1. Who is responsible
Dreamo Labs Ltd, registered in England and Wales, company no. 15597359. Registered office: 124–128 City Road, London, EC1V 2NX, United Kingdom. Privacy and support contact: [email protected]. You may also write to our registered office, marked “FairyTunes Privacy”.
Dreamo Labs Ltd is the controller of the personal information described here. This policy covers the FairyTunes app, fairytunes.app, account services and support. It is written for families in the UK, EU/EEA and US. Store availability and features vary by release; the iOS version and Google Play listing are not represented as published by this website preview.
Our Children’s Privacy Notice, Photos & Familiar Voices notice and Retention & Deletion Policy provide further detail. They form part of this privacy information.
2. Information we collect and where it comes from
| Information | Source and purpose |
|---|---|
| Parent identity and account data | Email address, optional display name, account/household identifiers, sign-in provider, confirmation/recovery events and session information. Supplied by you or your sign-in provider to create, secure and restore your parent account. Password authentication is handled by Supabase; support does not ask for passwords. |
| Child and family profiles | Names or nicknames, age/age band, appearance selections, interests, optional personal details, family/friend relationships and links between characters and children. Supplied by the grown-up to select appropriate content and personalize characters and songs. A nickname is sufficient where the app asks for a name. |
| Photos and generated character data | Optional photos you select, appearance prompts, generated portraits, chosen variants, image alignment/head-position information and job metadata. Used to create and display cartoon characters. Selected photos may be sent to our backend and image-processing provider before account creation during guest onboarding. |
| Voice recordings and derived singing audio | Adult voice recordings or audio files you choose, permission records, saved-voice identifiers and generated audio. Used to prepare songs in a familiar adult voice. A recording stored with a character may remain local until selected for an upload/processing flow. |
| Song requests and outputs | Chosen child, song/topic/style, personal note, edited lyrics, review choices, generated lyrics/audio/media, status and allowance records. Used to fulfill requests, check suitability, support retries and keep a family library. Text you enter may contain personal information, so avoid unnecessary sensitive details. |
| Preferences and local activity | Favorites, Kids visibility, autoplay, per-child watch allowance and usage counters, notification preferences, drafts and account-scoped local archives. Used to remember choices and operate parent controls. Some are device-local and do not synchronize across devices. |
| Technical and security data | IP address, request times, browser/device/app information available in requests, error events, session/job identifiers, rate-limit and access records. Used for delivery, authentication, security, abuse prevention and troubleshooting. |
| Support, rights and transaction records | Your correspondence and identifiers needed to investigate requests. If store billing is enabled, store transaction/entitlement records are used to verify access and handle billing questions; Apple/Google handles card details. The reviewed native build has no connected store purchase flow. |
We do not require a child to create an independent account or provide an email address. We do not request precise location, address-book access or unrestricted photo-library access for these features. The current app does not integrate advertising or cross-app tracking SDKs. A device/browser may provide information to the store or operating-system provider under its own settings.
3. Photos, facial features and familiar voices
The app can run face/head-position detection locally to align a character image. Optional reference-photo generation also sends the chosen photo to a remote image-processing service, which can analyze facial features to create the requested likeness. Adult voice processing analyzes audio characteristics to produce a synthetic singing rendition in a familiar voice. The result is generated media, not a genuine recording of the person singing the new words.
These features are for creative personalization, not account authentication or searching for a person’s identity. We do not claim that all facial/audio processing happens on the device or that no derived feature data is processed. Where facial or voice information is protected as sensitive or biometric information under applicable law, the corresponding notice, consent and deletion requirements must be met. A photo or ordinary recording is not automatically special-category biometric data under every law.
Use only photos you are authorized to provide and adult voices whose speakers have given informed permission. Child voice recreation is not supported. See Photos & Familiar Voices for the choices and withdrawal process.
4. AI processing and human access
FairyTunes uses automated systems to interpret a parent’s request, write or check lyrics, generate characters, personalize singing and check technical quality. Personal notes, age band, song context and edited lyrics may be sent to OpenAI for these tasks. If you include a name or other personal detail in the text, that detail can be included in the request. The reviewed lyric-generation/safety calls request non-storage of API response objects; that setting does not establish zero provider retention or eliminate all provider logs.
RunPod-hosted processing receives the photos, prompts, audio or media inputs needed for the requested generation stage. A quality-check path sends newly synthesized catalogue-singer audio to OpenAI for transcription before the familiar adult voice is applied; that path is not designed to send the uploaded family voice recording.
Some server-supported optional functions, such as pronunciation assistance or room imagery, may involve additional audio/text/image processing if enabled in the release you use. We must give relevant notice before enabling a materially different use. Authorized staff may access limited information to resolve a support, security or content concern. We do not promise that every request is reviewed by a person, that output is always suitable, or that processors retain nothing.
5. Purposes and UK/EEA legal bases
| Purpose | Applicable basis |
|---|---|
| Parent account and requested adult-facing services | Performance of our agreement with the adult account holder, where the processing is necessary for that agreement. |
| Optional child personalization, reference photos and adult voice use | Consent from the person concerned or a parent/person with parental responsibility where required. Separate permissions must cover the actual use and relevant AI-provider disclosure. A parent’s service contract is not, by itself, a lawful basis for every use of a child’s data. |
| Security, proportionate diagnostics and ordinary support | Legitimate interests in operating a safe, reliable service, balanced against the rights and best interests of the people concerned, particularly children. |
| Legal records and lawful requests | Compliance with an applicable legal obligation. We keep only the information needed for that obligation. |
Where processing involves legally protected sensitive information, an additional applicable condition is needed. We do not ask for diagnoses, identity documents or other sensitive details in song notes. You can withdraw consent without affecting the lawfulness of earlier processing; the related optional feature may then become unavailable. The final lawful-basis assessment must match the production flow.
7. International transfers
Our UK company uses providers that may process or access information in other countries, including outside the UK or EEA. The actual hosting region and support/subprocessor access depend on the configured account and provider. Where required, transfers need an adequacy decision or appropriate contractual safeguards, such as EU Standard Contractual Clauses and the applicable UK transfer arrangement, with any necessary assessment and additional measures.
You may contact us for information about the safeguards relevant to your data. This draft does not invent a UK-only hosting commitment, confirmed transfer mechanism or EU representative. These facts must be finalized for the UK/EEA launch.
8. Retention and deletion
We retain information only for a defined service, security or legal purpose and must remove or de-identify it when that purpose ends. Different copies have different lifecycles: a local recording, provider job input, saved portrait and backup are not the same record. Read the Retention & Deletion Policy for the confirmed code behavior and the periods still awaiting operational verification.
Current guest sessions have a seven-day expiry measured from creation. A scheduled backend cleanup is designed to remove expired, unclaimed guest records and stored previews; expiry is not a guarantee that every copy is erased at exactly that moment. Chosen/claimed account assets are treated separately. Removing a photo, voice or song from a device does not necessarily remove backend or provider copies.
To request account, child-profile, photo, voice or other cloud-data deletion, use Delete Account & Data. Sign-out, uninstalling, hiding a song from Kids Mode and subscription cancellation do not themselves perform cloud deletion.
9. Access, correction, consent and complaints
Email [email protected] with “Privacy request”, preferably from your parent account email. State whether you want access, a correction, portability, deletion, restriction, an objection or withdrawal of a particular consent. Identify the profile or saved item using its nickname or identifier where possible. Do not send passwords, full payment details, a child’s photo or an identity document with the first request.
We verify identity and parental authority proportionately before disclosing or deleting information. UK/EEA rights depend on the legal basis and applicable exceptions. We normally respond within one month where UK/EU GDPR applies; a lawful extension for a complex request will be explained. A response deadline is distinct from a verified operational erasure/backup schedule.
You may complain to the UK ICO or the data protection authority in your EEA country, without first complaining to us. US state laws may provide additional rights, such as access, correction, deletion, an authorized-agent request or an appeal, where those laws apply. Contact the same address and identify your state if relevant. We will not discriminate against you for exercising applicable rights.
10. Children’s information
Accounts are managed by adults; children use the family experience under adult supervision. That design does not remove children’s privacy protections. For US children under 13 where COPPA applies, required direct notice and verifiable parental consent must precede covered collection, subject only to applicable exceptions. UK/EEA consent and children’s rights require their own assessment; an adult checkbox, store download or parent gate does not automatically prove parental responsibility or valid consent.
Parents may review their child’s information, request removal and refuse further optional collection. We do not make a child provide more information than reasonably needed for the activity. See the Children’s Privacy Notice. A public notice does not substitute for an implemented in-app consent flow.
11. Device permissions, storage and security
Photo selection uses the operating-system picker; the reviewed app does not enable camera capture. Microphone access is requested when an adult chooses to record, and an audio-file import is also offered. Denying an optional permission prevents that operation, rather than granting permission for a different use.
Preferences, local family data and media can be stored on the device; web previews use browser storage. Native session credentials use platform secure storage where implemented. Signing out creates an account-scoped local archive so the same account may restore it later; it is not a cloud backup or erasure request. Protect shared devices and clear local copies separately when appropriate.
We use encrypted transport, access checks and scoped media/session credentials in the reviewed backend design. These measures reduce risk but cannot guarantee absolute security. Notification preferences currently save locally; remote push delivery is not connected in the reviewed build. Optional Google Analytics is available only after an adult opts in. This website has no advertising or third-party font embeds; see Cookies & Website Storage.
12. Changes
We will date material updates and give appropriate notice. A new purpose or disclosure that requires consent must not be introduced solely by changing this page. Contact [email protected] about this policy.
Optional website analytics
For adult visitors who choose to allow it, fairytunes.app uses Google Analytics 4 to understand website visits and page views. Google receives browser/device information, the visited page path, a shortened referring-site address, approximate geographic information derived from the request, and analytics cookie identifiers. Query strings, URL fragments, form values, names, email addresses, photos and voice recordings are not intentionally included in our analytics events. This does not add Analytics to the mobile app.
The Google tag is blocked until you confirm that you are 18 or over and select “Allow analytics”. Rejecting optional analytics does not prevent using this website. Advertising storage, advertising personalization and Google signals are disabled in our tag configuration, and automatic enhanced measurement is off. We honor browser Global Privacy Control and Do Not Track signals by keeping analytics off.
Our basis for optional website analytics is consent. Google Analytics user-level and event-level retention is configured to two months, with reset on new activity off. Most aggregated standard reports are not governed by this setting and may remain available longer. Your choice is stored in your browser for 180 days; you can change it through “Cookie settings” in the footer. Google Analytics cookies (_ga and a property-specific _ga_ identifier) are configured for up to 180 days. Withdrawal stops future collection and clears these cookies on this site; it does not automatically erase previously processed data. Contact [email protected] about privacy rights. Google may process information outside the UK/EEA; applicable contractual safeguards and the operator’s wider transfer review are explained in our Privacy Policy.
Learn how Google uses information from sites that use its services and see Google’s Privacy Policy. Children should reject optional analytics; a grown-up can manage these settings.