Mondow Privacy Policy

Mondow Inc. ("Mondow," "we," "us," or "our") provides the Mondow website at mondow.world, the Mondow app for iPad and iPhone when it is available from Apple's App Store, and related services (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, when we share it, how long we keep it, and the choices you have. It works alongside our Terms of Service.

Mondow is designed for children, so protecting children's privacy is central to how we operate. We follow the Children's Online Privacy Protection Act ("COPPA") and the Federal Trade Commission's COPPA Rule, and we apply the same protections to every child who uses Mondow, whatever their age. Only a parent or legal guardian can create an account, and a child uses the Service through that adult's account and with their permission.

During our beta, the Service is free and is offered only to residents of the United States.

1. A note to parents

Because Mondow is for children, we build for data minimization. Your child is never asked to enter personal information to use the Service. The only information we hold about your child comes from you (a nickname and birth year, and a gender or note if you choose to add them) and from what your child creates while using the Service. We instruct the artificial intelligence never to ask your child for personal details such as their real name, address, school, or location, and to steer back to the story if your child volunteers them.

You, the parent or guardian, set up and control the account, decide which children may use it, and can review, correct, or delete your child's information at any time. We obtain your consent, as described in Section 4, before we collect any information about your child, with one exception: a visitor may try the storyteller on our website before any account exists, as described in Section 2.

2. Information we collect

From you, the parent or guardian. When you create and manage an account, we collect your first name, your email address, and a password, which are handled by our sign-in provider. We collect the four-digit PIN you set to leave kid mode. We keep a record of your consent (the date and time you consented and which version of this Privacy Policy and our Terms you agreed to). If you use the feedback button in the Service, we collect your message, the page you were on, your browser type, the version of the app you were using, and which child profile was active. We also collect any messages you send us by email.

From you, about your child. When you add a child to your account, we ask for a nickname for them and the year they were born, and you may optionally add their gender and a short note. We use the nickname to personalize your child's experience (for example, as the name on their room sign). We use the birth year to work out your child's age, which we use to keep the experience appropriate as we develop it, to understand who is using Mondow during the beta, and in the byline of a featured creation if you approve one (see Section 3). We store the birth year rather than an age so that we do not have to ask again each year. The gender and note, if you add them, are stored with the profile for your reference. None of these details is sent to the artificial intelligence. Under COPPA, information about a child that we collect from a parent is treated as the child's personal information, and we protect it as such.

From your child. The main thing a child provides is the creative material they make with the Service: the words they write or speak, the answers they give the storyteller, and the characters, places, stories, and worlds they invent, including any character that stands for themselves (we never ask for a photo). We keep this as their Worldbook so they can return to it. If our content filter stops something your child typed or said, we keep a record of that blocked entry with their profile so we can improve the filter. A child may include personal details in what they write. Our content filter looks for inappropriate material (see Section 3) but does not detect personal details such as names or addresses. If your child volunteers one, it is sent to our artificial intelligence provider and saved with the story like anything else they write; we instruct the artificial intelligence not to use it or repeat it, but we cannot remove it before it is sent. So we ask that you supervise your child's use, and you can delete any story from your account at any time. A story or character stays private to your family unless you choose to feature it, as described in Section 3.

Your child's voice. If your child uses the voice feature, we record what they say only long enough to convert it to text, then delete the recording. The text becomes part of the story like anything they type. We do not keep recordings.

Trying Mondow before you sign up. Our website lets a visitor try the storyteller without an account: they pick from our featured characters, answer a few questions, see a short story written into pages, and see one of those pages illustrated. Because a child may be the one typing, we treat everything a visitor types there as a child's information. What they type, the pages written from it, and the one picture are stored for up to 24 hours against a random identifier held in a cookie on that device (see Section 9), so that the story can continue if you sign up on that device; if nobody does, it is deleted (see Section 7). The text reaches our artificial intelligence provider exactly as a signed-in child's does, through the same content filter described in Section 3, and the same caveat applies: the filter does not detect personal details a visitor types. The try screen has no voice feature, and we do not ask the visitor for anything about themselves. To protect the try screen against abuse, we also keep a one-way salted hash of the device's IP address, which cannot be turned back into the address, in a counter that limits how often it may be used.

Automatically. When the Service is used, we collect limited technical information: a device and browser type, an IP address (kept only in our hosting provider's request logs and, for the try screen, as the one-way hash described above; our analytics do not record it), page views and product events (such as "started a story"), error reports, and identifiers stored in cookies (see Section 9), including a short label for the invitation you arrived through, if any. Where this information is collected while your child is using the Service, we collect it only to support the internal operations of the Service, which COPPA permits without separate consent. Specifically, we use it to keep you signed in, to maintain your child's kid-mode session, to protect the Service against abuse, to diagnose errors, to measure performance, and to understand which features are used. We do not use it to build a profile of your child, to serve advertising, or for any other purpose.

Our analytics are tied to your parent account, not to your child. Your child appears in analytics only as an anonymous identifier. Session recording and automatic capture of what is typed or clicked are turned off. We do not send story text or images to our analytics provider, and error reports are intended to contain only technical details.

We do not knowingly collect more personal information from or about a child than is reasonably necessary for them to use the Service.

The Mondow app. The Mondow app for iPad and iPhone, once available, shows the same Service as our website and collects the same information in the same ways; this Privacy Policy applies to both. The app asks for permission to use the microphone only if your child uses the voice feature, and recordings are handled exactly as described above. The app does not ask for access to your camera, photos, contacts, or location, does not send notifications, does not use Apple's advertising identifier, and contains no advertising. It uses the same analytics as our website, described above. Apple distributes the app and processes your App Store account and downloads under its own privacy policy; Apple does not receive your child's information from us.

3. How we use information

We use the information we collect to:

• Provide and operate the Service, including generating stories and illustrations, maintaining the Worldbook, and saving what your child creates.
• Personalize your child's experience and keep stories appropriate for their age.
• Communicate with you about your account, your consent, your child's use, and support.
• If we send you updates about Mondow by email in the future, let you stop them using the unsubscribe link in any such email. We never send marketing to children.
• Keep the Service safe and secure, including filtering content and preventing misuse.
• Maintain, analyze, and improve the Service, using de-identified or aggregated information where we can.
• With your specific approval, show a story or character your child made on our website, as described below under "Featured creations."
• If we introduce paid features in the future, process your payments.

How content filtering works. Before anything your child types or says is sent to the storyteller, and again before any generated text is shown, we check it against a filter for profanity, sexual content, severe violence, self-harm, and slurs. Spoken words are first converted to text by the speech-to-text provider described in Section 5; the filter runs on that text, so a recording reaches that provider before we check it. Our artificial intelligence provider also applies its own safety settings to every text and image request, which is the safeguard generated images rely on. Blocked material is not sent to the artificial intelligence, and your child is gently redirected. In addition, we instruct the artificial intelligence never to ask your child for personal details. These safeguards are designed to keep the experience age-appropriate; they are not perfect, and they do not detect personal details a child may type or say.

Voice recordings. Recordings of your child's voice are used only to convert what they said into text and are deleted immediately after. We do not keep them, use them for any other purpose, or share them with anyone other than the provider that performs the conversion. If we ever wanted to use recordings for anything else, such as improving our own speech technology, we would tell you first and ask for your consent again, and it would apply only to recordings made after you agreed.

Featured creations. With your approval, a finished story or a character your child made can be featured on our website, where other families can read it. Nothing is featured unless you approve that specific creation. Whichever way you approve, we show you exactly what would be published: the story's text and pictures, or the character's picture and your child's own description of them, together with the byline as it would appear. The byline shows your child's first name (the nickname on their profile) and their age at the time; you can choose a pen name instead, and we recommend it. We never show a last name, a photo, your child's location or school, or anything else about your child. Please read the creation before you approve it, since a story can contain details your child chose to include; we also check each creation and may decline to feature it. We keep a record of your approval and confirm it to you by email, and you can withdraw your approval at any time, after which we remove the creation from our website within 7 days.

Until featuring is available inside the app, this works by email: if you or your child would like something featured, write to us at support@mondow.world, or we may reach out to you about a creation we would like to feature, and you approve or withdraw by replying to that email or writing to support@mondow.world. Once featuring is available in the app, your child will be able to ask for a creation to be featured from within Mondow, you will approve it there by entering your parent PIN, and you will be able to withdraw your approval from your account as well as by email.

Featured characters can be adopted. A featured character can be added by another family's child to their own stories. What travels is the character's name, picture, and your child's description of them, not anything about your child. The other child receives their own copy, and withdrawing your approval stops any new copies being made, though copies already in another child's stories remain there. If a featured character comes from another family, the same is true in reverse.

We do not use a child's personal information to serve behavioral or targeted advertising, we do not use it to train artificial intelligence models, and we do not sell it.

4. How we obtain a parent's consent

We collect information about your child only after you have consented, with one exception described in Section 2: a visitor may try the storyteller on our website before any account exists, and what they type there is kept for up to 24 hours so the story can continue if you sign up. Here is how it works:

• Before your account is created, you must confirm that you are 18 or older and the parent or legal guardian of any child you add to Mondow, and that you consent to their use of the Service as described in this Privacy Policy. You must separately agree to our Terms of Service and this Privacy Policy. You cannot continue until you have done both.
• You receive a short notice, and we verify your email address. During sign-up we give you a short notice of what we collect about your child, how we use it, and who we share it with. We send a one-time code to the email address you provide, and you must enter it to continue. This confirms that you control that address.
• We record your consent. Once your email is verified, we store a record of your consent with the date and time and the version of the documents you agreed to. Only then can you add a child to your account.
• One consent covers all your children. Your consent applies to every child you add to your account, now or later. Adding another child or updating a child's profile does not require new consent.
• We ask again if our policies change. If we update this Privacy Policy or our Terms, you will be asked to review and accept the new version before the Service can be used again, and we record that new consent.

We use this method because we use your child's information only to provide the Service to your family and do not disclose it to anyone except the service providers described in Section 5, who work on our behalf. A creation is featured only when you approve that specific creation, and we keep a record of your approval and confirm it to you by email. If we ever wanted to use or share your child's information in a way that is not covered by your consent, we would tell you first and ask for your consent again.

You can refuse to give consent, in which case we will not create an account and will not collect anything about your child; a story started on the try screen is deleted as described in Section 7. You can revoke your consent at any time by contacting us at support@mondow.world, in which case we will stop collecting personal information from your child and will delete what we have collected, as described in Section 7.

5. How we share information

We do not sell personal information, and we do not disclose a child's personal information to third parties for their own purposes, including advertising. We share information only in these ways:

With service providers that help us run the Service. These companies process information on our behalf and may use it only to provide their services to us. They are bound by terms that limit their use of the information to that purpose and require them to keep it confidential and secure. They fall into these categories:

• Artificial intelligence provider. Google, through its Google Cloud Vertex AI platform, generates the story text and illustrations. Google receives what your child writes to the storyteller, the characters and places they invent, and the descriptions used to make images, including what a visitor types on the try screen described in Section 2. Google does not receive your child's nickname, birth year, gender, or note. Under our agreement with Google, this content is not used to train Google's models.
• Speech-to-text provider. Converts your child's spoken words to text. Receives the recording only for that purpose and does not keep it. Today this is Google, described above.
• Sign-in provider. Handles account creation, sign-in, password storage, and email verification. Receives your name, email address, and password.
• Hosting and database providers. Host the Service and store your account information, your child's profile, and the Worldbook. Keep server and request logs.
• Analytics and error-tracking providers. Receive page views, product events, performance measurements, and error reports keyed to your parent account. As described in Section 2, your child appears only as an anonymous identifier, and no story text or images are sent to them.

Publicly, with your approval. A story or character you approve is shown on our website with your child's first name or a pen name and their age, as described in Section 3, and a featured character may be copied into other families' stories.

For legal and safety reasons. We may disclose information if the law requires it, to enforce our Terms, or to protect the rights, safety, or property of a child, you, us, or others.

In a business transfer. If Mondow is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, and it will remain subject to this Privacy Policy. We will notify you before your child's information is transferred and becomes subject to a different privacy policy.

We do not make your child's participation in the Service conditional on disclosing more personal information than is reasonably necessary to provide it.

6. Your choices and your rights as a parent

As a parent or guardian, you can, at any time:

• Review the personal information we have collected about your child. Your child's profile and everything they have created are visible in your account.
• Correct your child's nickname, birth year, gender, or note from your account.
• Delete your child's personal information. Deleting a child's profile from your account settings permanently removes the profile and everything your child made: their stories, characters, illustrations, drafts, and blocked entries.
• Refuse any further collection or use of your child's information, and revoke your consent, by contacting us.
• Delete your entire account from your account settings. You confirm with your account password, and your account, every child profile, and everything your children created are deleted immediately. You can also ask us to do it at support@mondow.world.
• Withdraw approval for a featured creation by replying to your confirmation email or writing to support@mondow.world.

To make a request, contact us at support@mondow.world or use the controls in your account. To protect your child, we may ask you to verify your identity (for example, by writing from the email address on the account) before we act on a request. If you ask us to delete information that your child needs in order to use the Service, we may have to close their profile.

7. How long we keep information

This section is our data retention policy for the information we collect. We keep personal information only as long as it is needed for the purposes described in this Privacy Policy, and we do not keep children's personal information for longer than that.

• Your account information (name, email, PIN, and consent records): kept while your account exists, so that we can operate it and show that we obtained your consent. When you delete your account, your account and sign-in records are deleted immediately, and the record of you in our analytics is deleted within 30 days. We keep a minimal record that consent was given and later withdrawn, without any of your child's information, where the law requires it.
• Your child's profile and everything they create (nickname, birth year, gender, note, stories, characters, illustrations, drafts, and blocked entries): kept while the child's profile exists, so that your child can return to their world and you can review it. Removed immediately when you delete the profile or your account. If your child had a featured creation, it is withdrawn at the same time and removed from our website within 7 days. An anonymous identifier may remain in feedback messages you sent and in abuse-prevention counters; it is no longer linked to any information about your child.
• Voice recordings: deleted immediately after they are converted to text.
• A story started on the try screen (Section 2): kept for up to 24 hours. If you sign up on that device within that time, it becomes part of your child's profile and is kept as described above; otherwise it is deleted, together with its pages and picture. The abuse-prevention counter keeps the one-way hash of the device's address and a count of how often the try screen has recently been used from it; it is linked to no account and cannot be turned back into an address.
• Featured creations: shown until you withdraw your approval or delete the child's profile, then removed from our website within 7 days. Copies of a featured character that other children adopted before then remain in their stories.
• Feedback messages: kept while your account exists so we can act on them. Deleted with your account.
• Technical logs, analytics, and error reports: kept by our providers for limited periods set by them, then deleted or de-identified.
• Backups: copies of deleted information are removed as our database provider's backups expire, normally within 30 days.

We may keep de-identified or aggregated information that does not identify you or your child.

8. How we protect information

We maintain administrative, technical, and physical safeguards designed to protect personal information, appropriate to its sensitivity and to the size and nature of our activities. These include encryption of data in transit, encryption of stored data by our database provider, restricting access to personal information to people who need it to operate the Service, a separate kid mode that is protected by your PIN, and careful selection and oversight of the service providers described in Section 5. No method of storage or transmission is completely secure, so we cannot promise absolute security, but we work to protect your and your child's information and to limit who can access it.

9. Cookies and similar technologies

We use cookies and similar technologies to run the Service. None of them are used for advertising, and none of them build a profile of your child:

• Sign-in cookies set by our sign-in provider keep you signed in to your account.
• A kid-mode cookie keeps your child in kid mode for up to 24 hours. It holds an identifier for the active child profile, cannot be read by scripts in the browser, and contains no other information about your child.
• Analytics and performance identifiers help us understand how the Service is used and how fast it loads. They are tied to your parent account, not to your child, and are never used for advertising.
• An invitation cookie, if you arrive through an invitation link, remembers which invitation brought you for up to 30 days, so we can see how families find Mondow. It is set before you have an account, holds only a short label for the invitation, and holds nothing about your child.
• A try cookie, if you use the try screen described in Section 2, holds a random identifier for up to 24 hours. It is what links the story a visitor started to that device so it can continue after you sign up, and it is one of the two things that limit how often the try screen may be used. It cannot be read by scripts in the browser and holds nothing else.

The same cookies are used inside the Mondow app, where they are stored by the app rather than by a browser.

You may be able to control some of these technologies through your browser settings, though parts of the Service will not work without the sign-in and kid-mode cookies.

10. California privacy rights

If you are a California resident, California law may give you the right to know what personal information we collect and how we use and share it, the right to request that we delete or correct it, and the right to opt out of the sale of personal information or its sharing for cross-context behavioral advertising. We do not sell personal information and do not share it for cross-context behavioral advertising, and we do not knowingly do either for any child. We will not treat you differently for exercising your rights. To make a request, contact us at support@mondow.world. We handle children's information in accordance with COPPA as described above.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Whenever we change it, you will be asked to review and accept the new version in the Service before you can continue using it, and that acceptance is recorded. If we make a material change to how we collect, use, or share your child's personal information, we will obtain your consent again in the same way before the change applies to your child. The "Last updated" date above shows when this Privacy Policy was last changed, and earlier versions remain available on our website.

12. Contact us

Mondow Inc. is the operator of the Service and is responsible for responding to all inquiries from parents about this Privacy Policy and about children's information. The service providers described in Section 5 process information on our behalf.

If you have questions or requests, please contact us:

Mondow Inc.
660 4th Street, PMB 208
San Francisco, CA 94107
(415) 689-4004
support@mondow.world