We protect your account with hashed passwords and PINs, an optional second sign-in step and limits on guessing, and one family's information is kept apart from another's by the database itself. If you find a security problem, or believe a book in the shared library copies your work, this article says where to write.
How we protect your account
- Passwords are never stored as you typed them. We keep only a one-way hash. A password needs at least ten characters.
- Guessing is limited. We limit how many times anyone can try a password. We will never ask you for your password.
- Two-step sign-in is available. You can ask for a code from an authenticator app as well as your password, with backup codes in case you lose your phone. Turn it on in Settings > "Account and security" > "Two-step sign-in" with "Set up two-step sign-in". See Two-step sign-in.
- Sessions end. A sign-in lasts 30 days and is renewed while you use TaleTykes, so a device you have not used for 30 days asks you to sign in again. Changing your password in Settings signs you out everywhere else; see Changing your email or password.
- One family cannot see another's information. This is enforced by the database, not only by the pages you see.
- Pictures and recordings are private. They have no public address and are shown through short-lived links to people who are allowed to see them.
- Our staff accounts need a second sign-in step, and every staff action is recorded.
How your child's sign-in is protected
Your child's PIN or picture password is stored as a one-way hash too. After 5 wrong tries, that reader is locked for 15 minutes and sees "Too many tries. Ask a grown-up to help." You can lift the lock sooner with "Let (your child's name) try again" on their Safety tab.
A child's PIN only opens their own shelf, and only on a device that you, or a guardian you invited, have set up for reading. It cannot change a setting or reach payments. Apart from books in the shared library, which a person has read first, it opens only that child's own books. Leaving the child area needs your own password. If a device goes missing, you can sign your child out everywhere; see Signing a reader out everywhere and Trusted devices.
If something goes wrong
If we ever find that someone reached information they should not have, we will tell the families affected, in plain words, what happened, what it means for their child, and what we have done, without waiting to be asked. How we look after this sets out our security program in full.
Reporting a security problem
If you think you have found a security problem in TaleTykes:
- Write to privacy@taletykes.com.
- Tell us how to reproduce the problem.
- Leave out any other family's information, even if you could see it.
We acknowledge a report within 3 working days, and we will not pursue anyone who reports a problem in good faith. Contact lists this address too.
Copyright notices
A family can offer a book their child made to the shared library, and a person reads it before any other family can see it. If you believe a book there copies your work, send a notice to our designated agent. Copyright gives the agent's details, what a notice must include, and what happens next. Email reaches us fastest.
When we receive a complete notice, we take the book out of the shared library. The family who made it keeps their own copy, and we tell them what happened and that they can send a counter-notice. The same page explains counter-notices and what we do about repeat infringement.
Who we are
TaleTykes is a DBA of Optiarms, Inc., a C corporation. Our postal address is in the privacy notice and the terms.
If you are worried about your own account, write to support@taletykes.com or see Contact.