Privacy Policy

In short

MomStory is an iPhone app built and operated by Ilia Vasilev ("MomStory", "we"), a sole proprietor, who is the seller of the app and the controller of the data described in this policy. This policy covers the MomStory app and this website.

What we collect

From you, the account holder

• Your Apple sign-in: the name and email Apple shares with us when you sign in, in the app or on this website. If you choose "Hide My Email", we only see Apple's relay address.
• Your voice: a recording of 30 to 60 seconds, the recording of the short consent phrase you read aloud, the full name you type on the consent screen, and the names you give your voices. See Your voice and consent.
• Your child's profile: first name, age, gender and up to 3 favorite animals, which you enter to personalize stories.
• Your stories: the themes you pick or the words you type, the story texts, their audio, and where you stopped listening.
• Settings: your language and time zone, notification choices and the device token that lets us send reminders and news.
• Invites and promo codes: if you came through a friend's invite, who invited you and whether you subscribed; if you invite friends, the months of Gold you earned and whether you've claimed them; and a creator's promo code, if you entered one.
• Videos you share on this website: if you share a video of your child on momstory.app, the video, a cover picture made from it and the details you send with it. See Bedtime videos.
• Activity: when you last opened the app, which reminders and news items we sent and which news items you opened, when stories were made and played, and records of the AI work done for your stories, which we use to keep track of our costs.
• Your subscription: the subscription events Apple reports — whether you have Gold, when it renews, its price, currency and country. We never see your card.

Collected automatically

• Product analytics: which screens you open and which buttons you tap, and where on the screen you tapped; when the app is installed, updated, opened or sent to the background; how long you waited for a story or a voice to be made; where you paused or stopped a story; how a purchase or a restore turned out; which version of the welcome screens you saw; which error screen appeared and why a sign-in failed, as short codes; and your child's age group, gender and favourite animals — never anything you type or see on screen. It is linked to your account ID, together with a random device number and a session number, your phone model and maker, screen size, whether it is a real phone or a simulator, iOS and app version, language, time zone and IP address. Before you sign in, it is sent under a random number that PostHog's software keeps on your phone, and that number is linked to your account ID when you sign in. No location tracking, no screen recording, no advertising ID.
• Turning off "Help improve MomStory" in Profile stops analytics from your phone. Some events are sent to PostHog from our servers regardless of that setting, linked to your account ID — for example, that a story or a voice was created, refused or failed, with a short error code and how many seconds it took, or that Gold started, renewed or ended, with the price and currency of a new purchase.
• Crash reports: MomStory uses Sentry to collect crash reports, so we can find and fix problems in the app. When the app crashes or hits a handled error, Sentry receives your phone model, its operating system version, the app version, where in the code the problem happened, and an anonymous install tag — a label we generate ourselves and store on your phone, not an identifier tied to your account. Each report also carries your phone's language and region setting, and a report that the app froze, which Sentry's own software makes, also carries your phone's time zone and its calendar and clock settings. Sentry also receives a short record of each app session — when it started, when it ended and whether it crashed — with the app version and no link to your account. Sentry's own software adds a random installation number of its own, kept on your phone, to these session records and to crashes it catches itself; it isn't tied to your account either. Sentry does not receive your voice recordings, your story text or your child's profile. We keep crash reports for up to 90 days.
• Service logs: our hosting and partners record IP addresses and technical details of requests, as any online service does.

What we don't collect

No advertising identifier, no precise location, no contacts or photos, no payment card details, and nothing from other apps.

The only video we ever receive is one you choose to share on this website yourself, and its location is removed on your phone before it is sent.

Your voice and consent

A copy of your voice is biometric information, and some laws — such as those of Illinois, Texas and Washington — protect it specially. This is how we handle it.

Consent comes first

• Before recording, you type your full name and agree on the screen: "I understand this and agree that MomStory may make a copy of my voice."
• To create a verification phrase, your full name is sent to our voice partner, Speechify. You read the phrase aloud; the recording of it is stored with us, and Speechify checks that the voice reading it is the voice being copied — so no one can copy a voice that isn't theirs.
• Your consent is saved with the date and time before your voice recording is sent to Speechify. Without it, the recording is never sent.
• We ask for consent each time you record a new voice.

What happens to the recording

• Your recording goes to Speechify, which builds a copy of your voice. As soon as the copy is built, we delete your recording and the consent phrase recording from our servers. A temporary copy on your iPhone is removed the next time you open MomStory, a day or more later.
• If building the copy fails, the recording and the consent phrase recording are kept until you record again or delete your account.
• The copy of your voice is kept by Speechify and used only to read your stories aloud. A short sample made with the copy is stored with us so you can hear the voice in the app.
• If a voice is built but you leave before naming it, it is removed after about an hour.

What we never do with it

We never sell your voice, we never use it to train AI models, we never use it for ads, and we never share the copy of your voice beyond the voice partner that reads your stories. Once a story has been read aloud, its audio also goes to Amazon Web Services, only so that background music can be mixed under it; AWS never receives your recording, the consent phrase recording or the copy of your voice — see Who processes it. A story you choose to share by link is different: anyone who has the link can listen to that story, read in the voice you chose — see Stories shared by link.

Deleting a voice

In Profile → Voices, you can delete any voice at any time. We ask Speechify to erase the copy right away; this usually completes within 24 hours. You can also write to privacy@momstory.app.

How we use it

• to write stories for your child and read them aloud in the voice you chose;
• to keep your library, voices and settings in your account;
• to handle your subscription;
• to run our creator programme: to credit a Gold subscription to the creator whose promo code you entered, so we can pay them for promoting MomStory;
• to send the reminders you turned on and, if you turned on MomStory news, our news and offers;
• to understand which parts of MomStory work well;
• to keep MomStory safe, prevent abuse and meet our legal duties.

Who processes it

These services process data for us. All of them except DeepSeek process it only to provide MomStory, and we chose them because they protect data at least as carefully as we do; for DeepSeek, see the note below the table. We don't sell data to anyone.

About DeepSeek. DeepSeek writes a story only when Claude is unavailable — when Claude fails to answer, and for a few minutes after such a failure. We can't promise that DeepSeek uses what it receives only to write your story, that it deletes it, or that it doesn't use it to train its models: we have no data processing agreement with DeepSeek, and DeepSeek names no fixed period for keeping what it receives. So please assume that DeepSeek may keep these details about your child with no set end date and may use them to improve its models. DeepSeek never receives your account ID, your email or your voice.

We may also disclose information if the law requires it, or to protect the safety of our users. If MomStory is ever sold or merged, this policy continues to apply to your data, and we'll tell you before anything changes.

Children

MomStory is made for adults. Only an adult (18+) creates the account; your child listens to stories but never has an account. The app is not in the App Store's "Made for Kids" category.

The details about your child — first name, age, gender and favorite animals — are given by you, used only to shape your child's stories — except the age group, gender and favourite animals, which are also part of our product analytics — and deleted with your account. The exception is DeepSeek, which writes a story only when Claude is unavailable: we can't promise that DeepSeek uses these details only for the story or deletes them — see Who processes it. If we learn that a child has created an account, we delete it.

Your permission before the first story. Before your first story, MomStory asks your permission to send your child's details — first name, age, boy or girl, favourite animals and the story idea you type — to Anthropic, which writes the story, and to DeepSeek, which writes it instead when Claude is unavailable, and to send the finished story, with your child's name in it, to Speechify, which reads it aloud in your voice. Until you agree, none of this is sent to any of them. You can withdraw this permission at any time by deleting your account in the app, or by writing to privacy@momstory.app. If you withdraw by email, no new story is written until you agree again. The stories you already have stay in your account, and voicing one of them still sends its text, with your child's name, to Speechify; delete a story, or your account, to stop that. Once a story is voiced, its audio, which says your child's name, is also sent to Amazon Web Services to mix the background music under it — see Who processes it.

Children in videos on this website. The videos parents share on momstory.app show their children listening to a story. Only a parent or legal guardian of the child may share such a video: before sending, they confirm that they are, and that they allow us to show the video on this site, and we record when they confirmed. We don't ask for the child's name or age, the location is removed from the video before it leaves the parent's phone, and we review every video before anyone else can see it. The parent can delete their video at any time, and anyone can ask us to take a video down — see Bedtime videos.

Keeping and deleting

• Voice recordings: deleted as soon as the copy of your voice is built. If building the copy fails, the recording and the consent phrase recording are kept until you record again or delete your account.
• Voices: kept until you delete them. We then ask Speechify to erase the copy right away; this usually completes within 24 hours. A note of the deleted voice — its name and Speechify's number for the copy — stays in your account until you delete your account, and so does the full name you typed on the consent screen.
• Crash reports: kept for up to 90 days.
• Technical log of the music step at AWS: kept for 14 days, and expired entries are deleted within about three days after that; it holds no links and no audio.
• Product analytics: kept while your account exists, and deleted with it.
• Videos you share on this website: kept until you delete them in My videos on momstory.app/share-video, or delete your account. A deleted video disappears from the site right away; copies held by our storage provider's delivery network expire within minutes. If we don't publish a video, or take it down, its files are deleted within minutes, and its details stay in your My videos, marked Not published, until you delete them. A video whose upload was never finished is deleted after a day.
• Votes for videos: kept until you remove them with Remove my votes, or delete your MomStory account.
• Everything else: kept while your account exists.

Deleting your account

In the app: Profile → Delete account. Your account data is removed from our database immediately — your profile, your child's profile, your voices, stories, subscription records and reminders. Files, the copies of your voices at Speechify and your analytics profile are then deleted by a queue that starts within minutes and usually finishes within 24 hours. Database backups are overwritten within 30 days.

Some records remain after deletion:

• a record that consent to copy a voice was given, and technical logs of our work with your account — when voices and stories were made and when deletion was carried out. They don't contain your email or your voice. They do contain internal identifiers — among them the ID your account had and Speechify's number for the voice check — and, in rare error records, a short technical message from our voice partner that can quote a voice name or a line of a story. We keep them with no set end date, as proof that consent was given and deletion was carried out;
• Speechify's own copy of the consent phrase recording and of the full name sent to it for verification — ours are deleted;
• whatever DeepSeek received to write a story for you, if it ever did: we can't confirm that DeepSeek deletes it, and DeepSeek names no fixed period for keeping it — see Who processes it;
• purchase records kept by Apple and RevenueCat, and, if you entered a creator's promo code, the record of that purchase kept by Insert Affiliate;
• an anonymous note in our analytics that an account was deleted, with the plan it was on and roughly how long it existed, as a range such as 8–30 days. It carries no account ID, cannot be linked back to you and has no set end date.

Your rights

Wherever you live, you can ask us to:

• show you the data we hold about you, and give you a copy;
• correct anything that's wrong;
• delete your data, or a single voice;
• send your data to you or another service in a common format;
• restrict or object to how we use it, including analytics;
• withdraw your consent to a copy of your voice — by deleting the voice in the app, or by writing to us.

Write to privacy@momstory.app. We'll answer within the time the law requires — usually within a month — and we won't treat you differently for asking.

If you're in the UK, Canada or Australia, you can also complain to your data protection authority: the Information Commissioner's Office in the UK, the Office of the Privacy Commissioner in Canada, or the Office of the Australian Information Commissioner.

Your rights in the United Kingdom

If you are in the United Kingdom, the UK GDPR applies and the data controller is the person named in In short above. We rely on three lawful bases:

• Your explicit consent for processing your voice, which is special category data — Article 9(2)(a).
• Performance of a contract, to deliver the service you signed up for — Article 6(1)(b).
• Our legitimate interests in understanding how the app is used, keeping the service secure and preventing abuse of the free tier — Article 6(1)(f), weighed against your rights.

You have the rights of access, rectification, erasure, restriction, portability and objection. You can withdraw your consent to voice processing at any time by deleting the voice, which does not affect the lawfulness of what was done before.

Storing anything on your phone and reading it back is also governed by the Privacy and Electronic Communications Regulations. What we store on your device is your sign-in, your settings, the stories you've voiced so they play without internet, your voice recording, which stays on your phone after you record it and is removed the first time you open MomStory a day or more later, two anonymous install numbers for crash reports, ours and Sentry's own, the install number Expo keeps to set up reminders, and a creator's promo code, if you entered one, with the random install number used to credit it, plus the account number and the random numbers analytics uses for your device, your session and the time before you sign in. You can switch off analytics from your phone at any time, simply and at no cost, with "Help improve MomStory" in Profile.

MomStory uses AI models to write and to narrate stories. That is content generation, not a decision about you: nothing in the app makes automated decisions producing legal or similarly significant effects.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk.

Security and where data is stored

Data travels encrypted between your iPhone and our services, and is stored encrypted by our providers, except DeepSeek, whose documents don't say whether it encrypts what it stores. Each account can see only its own data, and only a few people can access our systems, for support and maintenance.

Our main database is in the United States (N. Virginia), and analytics is in the EU (Germany). Supabase, Anthropic, Speechify, RevenueCat, Expo, Sentry, Grafana Labs and Apple process data in the United States. The step that mixes the background music under a finished story runs at Amazon Web Services in Europe (Stockholm) for now and will move to the United States (N. Virginia); AWS is a United States company. DeepSeek is a company in China, and its privacy policy says the data its services collect is stored there; please assume that what it receives from us is processed and stored in China. This website is served from Cloudflare's global network; Cloudflare is a United States company. Insert Affiliate Ltd is a United Kingdom company. Our mailboxes are run by Proton AG in Switzerland.

If you are outside the country where a provider is located, your personal information is transferred across borders. For UK users we rely, for every provider except DeepSeek, on the UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses, where one is required; for Amazon Web Services these are the AWS Data Processing Addendum and its UK Addendum, which are part of the AWS Service Terms. For users in Canada and Australia we rely on your consent and, for every provider except DeepSeek, on the contractual safeguards in our agreements with them. We have no agreement with DeepSeek: your child's details reach it only with the permission you give before your first story (see Children).

This website

momstory.app is a small set of pages — the home page, this policy, the terms and the support page — plus the invitation pages, whose addresses start with /r/, and the pages of stories parents share by link, whose addresses start with /s/. The site is hosted by Cloudflare. Most pages are ready-made files; an invitation page or a story page is put together by our code at Cloudflare each time it is opened.

The home page shows bedtime videos from parents in its Watch kids react section. Two more pages are for these videos: momstory.app/share-video, where a parent sends us a video, and a closed page where we review videos before they are published. See Bedtime videos.

Signing in on this site. Some pages of this site let you sign in with Apple — the invitation page a friend's invite opens, the page of a story shared with you, the video section of the home page, and the video pages. Signing in on the invitation page or on a story page is signing in to MomStory: it creates your MomStory account, the same one you then open in the app with the same Apple ID. For this, the page loads Apple's Sign in with Apple script from Apple's servers, and Apple shows its own sign-in window. Apple then hands the page a sign-in token, together with the name and email you choose to share (see What we collect). The page sends the token, your name and the invitation label — on a story page, the invitation label of the parent who shared the story, and also the story link's code — to our server at Supabase, which creates your account and records who invited you; from then on they are kept like the rest of your account. The page itself keeps none of it.

An account created on this site is an ordinary MomStory account, even if you never install the app. You can delete it in the app — Profile → Delete account — or by writing to privacy@momstory.app.

Signing in on the video pages. On the video pages and in the video section of the home page, signing in with Apple works differently: it never creates a MomStory account. The page asks Apple for no name and no email. Apple hands the page a sign-in token, which the page sends to our server at Supabase. The server checks it, looks up whether a MomStory account uses the same Apple ID, and gives the page a sign-in key that works for one hour. The key lives only in the open page: it is never saved in cookies or in your browser's storage, and closing the page forgets it. To share a video, you need a MomStory account and the same Apple ID you use in the app; to vote, you don't.

Cookies, storage and scripts. We set no cookies on this site. If you choose a light or dark theme on the site, that choice is kept in your browser's local storage on your device and is never sent to us; nothing else is stored. Apple's sign-in window is Apple's own page, and Apple may use its own cookies there under Apple's privacy policy. Apart from Apple's sign-in script on pages that offer Sign in with Apple, the site carries no third-party scripts and no advertising tags. Browsing these pages is not joined up with your MomStory account; the only link is the one you make yourself by signing in with Apple. On pages for shared stories and invitations, our server counts when the page is opened, when the story is played and when its buttons are pressed, and sends these counts to PostHog. No cookies and no scripts are used for this, your network address is not recorded, and nothing is joined with a MomStory account unless you sign in with Apple on that page.

What does happen is what happens on any website. Your browser asks Cloudflare for a page, and that request is written to a service log Cloudflare keeps for us. An entry holds the network address your browser connected from, the address of the page you asked for, the time, and the ordinary technical details a request carries, such as the kind of browser and whether the page was found. We use it to keep the site working and to see whether it is being attacked or abused. We do not use it to identify you, we do not build a profile from it, and we do not merge it with anything in the app. The home page also asks our server at Supabase for the list of published videos each time it opens, so Supabase sees the network address and technical details of that request just as Cloudflare does, and we treat them the same way.

Invitation links and story links deserve a plain word, because they carry more than a page name. When someone shares MomStory with you, the message includes a link of the form momstory.app/r/ followed by that person's own invitation label; when a parent shares a story, the link has the form momstory.app/s/ followed by a code for that one story. Opening such a link shows its page. To count opens, plays and button presses, our server sends the label or the code to PostHog with each count. If you sign in with Apple on the page, the invitation label also reaches our server with your sign-in, so that your new account records who invited you; on a story page, also the story link's code, so that the sign-in is counted for that link. The "Get the app" button takes you to the MomStory page in the App Store through a short address on this site that counts the press; the App Store receives neither the label nor the code and sees only that you came from momstory.app. Because the label and the code are part of the address, they appear in the log entry for that request, next to the network address of whoever opened the link.

The site is served over an encrypted connection only, and browsers are told to refuse any other kind.

Stories shared by link

When you tap Share story in the app, our server makes a link of the form momstory.app/s/ followed by a code for that one story, and you choose whom to send it to. Anyone who has the link can open the page and listen to the story in their browser, without an account and without the app.

What the page shows, and what it doesn't

• On the page and in the link preview: your name as it is in your MomStory account, in the line "… shared a story with you" — or no name at all, if your account has none — and a player for the story. The page says the story is narrated in a loved one's voice, because it may have been read by any of the voices on your account.
• Never on the page: the story's title, your child's name or age, your email, or a lasting link to the audio file.
• How the audio is played: only when someone presses play, the page asks our server for a link that works for 15 minutes, and the listener's browser plays the story straight from our storage at Supabase, so Supabase sees that browser's network address. The address of that link includes an internal number of your account.
• Link previews: when the link is pasted into a messenger such as iMessage, WhatsApp or Telegram, the messenger fetches the page to build a preview with your name; it never receives the audio.

Your child's name is in the story

The page doesn't show your child's name, but the story itself says it, because it was written for your child, and whoever listens hears it. Please share a story only with people you trust, and remember that they can pass the link on.

When a link stops working

• when you delete the story, or your account;
• when you rewrite the story's text — the new version gets a new link the next time you share it;
• when you delete the voice that read the story;
• when we switch it off after a report.

The page then says the story is no longer available.

Reporting a story

Every story page has a Report this story link, which opens an email to support@momstory.app with the code of the link in the subject. We may switch a link off after a report.

What we keep about a link

For each link, our server keeps which story it plays, when it was made, how many times its page was opened by a person — not by a messenger building a preview — and when it was last opened, with no network addresses and no details of the device. These records are deleted with your account.

Bedtime videos on this website

Parents who take part in our creator programme can share a short video of their child listening to a MomStory story. After we review it, the video appears on momstory.app with the parent's promo code under it. This section covers the parent who shares a video and the visitors who watch and vote. How we protect the children in these videos is described in Children.

When you share a video

• What we receive: the video; a cover picture made from one of its frames; the name you want shown under it; your promo code from our creator programme; a link to your own TikTok or Instagram post, if you add one; the time you ticked each of the two statements before sending; the video's length and picture size; and your MomStory account ID, so the video appears in your My videos.
• Prepared on your phone: before sending, the page converts the video on your phone into a format every browser can play and removes its location and other descriptive data. The original file never leaves your phone. For this the page uses Mediabunny, an open-source video library we serve from this site ourselves; it runs on your phone and sends nothing anywhere. Our server then checks the file again and refuses a video that still carries a location.
• Your promo code: to check that the code exists in our creator programme, our server asks Insert Affiliate, which runs the programme, and sends it only the code. When we review your video, we ask Insert Affiliate for the name of the creator the code belongs to, to make sure it is yours. We don't store that name.
• Review: we watch every video before anyone else can see it. When a video is sent, our server lets us know through Sentry; that notice carries only the number of videos waiting for review — no names, no video, no links.
• Once published, the video is public: anyone can watch it on momstory.app, together with the name you chose, your promo code and the link to your post. We may decline to publish a video, or take it down later.
• Where it is kept: videos, covers and their details are stored with Supabase in the United States (N. Virginia), like the rest of your account. Published videos and covers are played straight from that storage, so Supabase sees the network address of the browser that plays them, just as Cloudflare does for the pages.
• How long: see Keeping and deleting. You can delete your video at any time in My videos.

When you watch and vote

• Watching needs no sign-in.
• To vote for a video with the heart, you sign in with Apple. You don't need a MomStory account, and signing in to vote does not create one. One Apple ID has one vote per video.
• We keep your vote as a label that our server computes from your Apple ID number together with a secret of ours. The label can't be turned back into the number, and we never store the number itself.
• After signing in, Remove my votes deletes all your votes at once. Because we never store your Apple ID number, we can't find your votes from an email request, so this link is the way to delete them. If you have a MomStory account, deleting it deletes your votes too.

Reporting a video

Anyone can ask us to take a video down with the Report this video link under it, or by writing to support@momstory.app.

Changes to this policy

When we change this policy, we post the new version on this page before it takes effect and update the date at the top.

Contact

Privacy questions and requests: privacy@momstory.app. Anything else: support@momstory.app.