Privacy Policy
BabyStory operates the BabyStory website at babyfuturestory.com. This policy explains what we collect, why, who processes it, and how you can have it removed. We have written it to describe what the service actually does rather than to make promises we cannot keep.
1. Information we collect
- Account details. If you create an account we store your email address and a salted, slow hash of your password. We never store the password itself.
- Photos you upload. The images you choose are transmitted to the AI provider for the generation you requested, and the generated result is returned to your browser.
- Prompts and selections. The options you pick (mode, age, theme, words for a talking video) are sent with the photos so the provider can render the result.
- Payment records. When you buy credits we record the order reference, your email, the pack purchased, the amount, the currency and the resulting credit balance. Card details are handled by our payment provider and never reach our servers.
- Technical data. To prevent abuse we keep short-lived, hashed counters derived from your IP address and browser cookie. We do not store the raw IP address alongside your account.
- Usage analytics. We record which pages are visited, which buttons are pressed and which features are used, together with the referring site, campaign tags in the link, your country and whether you are on mobile or desktop. The visitor identifier is a random value stored in your browser and hashed on our servers; it is not linked to your account or email. Analytics are collected by our own server — no third-party advertising or tracking script runs on this site.
- Video job records. For video generation we keep the job identifier, the template used, the provider task reference and the result link so the page can show your film when it finishes.
2. How we use it
- To produce the image or video you asked for.
- To operate accounts, sessions and password resets.
- To process payments and add credits to your balance.
- To enforce free-use limits and prevent automated abuse.
- To diagnose failures and keep the service working.
We do not sell your personal data, and we do not use your uploaded photos to train our own models.
3. Who processes your data
- OpenAI (image generation) receives the reference photos and prompt for still-image generation.
- PixStag (video generation) receives the photo and prompt for video generation.
- Dodo Payments (merchant of record) acts as merchant of record: it is the legal seller, handles payment methods, tax and fraud screening, and receives the email and order information needed to do so.
- Resend (transactional email) sends password-reset email if that feature is enabled.
- Cloudflare (hosting, database and CDN) hosts the application and stores the database.
Each provider processes data under its own terms and privacy policy. Photos are sent only to produce the result you requested.
4. Cookies
- little_years_guest — remembers your free-use entitlement for up to one year. It is HttpOnly and contains a random identifier.
- little_years_session — keeps you signed in. It is HttpOnly and expires with your session.
- __cf_bm — set by our hosting provider for bot protection.
We do not use advertising or cross-site tracking cookies.
5. How long we keep it
- Generated results are kept for 24 hours. A finished baby video can be viewed and downloaded for 24 hours after it is created; after that the record is permanently deleted by an automatic cleanup that runs hourly. Generated photos are not stored on our servers at all — they are returned to your browser and exist only in your device's memory or downloads.
- Account, order and credit records are kept while your account is active, and for as long as we need them for accounting and dispute handling.
- Abuse-prevention counters are short-lived and keyed by a hash, not by identity.
- Analytics events are kept for 90 days and then deleted by an automatic cleanup.
6. Photos of children
The service is intended for adults. You may only upload a photo of a child if you are that child's parent or guardian, or you have the guardian's explicit permission. We do not knowingly collect photos of children from anyone acting without that permission, and we will delete such material when it is reported to us.
7. Your rights
You can ask us to confirm what we hold about you, correct it, or delete your account and its data. Email privacy@babyfuturestory.com from the address on the account. Deleting your account removes your profile, sessions and credit balance; order records may be retained where tax or accounting rules require it.
8. Security
Passwords are stored as slow, salted hashes. Sessions use random tokens stored only as hashes. Traffic is encrypted in transit. No service can promise perfect security, so please use a unique password.
9. International transfers
Our providers operate globally, so your data may be processed outside your country of residence. Where required, transfers rely on the providers' own safeguards.
10. Changes
If this policy changes materially we will update the date above and, where appropriate, tell you by email.
11. Contact
Privacy questions and deletion requests: privacy@babyfuturestory.com. General support: support@babyfuturestory.com.
← Back to BabyStory