, Woodlands, Pretoria, 0072, South Africa · ops@dev-studios.com

A note for children

There is a short version written for children — “The Keeper's Promise” — inside the app, so a child can understand what Woud does with what they say.