Privacy – Fabula

2. The essentials in brief

Fabula invents audio stories for children. As a parent, you create characters (for example your child under their first name or a nickname), choose a genre and, if you like, a few keywords. From this, an artificial intelligence from OpenAI generates a story in five chapters and reads it aloud with a synthetic voice. New stories, characters and purchases are protected by a parent PIN; children only listen and do not enter anything.

For this, personal data has to leave your device – unlike with a purely offline app:

1. Your user account (email address, password) is held by our hosting provider Supabase on servers in Frankfurt am Main.
2. Characters, keywords, stories and audio versions are stored there as well, so that you can find them on every device.
3. To write a story, our servers transmit the age, gender and role of the characters, genre, keywords and language to OpenAI – in doing so we replace the characters' names with placeholders and only insert them again on our server. Only for reading aloud does OpenAI receive the finished chapter text including the names. Your email address and user ID are never transmitted. OpenAI does not use the data to train its models.
4. Purchases of credits are made via Google Play; we manage the purchase status with RevenueCat. We never see payment data.
5. We send emails (confirmation of registration, purchase confirmation, confirmation of a withdrawal) via Resend.

What Fabula does not do: no advertising, no advertising ID, no analytics or tracking tools, no location data, no photos, no microphone recordings, no sharing of stories with other users, no selling of data.

3. User account

3.1 Registration and sign-in

Fabula requires a user account because stories are generated and stored on our servers and charged against your balance. The account is intended for adults – usually a parent; children listen to the stories via their parents' account (see section 13).

When you register, we process:

• your email address,
• your password – exclusively as a cryptographic hash; we cannot see the password in plain text,
• a randomly generated user ID (UUID) to which your characters, stories and balance are linked,
• the times of registration, email confirmation and last sign-in,
• the version of the Terms and Conditions you accepted when registering, and the time of acceptance,
• your setting for the narrator voice (if you choose one).

Providing an email address and password is required to conclude the contract. Without them, Fabula cannot be used.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract); for evidence of acceptance of the Terms and Conditions Art. 6(1)(f) GDPR (legitimate interest in being able to prove the content of the contract).

3.2 Emails

We send only those emails to your email address that are necessary for the account or the contract:

• the confirmation of registration and – at your request – a link to reset your password,
• after each purchase a contract confirmation with product, price, time, order number and the wording of your consent (section 5.4) – we are required to do this by law (Section 312f(3) of the German Civil Code, BGB),
• after a withdrawal an acknowledgement of receipt with content, date and time (Section 356a BGB).

Emails are sent via Resend (section 9.3). We do not send promotional emails or newsletters.

Legal basis: Art. 6(1)(b) GDPR; for contract and withdrawal confirmations Art. 6(1)(c) GDPR (legal obligation).

3.3 Security logs of sign-in

On sign-in, registration, password change and sign-out, the authentication service logs the event with the time, the type of operation and the IP address used. These entries serve to detect and defend against attacks on accounts (e.g. mass sign-in attempts). We delete them no later than 30 days after they are created.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of user accounts) and Art. 32 GDPR.

4. Characters, stories and audio versions

4.1 Characters

You can create characters that appear in stories. The following are stored:

• the name of the character (entered freely, 1–60 characters),
• the age of the character,
• a gender (female, male or neutral) – this serves solely to ensure that the story uses the correct pronouns,
• the chosen illustration (from predefined drawings; photos cannot be uploaded),
• the role (main or supporting character).

If you name a character after your child or another real person, these details are personal data of that person. We receive them from you, not from the person concerned (Art. 14 GDPR). Fabula does not need a real name for this: a first name or nickname is enough, and we ask you not to enter a surname (the app points this out at the name field).

Creating and editing characters is only possible after entering the parent PIN (section 13).

Character details are voluntary. Stories can also be generated without your own characters; the AI then invents the main characters.

Legal basis: for your own details Art. 6(1)(b) GDPR; where characters concern real third parties – in particular your child – Art. 6(1)(f) GDPR. The legitimate interest lies in generating the personal story for your child that you as a parent have requested. The interests of the child do not override this, because only a few details chosen by you yourself are processed, and these are not shown to anyone but you, are not analysed and are not used for advertising purposes.

4.2 Stories and keywords

When you create a story, we store:

• the chosen genre and language,
• your keywords (free text, optional),
• which characters appear,
• the title and text of the five chapters generated by the AI,
• technical details of the story (generation status, chosen narrator voice, time of generation, for sequels the link to the previous parts and the plot form last used, so that two consecutive stories are not structured in the same way).

Please do not enter any sensitive information in keywords – such as illnesses, religion, origin or full names and addresses of real persons. The keywords are transmitted to the AI (section 4.4); if they contain the names of your characters, we replace these with placeholders beforehand. Before generation, an automatic content filter checks whether the keywords are suitable for a children's story (section 4.4). We do not evaluate the keywords for sensitive content and do not need such information; for a good story, “the first day of school” is enough rather than a detailed description.

Legal basis: Art. 6(1)(b) GDPR; where third parties are concerned, Art. 6(1)(f) GDPR (as in section 4.1).

4.3 Audio versions and offline storage

Each chapter is given a voice-over with a synthetic voice from OpenAI (section 4.4). In the app, every story is labelled “Written and read by AI”. The audio files are held in a non-public storage area at Supabase in Frankfurt. For playback, the app generates a link that becomes invalid after one hour; without being signed in as the owner of the account, no access is possible.

If you choose “Save for offline”, the app downloads the audio files to the app's own storage area on your device. This is not accessible to other apps. The files remain there until you remove them under “Settings → Delete downloads”, delete the app data or uninstall the app.

So that the app can also be used without an internet connection, it additionally stores a copy of your story list and of the text of every story you have opened in the same app-owned storage area. This copy does not leave your device. It is removed when you sign out, via “Delete downloads”, when the account is deleted, when the app data is deleted and when the app is uninstalled.

Voice samples (“Listen to voice”) are the same for all users and contain no personal data.

Legal basis: Art. 6(1)(b) GDPR.

4.4 Generation by artificial intelligence (OpenAI)

The text and voice-over of the stories are generated by AI models from OpenAI. The app itself does not connect to OpenAI for this; the request is made exclusively by our server (Supabase Edge Functions).

Names stay with us (pseudonymisation). Before we make a request to write a story, our server replaces the names of your characters with neutral placeholders such as “[[F1]]”. The AI writes the story with these placeholders; our server only inserts the real names after the response. This also applies to keywords and – for sequels – to the title and text of the previous part.

The following is transmitted to OpenAI:

• for writing: genre, language, keywords, and the age, gender and role of the characters appearing (without names); for a sequel additionally the title and text of the previous part (without names);
• for content review: the keywords and the title and text of the finished story (in each case without names) to OpenAI's moderation service; it assesses whether the content is suitable for children;
• for reading aloud: the text of the respective chapter – here including the characters' names, because the voice has to pronounce them – and the chosen voice.

Not transmitted: your email address, your user ID, your IP address or device data. OpenAI recognises only our server as the sender.

We use the paid OpenAI API (not consumer services such as ChatGPT). Inputs and outputs are not used there to train AI models. We instruct OpenAI not to store responses for later retrieval. OpenAI stores requests and responses for no more than 30 days exclusively in order to detect abuse and violations of its usage policies, and deletes them afterwards.

OpenAI processes the data as a processor on our behalf on the basis of OpenAI's Data Processing Addendum (Art. 28 GDPR). Processing may take place on servers outside the EU, in particular in the USA (section 9.6).

Children's stories are subject to their own content requirements (no frightening content, a happy ending) and to the content review: keywords that are not suitable for a children's story are rejected before a credit is used; a story that does not pass the review is rewritten and otherwise not delivered – the credit is then refunded. With AI-generated content there can be no complete guarantee that every story is suitable; that is why you can report any story (section 6).

No decision is made about you; the AI exclusively writes the story you have requested (section 17).

Legal basis: Art. 6(1)(b) GDPR (generation of the story ordered); where third parties are concerned, Art. 6(1)(f) GDPR (as in section 4.1).

4.5 Deleting individual content

You can delete characters and stories individually in the app at any time. When a story is deleted, its chapters and audio files on the server are deleted as well. The text copy of the story stored on your device is removed at the same time; you remove audio files saved offline via “Delete downloads”.

5. Credits and purchases

5.1 Google Play (purchase and payment)

You buy credits via the Google Play billing system. The purchase contract, payment, invoice and refunds are handled by Google in accordance with the Google Play Terms of Service. We do not receive or store payment method data (credit card, bank details, PayPal etc.) at any time. Google is independently responsible for this processing; Google's privacy policy applies (https://policies.google.com/privacy).

Legal basis: Art. 6(1)(b) GDPR.

5.2 RevenueCat (purchase verification)

To determine which package you have bought and to credit the credits to your account, we use RevenueCat.

Provider: RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA.

Data processed:

• your Fabula user ID (the random UUID from section 3.1 – not your email address); before the first sign-in a random identifier generated by RevenueCat,
• product, time of purchase, purchase token and transaction identifier from Google Play,
• store country, currency and price of the purchase,
• technical details such as device model, operating system and app version, language and the IP address of the connection.

RevenueCat acts as a processor under our instructions; the basis is RevenueCat's Data Processing Addendum (Art. 28 GDPR), which incorporates the EU Standard Contractual Clauses. The data is processed in the USA (section 9.6). Privacy policy: https://www.revenuecat.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (crediting of the purchased credits).

5.3 Balance account

We store the proof of purchase (product, number of credits, price and currency, Google Play order number, transaction identifier, platform, time) and every booking on your balance account (credit from a purchase, use for a story, automatic refund in the event of a technical error, manual credit by us, debit after a refund by Google Play). Your balance results from this.

Legal basis: Art. 6(1)(b) GDPR.

5.4 Consent before purchase

We provide credits immediately after purchase. To make this possible, we ask you before every purchase for your express consent and for confirmation that your right of withdrawal thereby expires (Section 356(5) BGB). For this we store your user ID, the chosen product, the version of the text displayed and the time. The wording of your consent is included in the purchase confirmation we send you by email.

Legal basis: Art. 6(1)(c) GDPR (obligations to provide evidence and confirmation under Section 312f(3) and Section 356(5) BGB) and Art. 6(1)(f) GDPR (legitimate interest in being able to prove, in the event of a dispute, that consent was given).

5.5 Withdrawal

Via “Withdraw from contract” (in the settings under “Legal” and in the dialog for entering the parent PIN) you can withdraw from a purchase made in the last 14 days. For this we store your user ID, the purchase concerned (product, order number, time of purchase), the time of the withdrawal, an optional note and the processing status, and we immediately send you an acknowledgement of receipt by email. The refund is made via Google Play.

Legal basis: Art. 6(1)(c) GDPR (Section 356a BGB) and Art. 6(1)(b) GDPR.

Retention of consents and withdrawals: three years from the end of the year in which they were given or declared (standard limitation period, Section 195 BGB); after that we delete them automatically. If you delete your account earlier, we remove the link to your account from them: only the product, the Google Play order number and the times remain.

6. Reporting content

In every story you can (after entering the parent PIN) use “Report content” to tell us that something is not right. The following are stored: the story concerned and its title, the reason chosen, your optional description (no more than 2000 characters), your user ID, the time and the processing status. We are notified of every new report by email (via Resend, section 9.3); the message goes only to us. We look at the reported story in order to improve our requirements and filters and – if the story was unusable – to credit the credit back.

Please do not include any details about your child in the description that go beyond the reason for the report.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in child-appropriate content and in compliance with Google Play's policies on AI-generated content) and Art. 6(1)(b) GDPR where a credit is concerned.

7. Operation, security and protection against abuse

7.1 Connection data

Each time the app connects to our server, Supabase processes technically necessary connection data: IP address, time, interface called, status code, app or software version. These logs serve operation, troubleshooting and defence against attacks and are automatically deleted by Supabase after 7 days at the latest.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

7.2 Request limits

So that a single account does not overload the service, the number of stories per account and period is limited (currently 20 requests per 10 minutes). For this we store the user ID, type of request and time for each request. Entries older than 100 minutes are deleted with the next request, all others at the latest together with the account.

Legal basis: Art. 6(1)(f) GDPR (protection against abuse and overload).

7.3 AI cost and usage log

For each generation we store the user ID, the story, the AI model used, the number of units processed (“tokens”) and the estimated costs. We use this information to monitor the costs of the service, to calculate prices and to detect abuse. This log does not contain any content of the story.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in economically viable operation that is secure against abuse).

7.4 Contact by email

If you write to us, we process your email address, your name (if provided) and the content of your message in order to answer your enquiry. We delete the correspondence once the enquiry has been dealt with, unless statutory retention obligations (e.g. for commercial letters, six years under Section 257 of the German Commercial Code, HGB) prevent this.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns the contract, otherwise Art. 6(1)(f) GDPR.

8. Data stored on your device

The app stores on your device:

This information does not leave your device – with the exception of the sign-in session, which is sent along with every request to our server in order to identify you as the account holder. It is removed when you delete your account in the app (section 15), delete the app data or uninstall the app.

Storing this information on your device is strictly necessary to provide the app you have expressly requested; consent is not required for this (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Legal basis of the subsequent processing: Art. 6(1)(b) GDPR.

9. Recipients and processors

We pass personal data only to the following service providers, who process it on our behalf and under our instructions (Art. 28 GDPR), and to Google Play as an independent controller for the purchase.

9.1 Supabase (hosting, database, sign-in, file storage, server functions)

• Contracting party: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513.
• Server location: Frankfurt am Main, Germany (Amazon Web Services data centre, region eu-central-1).
• Sub-processors include: Amazon Web Services (Frankfurt data centre), Supabase, Inc. (USA; support and maintenance).
• Data processed: all data mentioned in sections 3 to 7.
• Basis: data processing agreement (Data Processing Addendum) with Supabase under Art. 28 GDPR.
• Privacy policy: https://supabase.com/privacy.

The data is stored in Frankfurt. Access by Supabase from third countries (in particular for maintenance and support purposes) cannot be ruled out; it is safeguarded by EU Standard Contractual Clauses (section 9.6).

9.2 OpenAI (text, narrator voice, content review)

• Contracting party in the EEA: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; sub-processors include OpenAI, L.L.C. and affiliated companies in the USA and their data centre operators.
• Data processed: see section 4.4.
• Basis: OpenAI's Data Processing Addendum (Art. 28 GDPR).
• Privacy policy: https://openai.com/policies/privacy-policy.

9.3 Resend (email delivery)

• Provider: Plus Five Five, Inc. (“Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA.
• Data processed: your email address, content of the email (section 3.2, for reports the details from section 6), time and delivery status.
• Basis: Resend's Data Processing Addendum (Art. 28 GDPR).
• Privacy policy: https://resend.com/legal/privacy-policy.

9.4 RevenueCat (purchase verification)

See section 5.2. If you delete your account, we also delete the purchase data stored at RevenueCat under your user ID.

9.5 Google Play (distribution, purchase, payment)

Google Play is independently responsible for providing the app, handling purchases and payment. Provider in the EEA: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for purchases Google Commerce Limited, same address. Privacy policy: https://policies.google.com/privacy.

If the app crashes, your Android device may – depending on your settings under “Google → Usage & diagnostics” – send a technical report to Google. From this we only see aggregated evaluations in the Google Play Console that do not relate to you personally. Legal basis for our use of these evaluations: Art. 6(1)(f) GDPR (legitimate interest in a stable app).

9.6 Transfers to third countries

In the USA, access by authorities cannot be completely ruled out despite these measures. We have assessed the transfers and taken additional measures; the most important is that the text AI does not receive the names of your characters (section 4.4). You can request a copy of the Standard Contractual Clauses from us at info@simplynext.de.

9.7 Opening external pages

The links “Privacy policy”, “Terms and Conditions” and “Legal notice” open your browser. When a page is opened, the operator of the website processes the usual connection data; the privacy policy of the website opened applies.

10. What we do not do

• No advertising and no advertising SDKs; the app does not query the device's advertising ID.
• No analytics or tracking tools (no Google Analytics, no Firebase, no Facebook SDK). A tool for crash reports (Sentry) is contained in the program code but is not activated; it does not transmit any data. Should we activate it, we will adapt this policy beforehand.
• No access to location, contacts, camera, microphone, photos or files outside the app.
• No passing on of stories to other users, no public profiles, no chat or comment function.
• No profiling, no automated decisions about you.
• No selling and no renting of data.
• No use of your inputs or stories to train AI models – neither by us nor by OpenAI.

11. App permissions

Fabula does not request any further permissions – such as for camera, microphone, location, contacts or media files.

12. Retention periods

13. Children

Fabula is made for children aged about 6 to 8 and takes part in Google Play's “Designed for Families” programme. However, the app is built so that adults hold the account:

• Account for adults only. Only persons of legal age may register. The email address is that of a parent or another person with parental responsibility, not that of the child. The contracting party and the “user” for data protection purposes is the adult.
• Few details about the child. About your child we only process what you enter in a character: a name (a nickname is enough), the age, a gender and a drawn illustration. We do not collect photos, voice, location or contact details of the child.
• No advertising, no tracking. Children do not see any advertising in Fabula; no advertising IDs or usage profiles are collected.
• No outside contact. Children cannot communicate with anyone or publish anything in Fabula.
• Parent mode: children only listen. Everything that requires input or uses balance – new stories and sequels, creating and editing characters, keywords, purchases, reports, settings – is protected by a parent PIN that is stored only on the device. A child can therefore not enter any data in Fabula; they listen to the stories you have created.
• Purchases. Purchases are protected by the parent PIN and are made via Google Play and the Google account stored there. We additionally recommend turning on authentication for every purchase in Google Play (Google Play → Settings → Authentication).
• Child-appropriate content. Keywords and finished stories pass through an automatic content review (section 4.4); every story is labelled as AI-generated and can be reported (section 6).

Processing is not based on the child's consent; Art. 8 GDPR therefore does not apply. The legal bases are the contract with you and your and our legitimate interest in generating the story you want for your child (section 4.1).

As parents, you can assert your child's rights under section 14 on their behalf – most easily by deleting the character or story concerned.

14. Your rights

You have the right to:

• access to the personal data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR, see below)
• lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR (section 3.1 for evidence of acceptance of the Terms and Conditions, 3.3, 4.1, 4.2, 4.4 for third-party data, 5.4, 6, 7 and 9.5), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The objection can be made informally, e.g. by email to info@simplynext.de.

15. Deleting your account

In the app: Settings → Delete account. The settings are protected by the parent PIN.

Without the app (e.g. if the app has already been uninstalled): write from the email address of your account to info@simplynext.de with the subject “Delete account”. We delete the account within one month and confirm the deletion to you.

What is deleted: your account with email address and password hash, all characters, stories, chapters and audio files on the server, proofs of purchase and balance bookings held by us, the cost and usage log, content reports, entries for request limits and the customer record at RevenueCat. On the device on which you trigger the deletion, the app also removes the stories saved offline, the parent PIN and the settings. The deletion is final and cannot be undone.

What is not deleted automatically:

• Consents before purchase and withdrawals: they are kept without a link to your account until the period in section 5.5 expires.
• Audio files saved offline and settings on other devices on which you were signed in – remove these by uninstalling the app or via Android Settings → Apps → Fabula → Storage → Clear data.
• Data that Google Play has stored about your purchase as an independent controller (section 9.5).
• Logs that are deleted at short notice anyway in accordance with section 12.

Unused credits expire on deletion, because they can no longer be assigned to an account afterwards. Please contact us before deletion if you would like a refund for purchased, unused credits (Section 14(3) of the Terms and Conditions).

16. Data security

• All connections between the app, our servers and our service providers are encrypted via TLS (HTTPS).
• The database is set up so that each account can only read its own characters, stories and bookings (Row Level Security). The app cannot change balances and purchases itself; only our server functions may do so.
• Audio files are held in a non-public storage area and can only be retrieved via time-limited links (one hour).
• Passwords are stored exclusively as a hash.
• The access key to the OpenAI API and all other secret keys are held only on the server, not in the app.
• The text AI does not receive the names of characters (pseudonymisation, section 4.4).
• The parent PIN is stored encrypted in the Android Keystore and is not transmitted.
• The security of the data on your device also depends on the protection of the device (screen lock, current system updates).

17. No automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The AI exclusively generates the story you have requested; it does not make any decisions about you or your child.

18. Changes to this privacy policy

We adapt this policy when the legal situation, the app or the services used change. The version available at the time of your use applies. In the event of material changes – in particular new recipients or new purposes – we will inform you in advance in the app and, where required, obtain your consent.

The German version of this policy is authoritative.

19. Contact

SimplyNext

• Email: info@simplynext.de
• Phone: +49 1743389049