Privacy Policy

Effective July 22, 2026

Moontuck is a bedtime story service. We take privacy seriously, especially because some of what you share with us is about your kid. This policy explains what we collect, why we collect it, and what we will and won’t do with it. We’ve written it in plain English. If anything is unclear, write to us at contact@moontuck.com.

Moontuck is made for grown-ups. It is intended to be used by an adult parent or guardian — not by children. A parent creates and manages the account, chooses the story settings, and reads the chapters to (or with) their child. Children are the audience for the stories; they are not meant to use the app or website themselves.

1. Information we collect

From you, the parent

• Account info: your email address and (if you choose to set one) a password. If you sign in with a third party (e.g. Google), we receive the basic profile fields that provider gives us.
• Billing info:handled by our payment processor, Stripe. We receive a customer reference, the subscription status, and limited details (last four digits of your card, billing country). We never see or store your full payment card number. If you subscribe through a Moontuck mobile app, that purchase is processed by Apple (App Store) or Google (Google Play) under their own terms instead — we receive the subscription status, never your payment details.
• Communications: if you write to us, we keep the message so we can reply and improve the service.

About your child

• First name only — never a last name or full name.
• An age range — never an exact date of birth.
• One chosen world per child— the theme their saga lives inside (dragons, dinosaurs, knights & castles, etc.). Picked by you at signup; can be changed later.
• Optional steeringyou submit: “what happens next” nudges for the saga. Entered by you, the parent.
• Delivery status: which chapters have been sent or failed. We do not track whether you opened a chapter — chapter emails include our logo image (which most clients fetch when rendering), but there is no per-recipient tracking pixel or open beacon.

That is the entire list of what we collect about a child. We do not collect photos, videos, voice recordings, geolocation, contacts, or any identifier we don’t need to run the service.

Automatically, when you use the site

• Standard log data: IP address, browser type, pages visited, timestamps. Used for security and to diagnose problems.
• A small number of essential cookies (sign-in session, preferences). We do not run third-party advertising cookies.

2. How we use information

• To write and deliver your child’s daily chapter.
• To review chapters for safety and age-appropriateness. Every chapter passes through an automated pre-publish quality check, a human approval gate (a real person reads it before delivery), and a weekly automated quality audit across a sample of chapters. Identifying information about your child stays within the chapter-generation context and is never published.
• To maintain your account, library of past chapters, and subscription.
• To process payments and prevent fraud.
• To send service email (chapter delivery, billing receipts, important account notices).
• To answer your questions when you contact support.
• To improve the service and our safety guardrails. When we observe patterns in generated content — for example, a phrase clichéd enough to land on our stock-phrase blocklist — we update the writer prompt, the rubric, or the quality guard accordingly. This is prompt engineering, not AI training.

We do not train or fine-tune AI models. We use a commercial AI provider’s API; the writer prompt evolves over time based on observed quality, but no model weights are updated using your child’s data. Your steering submissions and chapter content are not used to train any model, by us or by anyone we work with. See Terms section 9 for the full IP picture.

We do not target ads with your information, and we do not sell it to anyone.

3. Children’s privacy (COPPA)

Moontuck is intended for adults. It is marketed to, and designed to be used by, parents and guardians — not by children.Accounts are created and managed by an adult who agrees to our terms on behalf of their family. We follow the spirit and the rules of the U.S. Children’s Online Privacy Protection Act (COPPA):

• We collect only the minimum information needed about a child to personalize their story: a first name, an age range, and one chosen world (dragons, dinosaurs, etc.). No gender is collected — stories use the child’s name throughout.
• The child does not log in, type into the site, or interact with us directly. A parent operates the service on the child’s behalf, and all story preferences and “what happens next” choices are entered by the parent.
• You, the parent, can review, edit, or delete what we have about your child at any time.
• We do not knowingly collect personal information directly from a child under 13. If you believe a child has somehow contacted us directly, write to us and we will remove it.

4. Who we share information with

We share only what is necessary to run the service, and only with vendors who are bound to protect it:

• Stripe — payment processing.
• Resend — delivery of chapter and account emails.
• Supabase and Vercel — secure cloud hosting and database.
• A commercial AI provider— generates the story text under a commercial-tier API agreement with a non-training data policy. We send only what the model needs (the child’s first name, age range, chosen world, the saga’s narrative state, and any steering you submitted). Your data is not used to train any models — by us or by the provider.

(We may update the specific vendors above as the service evolves; we will keep this list current.)

We do not sell personal information, and we do not share it with advertisers or data brokers.

We may disclose information if required by law, to protect the safety of a user, or in the event of a business transfer (merger, acquisition) — in which case any successor will be bound by this policy.

5. Data security

We use industry-standard measures to protect your information in transit and at rest. No system is perfectly secure, but we work to minimize risk and will notify you promptly if a breach affects your account.

6. Data retention

• We keep your account and your library of delivered chapters for as long as your account is active.
• If you cancel, we keep your library available for 90 days so you can resubscribe without losing it. After that we delete it, unless you ask us to delete it sooner.
• We keep billing records (receipts, invoices) for as long as tax law requires us to.
• Backups are rotated and overwritten in the normal course.

7. Your rights

You can, at any time:

• See, correct, or download what we have about you and your child.
• Delete your account, including all child profiles and the library — yourself, immediately, at moontuck.com/account/delete. No email required, no waiting period.
• Cancel your subscription.
• Opt out of non-essential email (we keep sending you billing and account notices).

For anything else — or if you’d rather a person handle the deletion — email contact@moontuck.com and we will respond within 30 days. If you live in California, the EU, or another region with specific data rights (access, portability, erasure, objection), the same email handles those requests.

8. Cookies

We use cookies — small pieces of text stored by your browser — and we use them sparingly. Here’s exactly what kind, why, and how to control them.

What we use

• Sign-in session cookies.When you sign in with a magic link or Google, we store a session token in a cookie so you don’t have to sign in on every page. These are HTTP-only, secure (HTTPS-only), and SameSite = Lax.
• Short-lived state cookies.The Google sign-in flow uses a 10-minute CSRF state cookie to prevent sign-in hijacking. It’s deleted the moment you finish or cancel sign-in.

What we don’t use

• No advertising cookies.
• No third-party analytics cookies.
• No cross-site tracking pixels.

How to remove or block them

You can clear or block cookies in your browser’s settings. Most browsers let you do this per-site (search “cookie settings” in your browser’s help). Removing the sign-in cookie signs you out — you’ll need to sign back in (with email or Google) to use your account. The rest of the site continues to work.

How to opt out

If you’d like to opt out of any cookie or have us delete any stored cookie state associated with your account, email support@moontuck.comand we’ll process the request within 7 business days. Note that opting out of the sign-in session cookie effectively means you can’t use the account dashboard — your chapter deliveries by email will continue as long as your subscription is active.

We do not show a cookie banner because we don’t use the kind of cookies that legally require one (no tracking, no advertising). If that ever changes, we’ll add a banner, update this section, and email you before it takes effect.

9. International users

Moontuck is operated from the United States. If you access the service from elsewhere, your information will be processed in the U.S., which may have different privacy laws than your home country. By using Moontuck you consent to that transfer.

10. Changes to this policy

We will update this page when we change how we handle information. If the change is material, we will email you before it takes effect. The “Effective” date at the top always shows the current version.

11. Contact

Questions, requests, or concerns: contact@moontuck.com.

Moontuck is operated by MCD LLC, 1890 1st Capital Drive, PO Box 192, St Charles, MO 63302.