Personal Data Policy

Version of 2026-08-25. Governing law: Law of the State of California, USA.

1. Controller and contact

1.1. Controller: Maksim Tsiarnouski (TuckBook), Individual entrepreneur (sole proprietor), USA, address California, USA.

1.2. Data requests, withdrawal of consent or account deletion: [email protected].

2. What data is processed

2.1. Parent account: email, name/form of address, password hash, session cookies and settings.

2.2. Child data entered by the parent: first name without surname, age, interests and the situation for the story. The parent confirms the right to provide this information.

2.3. Content: requests, generated texts, images, PDFs and audio. Optionally the User may upload a reference photograph or a voice sample; these are not required for basic generation.

2.4. Technical data: IP address, user agent, diagnostic events, timing and outcome of operations.

2.5. Payment data: the selected plan, transaction status, amount and the minimum provider identifiers needed for reconciliation or refund. The service does not receive card details.

3. Purposes and legal bases

3.1. Account creation, generating and storing books, support, security, quota accounting and fulfilling a paid order.

3.2. Processing is carried out on the basis of the User's consent, to perform the contract and to meet mandatory requirements of applicable law. Separate consent is requested at registration.

3.3. Data is not sold and is not used by TuckBook itself to train public models.

4. Data sharing needed to run the service

4.1. A book is not created on our servers alone. To produce the text, illustrations and narration we send external artificial-intelligence services what is needed for that specific order: the story description, the child's first name and age, and — if you uploaded them — the reference photograph and voice sample. We send only the material of your order and only for the time it takes to fulfill it.

4.2. We do not permit those services to use the transferred material to train their models, and we do not share data with anyone for advertising or sale.

4.3. Part of the processing happens outside the country of storage: external services run on their own infrastructure. By uploading a photograph or voice you consent to such transfer. The service works without uploading them — they are optional.

4.4. Besides the AI services, the hosting provider and the email service receive a minimum of data (the address and the message text). Payment operations go through Telegram under its rules.

4.5. Primary storage: Germany, provider netcup GmbH.

4.6. Analytics: no third-party web analytics is connected.

5. Retention periods

5.1. The account and library are kept while the account is active, or until a justified deletion request. Mandatory payment records may be kept longer for the period required by law.

5.2. After a confirmed request, working data is deleted or anonymized within 30 days; local backups rotate within 14 days.

5.3. The User can separately delete uploaded photographs, voice samples and created books in the “Account” section.

5.4. The whole account can be deleted by the User: “Account” → “Delete account”. Books, photographs, character portraits and voice samples are deleted with it, including the voice copy held by the external service. Only anonymized payment records we are required to keep for accounting are retained.

6. Security

6.1. Passwords are stored only as a strong hash; sessions are signed; administrative and webhook routes are protected by separate secrets; public traffic is served over HTTPS.

6.2. Access by staff and contractors is limited to the task and the necessary scope.

7. Cookies and user rights

7.1. Necessary cookies support sign-in, CSRF protection and the guest session. Some features do not work without them.

7.2. The User may request a copy of their data, correction, restriction, deletion or withdrawal of consent, and may also contact the competent authority in their country.

8. Children

8.1. The service is intended for use by a parent or legal guardian. A child must not create an account or submit personal data on their own.

9. Changes

9.1. Material changes are published on this page with a new version date. Questions: [email protected].