Privacy Policy

1. Introduction

Toony Story is operated by Modlific LLC, a Utah limited liability company (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, and protect your personal information when you use our service. By using Toony Story, you consent to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

• Account information — your name, email address, and password when you create an account. Passwords are stored securely and are never saved in plain text.
• Google account data — if you sign in with Google, we receive your name, email, and profile picture from Google.
• Content you create — characters, stories, and AI-generated images you create within the app.
• Uploaded photos — reference photos you upload for character creation, which are sent to our AI provider for image generation.
• Usage data — we may collect basic server logs (IP address, browser type, pages visited) for security and performance purposes.
• Payment information — if you make a purchase, our payment processor collects your payment details. We do not store your credit card number or full payment details on our servers.

We do not sell your personal information.

3. How We Use Your Information

We process your information on the following lawful bases:

• To perform our contract with you — providing the Toony Story service, authenticating your identity, and maintaining your account.
• With your consent — generating AI illustrations from your uploaded photos and sending transactional emails.
• For our legitimate interests — improving the service, ensuring security, and preventing abuse.

4. Uploaded Photos & Likeness Data

When you upload a reference photo for character creation, please be aware of the following:

• Processing — your photo is sent to Google Gemini’s API to generate a stylized illustration. We do not use facial recognition technology or build biometric profiles.
• Storage — uploaded reference photos are stored alongside your character data for the purpose of regenerating or editing illustrations. They are not shared with other users or third parties beyond our AI provider.
• Consent responsibility — by uploading a photo of another person, you confirm that you have that person’s consent (or parental/guardian consent for minors) to use their likeness in AI-generated illustrations.
• Deletion — when you delete a character or your account, the associated reference photos and generated images are permanently removed.

5. Cookies & Tracking

Toony Story uses the following cookies and tracking technologies:

Essential Cookies

• Session cookie — a secure cookie required to keep you logged in. This cookie is essential for the service to function and cannot be disabled.

Analytics & Advertising Cookies (Consent Required)

The following are loaded only after you consent via our cookie banner. You may decline these cookies and still use the service.

• Google Analytics — we use Google Analytics to understand how visitors use our site, including page views, session duration, and feature usage. Data is processed by Google under their Privacy Policy.
• Meta Pixel — we use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. This shares data about your activity on our site (such as page views, sign-ups, and purchases) with Meta. Data is processed by Meta under their Privacy Policy.

Managing Your Preferences: You can change your cookie preferences at any time on our Cookie Preferences page or via the link in our website footer. You can also disable cookies in your browser settings.

Do Not Track: If you decline analytics cookies via our consent banner, no tracking scripts are loaded.

6. Third-Party Services

We use the following third-party services to operate Toony Story:

• Google Gemini — for AI story generation and image creation. Your prompts and uploaded reference photos are sent to Google’s API.
• Google Analytics — for website analytics and usage measurement (loaded only with your consent; see Section 5).
• Meta Pixel — for advertising measurement and conversion tracking (loaded only with your consent; see Section 5).
• Stripe — for payment processing, subscriptions, and billing. Your payment information is sent directly to Stripe and is never stored on our servers.
• Lulu Direct & Printful — for printing and shipping physical books and merchandise. Your shipping address is shared with these providers to fulfill orders.
• Google — for optional social sign-in (Google OAuth).
• SendGrid — for sending transactional emails.
• Infrastructure providers — we use third-party providers for database hosting and application hosting.

Each provider processes data in accordance with their own privacy policies. We select providers that maintain appropriate security standards and data protection practices.

7. International Data Transfers

Toony Story is operated from the United States. Our third-party service providers may process data in the United States and other countries. If you are accessing the Service from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to such transfers.

8. Data Storage & Security

Your data is stored in a secure, encrypted database. Passwords are securely hashed and are never stored in plain text. We use HTTPS for all data transmission and secure cookies for session management. While we implement industry-standard security measures, no method of transmission or storage is 100% secure.

9. Data Retention

We retain your account data and created content for as long as your account is active. If you delete your account, your personal data and associated content (including uploaded photos, characters, stories, and generated images) will be permanently removed from our active systems within 30 days. Residual copies in backups may persist for up to 90 days before automatic deletion.

10. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach. We will also notify relevant authorities as required by applicable law.

11. Your Rights

Regardless of your location, you have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@toonystory.com. We will respond within 30 days.

• Right to access — request a copy of all personal data we hold about you.
• Right to rectification — request correction of inaccurate personal data.
• Right to deletion — request deletion of your account and all associated data. You can delete your account directly from the Account Settings page, or by contacting us.
• Right to data portability — request an export of your data in a commonly used, machine-readable format.
• Right to restrict processing — request that we limit how we use your data while a concern is being resolved.
• Right to object — object to processing of your data based on our legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know — you may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete — you may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.
• No sale of data — we do not sell your personal information. With your consent, we share limited activity data with Meta for advertising measurement (see Section 5). You may opt out of this sharing at any time via our cookie consent banner.
• Right to opt out of sharing — you can opt out of data sharing for advertising purposes by declining cookies via our cookie banner or using the “Cookie Preferences” link in our footer.

To exercise these rights, contact us at privacy@toonystory.com. We will verify your identity before processing your request.

13. Utah Consumer Privacy Act (UCPA)

Toony Story is operated from the State of Utah. If you are a Utah resident, you have rights under the Utah Consumer Privacy Act (UCPA):

• Right to access — you may request confirmation of whether we are processing your personal data and access to that data.
• Right to delete — you may request deletion of your personal data.
• Right to data portability — you may request a copy of your personal data in a portable format.
• Right to opt out — you may opt out of the processing of your personal data for targeted advertising or the sale of personal data. You can exercise this right via our cookie consent banner or the “Cookie Preferences” link in our footer.

To exercise these rights, contact us at privacy@toonystory.com. We will respond within 45 days. If we are unable to fulfill your request, we will explain why.

14. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• All rights listed in Section 11 above apply, along with the right to lodge a complaint with your local data protection authority.
• Lawful basis — we process your data based on contract performance (providing the Service), consent (photo uploads, email), and legitimate interests (security, service improvement).
• Data transfers — data is transferred to the United States as described in Section 7. We rely on standard contractual clauses and provider certifications where applicable.

For GDPR-related inquiries, contact our privacy team at privacy@toonystory.com.

15. Children’s Privacy

Toony Story is designed for use by families to create children’s storybooks. While the stories are intended for children, account creation and use of the service requires a parent or guardian. We do not knowingly collect personal information from children under 13 without parental consent. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe a child has provided us personal information without consent, please contact us at privacy@toonystory.com.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the “Last updated” date. For significant changes, we will also notify you via email.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights: