Privacy Policy

Kimoa is a family bedtime story app. It is rated 4+ in the App Store, but the account holder must be a parent or guardian who is at least 13 years old, or 16 years old in the EU or UK where required by local law. Kimoa is not in Apple's Kids category, and it does not create child accounts or child profiles.

1. Who We Are

Kimoa is operated by Every Toys Dream LLC. In this policy, "Kimoa," "we," "us," and "our" refer to Every Toys Dream LLC and the Kimoa app and website.

2. Information We Collect

We collect the following categories of information when you use Kimoa:

• Account information: your email address and account-related records. Your password and sign-in sessions are stored and secured by Clerk, our sign-in provider, not by Kimoa.
• User-generated content: story prompts you type, character names you enter, generated story text, generated cover images, and generated audio narration.
• Subscription information: your Kimoa Pro subscription status, which we store to unlock Pro features. See section 6.
• Usage data: story generation counts, per-request cost telemetry, operational logs, error logs, and analytics events such as screens viewed and features used.
• Device and technical data: data collected through the PostHog React Native SDK for app analytics, such as device model, operating system version, app version, and an anonymous device identifier. We do not collect IDFA and we do not use cross-app tracking identifiers.
• Support communications: information you send us when you contact support or make a privacy request.

3. How We Use Information

We use personal information to:

• create and manage your account;
• authenticate sign-in and keep your account secure;
• generate stories, cover images, and narrated audio you request;
• manage your Kimoa Pro subscription and unlock its features;
• store and sync your stories and media files;
• measure service usage, performance, reliability, and cost;
• send transactional emails such as verification codes, password reset codes, password-change confirmations, and account-deletion confirmations;
• respond to support, privacy, deletion, GDPR, and CCPA requests;
• detect abuse, enforce our Terms of Service, and protect the service.

4. Legal Bases for Processing

If you are in the EEA, UK, or another jurisdiction that requires a legal basis, we rely on:

• Contract performance: to create your account, provide Kimoa, generate stories, store your content, and deliver requested features.
• Consent: where you voluntarily provide prompts, request AI generation, or contact us for support.
• Legitimate interests: to secure the service, prevent abuse, troubleshoot issues, analyze service performance, and improve the product in a privacy-conscious way.
• Legal obligations: where we must retain, disclose, or delete information to comply with applicable law.

5. Third-Party Processors

We use third-party service providers to operate Kimoa. These providers process information on our behalf for the purposes described below:

• Convex for backend database, stories metadata, and server functions. Privacy Policy: convex.dev/privacy
• Clerk for account sign-in, passwords, sign-in sessions, device verification, and sign-in and verification emails. Privacy Policy: clerk.com/legal/privacy
• Cloudflare R2 for object storage of generated cover images and narrated audio files. Privacy Policy: cloudflare.com/privacypolicy
• PostHog Cloud for product analytics in the mobile app. We use PostHog for analytics only, not advertising identifiers. Privacy Policy: posthog.com/privacy
• Resend for sending the account-deletion confirmation email. Resend sends only this email. Privacy Policy: resend.com/legal/privacy-policy
• AI model providers. We use third-party AI providers to write story text, create cover illustrations, and produce narration. Which provider handles a given story may change over time as we balance cost, quality, and creativity. When you request a story, your story prompt, the character names you enter, and the generated story are sent to the provider that handles each step. We currently use:
  • DeepSeek: story text. DeepSeek is based in China, and data sent to it is processed in China. Privacy Policy: DeepSeek Privacy Policy
  • Google Gemini API: cover illustrations, and story text when selected. Privacy Policy: policies.google.com/privacy
  • ElevenLabs: voice narration. The story text is sent to create the audio. Privacy Policy: elevenlabs.io/privacy-policy
  We will update this list when we add or change an AI provider.
• RevenueCat for managing Kimoa Pro subscriptions. See section 6 for the information RevenueCat receives. Privacy Policy: revenuecat.com/privacy

6. Subscriptions and Payments

• Kimoa Pro is an auto-renewing subscription sold through Apple's App Store. Apple processes all payments, and Kimoa never receives or stores your card or bank details.
• We use RevenueCat (revenuecat.com/privacy) to manage subscriptions. RevenueCat receives your Kimoa account ID and purchase information (product, price, currency, purchase and renewal dates, subscription status, and App Store country), plus basic device and app-version data. Kimoa stores your subscription status to unlock Pro features.
• You can manage or cancel your subscription in your device's Settings → [your name] → Subscriptions.
• Refunds are handled by Apple under Apple's policies at reportaproblem.apple.com. Kimoa cannot issue App Store refunds directly.
• We may keep purchase records for as long as needed to meet tax, accounting, and legal obligations.

7. Cookies, Website Analytics, and Tracking

The current public Kimoa website is primarily informational and does not currently include third-party advertising trackers or website analytics. The site does, however, load fonts from Google Fonts, which may receive standard request data such as your IP address, browser information, and the page requesting the asset. The Kimoa mobile app uses PostHog analytics as described above. If we later add website analytics, non-essential cookies, or similar tracking tools, we will update this Privacy Policy before or when those tools are enabled.

8. Children's Data and Family Use

Kimoa is intended for family bedtime use, but the account holder must be an adult parent or guardian. We do not knowingly collect personal information directly from children. The service is used by the adult account holder, who may create or read a story for a child. Kimoa does not create child accounts or child profiles.

Kimoa is not enrolled in Apple's Kids category and is not presented to App Review as a child-directed app whose primary user is a child. If we learn that we collected personal information directly from a child without the required legal basis, we will delete that information.

9. Data Retention

We keep personal information for the following periods unless a longer retention period is required by law:

• Account data and stories: until you delete the story, delete your account, or ask us to delete your information.
• Anonymized generation logs used for performance or cost analysis: up to 90 days, then aggregated or deleted.
• Error logs: up to 90 days.
• Analytics data: according to our PostHog retention settings and PostHog's service practices.
• Support and legal requests: for as long as reasonably necessary to respond and document the request.

10. Account Deletion and Data Deletion Requests

You can delete your account in the Kimoa app by going to Account → Delete Account. When you do, we trigger server-side deletion of your account and associated Kimoa data, including your user record, stories, generated media stored in Cloudflare R2, and your sign-in account at Clerk. When an account is fully deleted, we also ask RevenueCat to delete its subscription records for that account. A confirmation email is sent after the request is processed. Deleting your Kimoa account does not cancel an Apple subscription; cancel it in Settings → [your name] → Subscriptions.

You can also request deletion by emailing support@kimoaplay.com. We aim to complete account and deletion requests within 30 days, unless we need a longer period to verify identity, comply with law, or complete a narrowly tailored retention obligation.

11. International Data Transfers

Kimoa and our service providers may process information in the United States and, depending on the provider, in other regions including the European Union and China (see AI model providers in section 5). By using Kimoa, you understand that your information may be transferred to and processed in countries that may have different data protection laws than your home country.

12. Your Privacy Rights

Depending on your location, you may have the right to request:

• access to the personal information we hold about you;
• correction or rectification of inaccurate information;
• deletion or erasure of your personal information;
• portability of certain information you provided to us;
• objection to certain processing or restriction of certain processing;
• withdrawal of consent where processing relies on consent.

To exercise these rights, email support@kimoaplay.com. We may need to verify your identity before fulfilling a request. If you are in the EEA or UK, you may also have the right to complain to your local supervisory authority.

13. Security

We use reasonable technical and organizational safeguards designed to protect personal information. No system can be guaranteed completely secure, and you use Kimoa at your own risk.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the effective date above and may provide additional notice through the app, on the website, or by email when appropriate.

15. Contact Us

For privacy questions, data requests, deletion requests, GDPR requests, CCPA requests, or general support, contact us at support@kimoaplay.com.