Security & Privacy

Last updated June 16, 2026

Moontuck is a personalized bedtime-story service operated by MCD LLC(1890 1st Capital Drive, PO Box 192, St Charles, MO 63302). Because some of what you share with us is about your child, here’s exactly how we handle it — in plain English.

What we collect

From you, the parent:your email address (and, if you use Google sign-in, the basic profile fields Google provides), your timezone, the messages you send us, and any “what happens next” steering you submit for your child’s saga.

About your child:a first name only (never a last name), an age range (never a birthday), and one chosen world (dragons, dinosaurs, knights & castles, etc.) per child. We do not collect their gender — stories use your child’s name throughout rather than gendered pronouns. Up to 4 children per subscription, each with their own first name and chosen world.

Automatically: basic log data (IP address, browser, request timestamps) for security and troubleshooting, and a small number of essential sign-in cookies. We do notuse advertising cookies or third-party analytics. Chapter emails contain our logo image, which most email clients load when rendering the message — we don’t use that or any other tracking pixel to monitor which chapters you’ve opened or read.

What we never collect about your child

No last name. No birthday. No photos, video, or voice recordings. No school. No home address. No location data. No contacts. No device identifiers we don’t need. Just a first name, an age range, and one world they love — the minimum required to make the story theirs.

Moontuck is for grown-ups

The app and website are set up and run by a parent or guardian. Children don’t log in, type into the site, or use the service directly — they’re the audience for the stories, not the users. Every story setting and steering nudge is entered by the parent.

How stories are made — and reviewed before they ship

Each chapter is written by a large language model from a leading commercial AI provider, guided by a tightly-constrained writer prompt with safety rules baked in. Before any chapter reaches your inbox it passes through three layers:

We send the AI only what it needs: your child’s first name, age range, the chosen world, the story’s narrative state, and any steering you submitted. We do not send your email, IP address, payment information, or any other identifying data to the AI provider.

What happens to your data at the AI provider

Our AI provider operates under a commercial-tier API agreement whose policy ensures the text we send and the chapters they generate are not used to train their models.Inputs and outputs are retained briefly for abuse-monitoring and operational purposes, then deleted on their schedule. If you’d like the name of the specific provider we use today, email support@moontuck.comand we’ll tell you.

On our end, we do not train, fine-tune, or sell your child’s information, chapter content, or any conversational data to anyone. Your steering submissions are licensed to us non-exclusively to improve the service (writer prompt tuning, rubric refinement) per Terms section 9.7 — never published or attributed to you. We may change AI providers in the future; whichever provider we use will be on the same commercial-tier non-training basis described above.

Your library and chapter emails

Each delivered chapter arrives as an email in your inbox. Those emails remain in your inbox archive as your family’s personal record of what was received — we don’t ask you to delete them.

Separately, your online libraryon moontuck.com gives you a searchable view of every chapter you’ve received. Library access is part of your subscription: it stays open while you’re a subscriber, plus a 90-day grace window after cancellation so you can come back without losing visibility. After 90 days the library closes.

The stories themselves are Moontuck’s intellectual property; your subscription is a narrow personal-use license to read them aloud at bedtime, not a license to reproduce or redistribute them. The full IP terms are in Terms section 9.

Who we share data with

We share only what’s necessary to run the service, and only with vendors bound to protect it:

We do not sell your information, and we do not share it with advertisers or data brokers.

Payments

All payments are processed by Stripe. Moontuck never sees, stores, or has access to your credit card number, CVV, or billing details — Stripe handles those directly. Stripe is PCI DSS Level 1 certified, the highest level of payment security.

Technical safeguards

What we’ll never do

Data deletion

You can cancel your subscription anytime from your account page in two taps. To delete your account and child profiles entirely (beyond cancellation), email support@moontuck.com. We process deletion requests within 30 days. The chapter emails already delivered to your inbox remain in your personal email archive — those are yours to keep or delete as you wish.

Report a vulnerability

If you discover a security vulnerability in Moontuck, please report it responsibly to security@moontuck.com. Include the affected URL, steps to reproduce, and whether user data may be involved. We take all reports seriously and will respond within 48 hours.

Trust by design

This page is the plain-English summary. For the full details, read our Privacy Policy and Terms of Service.