Notice for parents about children's information

TaleTykes, Inc. ("TaleTykes", "we", "us") runs a reading and writing practice service for children in Pre-K through grade 8. This notice is written for parents and legal guardians. It is our direct notice to you under the Children's Online Privacy Protection Act (COPPA) and the Federal Trade Commission's COPPA Rule (16 CFR Part 312, as amended in 2025), and it is also our online notice about how we handle information from and about children under 13. We apply the same practices to every child who uses TaleTykes, including children aged 13 and older.

Read this notice before you set up a child space. When you give consent, we record which version of this notice you saw. If you have a question at any point, email privacy@taletykes.com.

The short version

The rest of this notice gives the full detail the law asks for. The Privacy policy covers information about adults.

Who we are and how to reach us

The operator responsible for children's information on TaleTykes is:

• TaleTykes, Inc., a Delaware corporation in the United States
• Website: www.taletykes.com, and the TaleTykes app for iPhone and iPad
• Email for children's privacy: privacy@taletykes.com
• In the service: Settings → Privacy & data, after you sign in
• Mailing address: our mailing address is available on request from legal@taletykes.com and is given in full in every school agreement

TaleTykes is the only operator collecting personal information through the child space. The companies listed under "Who receives your child's information" process information for us under contract; they are not separate operators collecting from your child. If you have a question about one of them, ask us and we will answer it.

We have no phone line for privacy requests. Email and Settings → Privacy & data are the two ways to reach us, and both reach the same team.

What this notice covers

This notice covers personal information we collect from or about a child through:

• the child space on the TaleTykes website
• the TaleTykes app for iPhone and iPad
• class devices a teacher has set up for reading under a school agreement

It does not cover information about you as an adult account holder, which is in the Privacy policy, except where this notice describes what we keep to prove your consent. It does not cover services your child's school runs, such as its learning management system, or services you choose to connect, such as Sign in with Apple. Those services have their own policies.

"Personal information" here has the meaning COPPA gives it. It includes a first name, a persistent identifier that can recognize a user over time and across services, and audio files that contain a child's voice, along with other items.

How the child space works

Children are never account holders on TaleTykes. A parent, guardian or teacher creates a child space and decides how the child signs in. Your child then reads books written for the skills they are practicing, answers short questions, builds sentences and stories from tiles, and practices sounds and words.

What your child can do

• Read books chosen for the sounds, words and skills they are working on
• Tap a word to hear it or see help with it
• Listen to a page read aloud by the device's own speech voice
• Answer questions by tapping a choice, a picture or a tile
• Build writing from word tiles, picture prompts and sentence frames
• Keep words they like on that device (up to 40 words, stored only on that device)
• Pick interests from a menu so books cover topics they like
• If you allow it, read a page aloud and get a score for how it went

What your child cannot do

• Type free text to an AI model. Child inputs are pictures, tiles and choices only.
• Post anything publicly. Nothing a child makes is shown to other families or to the public.
• Chat or exchange messages with other users, including other children.
• Receive push notifications, emails or texts. We send messages only to adults.
• See advertising of any kind. There are no ads anywhere on TaleTykes.
• Follow links out of the child space to other websites, app stores or social media.
• Buy anything. There are no purchases, loot boxes or in-app payments in the child space.
• Upload photos, video or files.
• Share their location or contacts.

There is no infinite feed, no streak your child can lose, and no reward that depends on spending time or money.

What we collect from and about your child

We collect only what the reading practice needs. Some items you give us when you set up the child space. Some are created as your child uses the service. The table lists each item, how we get it, and why.

We do not collect your child's last name, photo, email address, phone number, home address, a school name typed by the child, precise location, contacts, advertising identifier or gender. If a school roster includes a last initial, we keep only that initial, to tell two students with the same first name apart in a class.

Voice and audio

When voice consent is on, your child can record a page read aloud. The recording is scored on the device, kept in memory only long enough for one replay, and then discarded. It is never uploaded to us or to any vendor. Only the resulting scores are sent to us and stored. COPPA treats a child's voice as personal information, so we ask for your separate consent before this feature can be used even though the audio never leaves the device.

The "Listen" read-aloud feature uses the speech voice built into the browser or the iPhone or iPad. The text is spoken on the device, and no vendor receives it.

What we collect about you to run your child's space

To set up and protect a child space we also keep information about you: your name, email address, sign-in records, your consent record (see "How we check that you are a parent"), your settings for each child (daily time limits, blocked topics, voice and name choices, reading goal, quiet hours, notification choices) and billing records. The Privacy policy explains these in full.

How we use your child's information

We use children's personal information only to provide and support the TaleTykes service. Specifically:

• to choose and write the next books and lessons at the right level for your child
• to show you, and if your child is in a class, the teacher, how reading and writing are going
• to apply the time limits, topic blocks and other settings you choose
• to keep the service safe, including a person's review of writing that may show a child is at risk
• to keep accounts and devices secure, stop misuse and keep the service working
• to meet our legal duties, such as keeping proof of your consent

We never use your child's information:

• for advertising of any kind, including contextual ads, targeted ads or ads measured across services
• to build a profile of your child for any purpose outside TaleTykes
• to sell or rent it, or share it for cross-context behavioral advertising
• to train AI models, ours or anyone else's
• to send your child messages or notifications

Consent, scope by scope

Consent on TaleTykes is per child and per scope. You give it when you set up a child space, and you can change each optional scope at any time from Settings → Privacy & data. We record which scopes you chose, the version of this notice you saw, the method we used to check you are a parent, and the time.

A child without granted core consent cannot sign in.

Core: the reading space (required)

Core consent covers everything in "What we collect from and about your child" except oral reading scores and research assignments. It is needed for TaleTykes to work, because we cannot choose books for a child without knowing their level and what they have read.

If you say no to core consent, we do not create the child space and we collect nothing from your child. If you withdraw it later, your child can no longer sign in, we stop collecting at once, and we delete your child's information within 30 days, apart from the consent records we must keep.

Voice: read-aloud recording and scoring (optional)

Voice consent lets your child record a page read aloud and get a score. As explained above, the audio stays on the device and only scores are stored.

If you say no, the record button does not appear. Your child can still read every book, use "Listen", answer questions and write. Their skills are still estimated from reading events and answers.

Names in books and messages: name_personalization (optional)

This scope lets us put your child's first name into their own books after the text is written and checked, and into emails and texts we send to you about that child. The name is added by our own server or by the app on the device after generation. It is never sent to an AI vendor. Books with a name in them are never added to the shared library.

If you say no, books use a neutral hero, and messages to you refer to your child in a general way, such as "your reader". Nothing else changes.

Research: anonymous comparisons of lesson settings (optional, off)

This scope would let us include your child in comparisons of two lesson or book settings, both of which we would defend as good teaching. Nothing in a comparison withholds teaching, and your child never sees which version they got. Results are studied only in aggregate, without names.

Research consent is off by default and we do not ask for it at launch. If we start asking, it will be a separate choice with its own explanation, and saying no changes nothing about your child's use of TaleTykes. A school may agree to comparisons for its students in its school agreement.

We never ask for more than an activity needs

We do not make your child's participation in any game, activity or feature depend on giving more personal information than that activity reasonably needs. Declining an optional scope never stops your child using the core service.

How we check that you are a parent

Before a child can sign in, we take steps to make sure the person giving consent is the child's parent or legal guardian.

The card check

When you start a family plan we charge 50 cents to a credit or debit card and refund it automatically. The FTC accepts a monetary transaction that notifies the primary account holder as a method of verifiable parental consent. The charge appears on the card statement, so the cardholder learns about it even if someone else used the card.

Payments are handled by Stripe. We never see your full card number. We receive the card brand, the last 4 digits, the expiry date and the billing ZIP code, and we keep a one-way hash of the card (a fingerprint) so that each card can start only one trial.

If the card is in someone else's name

Use a card in your own name if you can. If you use a card that belongs to another adult, such as a spouse or another guardian, you confirm that the cardholder is also the child's parent or guardian or has agreed to the charge. The cardholder will see the charge and can contact us. If a cardholder tells us they did not agree, or we have another reason to think the person who consented is not the child's parent or guardian, we pause the child space so the child cannot sign in, and we ask for consent again by another method. If we cannot get valid consent, we delete the child's information.

Other methods

Our systems also support other methods the FTC recognizes, including a signed consent form, knowledge-based questions, a video call with trained staff, and a check of a government ID followed by prompt deletion of the ID. We do not use these today. If we add one, we will update this notice and say how we handle any information it collects.

Schools

When a school uses TaleTykes for its students, the school may give consent for educational use in place of parents, as described in "School use" below.

Who receives your child's information

We do not sell, rent or share children's information for advertising. We disclose it only to the service providers below, who run parts of TaleTykes for us under written contracts that limit them to providing that service, require them to keep it secure and confidential, and bar them from using it for their own purposes. All of them process data in the United States. The full list, with locations, is on our Subprocessors page.

AI vendors receive no child identifiers

Anthropic, Google and xAI never receive your child's name, birth year, sign-in details, device token, account id or any other identifier. Our system writes each request from book settings and menu choices, and a check runs on every request to block personal information before it is sent. AI vendors operate under terms that bar them from training on what we send and limit retention. Nothing they produce reaches your child until our own checks for decodability, readability, safety and format have passed. The AI page explains this in more detail.

Disclosures for safety and the law

We may also disclose a child's information when we believe in good faith that the law requires it, such as a valid subpoena or court order, or when it is needed to protect a child's safety, for example a report to the appropriate authorities about a child at risk. We disclose only what is needed, and we keep a record.

If TaleTykes is ever part of a merger, acquisition or sale of assets, children's information would move only under terms that keep the promises in this notice, and we would tell you before it is used under any different terms.

Disclosures that are not part of the service need separate consent

The 2025 amendments to the COPPA Rule require a separate consent before an operator discloses a child's information to third parties when the disclosure is not integral to the service, for example for advertising or for sale. We make no such disclosures. If we ever wanted to, we would first ask you for a separate consent, apart from the consent you give to use TaleTykes, and saying no would not affect your child's use of the service.

Persistent identifiers and internal operations

TaleTykes uses a few persistent identifiers: the trusted device token, the child session cookie, and, on iPhone and iPad, the same tokens kept in the device's Keychain. We use them only to support the internal operations of the service: to keep a child signed in on a device a grown-up trusted, to apply time limits, to keep the service secure, to stop misuse, and to keep it working. We never use them to contact a child, to build a profile across sites or apps, or for advertising. The COPPA Rule allows this use as support for internal operations, and we limit it to that.

All our cookies are first-party. There are no third-party cookies, analytics, trackers or advertising ids. The Cookies page lists each one with its lifetime.

Our data retention policy

This section is our written data retention policy for children's personal information. We keep a child's information only as long as reasonably necessary for the purpose we collected it for, and then delete it. We do not keep it indefinitely.

Why we keep it

We keep reading and writing records because the core purpose of TaleTykes is to teach reading over months and years. Books for next week depend on what your child mastered last month. Without that history we would repeat skills a child already has or skip ones they still need. We keep consent records because the law expects us to be able to show that a parent consented.

How long we keep it

Deletion timeline

When you delete a child space, we pause it at once: your child can no longer sign in and no new books are made. We then delete the child's information within 30 days. Copies in backups are overwritten within the following 30 days as backups roll over. We keep the consent record for 3 years, as above, and it contains no reading or writing data.

We may keep specific records longer only when the law requires it, or when they are needed to resolve a dispute or a safety matter that is already open. We keep only the records involved, only for as long as needed, and we do not use them for anything else. The Retention page gives the full schedule for every kind of record.

Our information security program

We keep a written information security program for children's personal information, as the amended COPPA Rule requires. A named person at TaleTykes is responsible for it. Under that program we:

• identify and review risks to children's information at least once a year and after any significant change
• design safeguards to control those risks, and test and monitor them
• encrypt data in transit (TLS 1.2 or newer) and at rest
• enforce row-level security in the database, so a parent's session can read only that family's rows, a teacher's only their own classes, and a child's only their own
• give staff access to child data only through named roles, a two-person approval for role grants, and time-limited access windows of at most 30 minutes, each with a reason
• log every staff access to child data in an append-only, hash-chained audit log that cannot be edited
• store sign-in secrets, device tokens and sign-in codes as one-way hashes, and encrypt accommodations and integration tokens
• check every vendor's security before it receives data and bind it by contract
• train staff who handle children's data
• keep a written incident response plan and tell affected parents, schools and regulators as the law requires
• review and update the program at least once a year

Our Security overview describes these measures in more detail. No system is perfectly secure, but we hold ourselves to these steps and review them regularly.

Safety review of writing

Children's writing is built from tiles and prompts, so it is limited by design. Even so, a child can put words together in a way that suggests they may be at risk. When our checks flag a piece of writing, it is held and a trained person at TaleTykes reviews it. An AI system never decides on its own whether a child is safe. If a person decides there is a concern, we may contact you, or the school for school use. In an emergency, we may contact the appropriate authorities.

You can report a book you think is wrong for your child from the book's menu. The book comes off your child's shelf while we review it, and we reply within one business day. Our Content standards explain what books may and may not contain.

Your rights as a parent

As a parent or guardian you can, at any time:

• Review the personal information we hold about your child
• Download a copy of it
• Correct details you entered, such as the name or grade
• Delete your child's information, by deleting the child space
• Refuse further collection or use of your child's information
• Withdraw consent for any optional scope, such as voice, while keeping the core reading space
• Withdraw core consent, which stops collection and starts deletion

You can refuse further collection and use while still allowing what is integral to the service. For example, you can turn voice off and keep the reading space, or turn names off and keep everything else. If you refuse further collection for the core reading space, though, your child cannot keep using TaleTykes, because the service cannot choose books without it.

You can also refuse to let us disclose your child's information to third parties while still allowing the service to use it, except for disclosures to the service providers listed above that are integral to running TaleTykes. Since we make no other disclosures, there is nothing more to switch off.

How to use your rights

In the service

Sign in and go to Settings → Privacy & data. There you can see each child's consent scopes, switch optional scopes on or off, download a child's information, and delete a child space. Changes to optional scopes take effect at once.

By email

Email privacy@taletykes.com from the email address on your account. Tell us which child the request is about and what you want. If you write from a different address, or we cannot otherwise confirm you are the parent, we will ask for reasonable proof before we show or change anything, so that no one else can see your child's information. We will not ask for more than we need.

We reply to email requests within 30 days, and usually much sooner. There is no fee.

If your child is in a school

If your child uses TaleTykes through a school, contact the school first: it controls student records under its agreement with us. You can also email us, and we will help the school answer within 10 business days.

School use

Schools may use TaleTykes with their students under our School terms. When they do:

• The school may consent for the collection of students' personal information in place of parents, but only for the use and benefit of the school and for no other commercial purpose. This follows the FTC's guidance on school authorization and the 2025 rule.
• We use student information only to provide the service to the school, and never for advertising, for profiles outside the service, for sale or for training AI models.
• The school decides which features are on, and may give parents its own notice about TaleTykes. We give schools notice text they can use.
• The school controls student records. Parents can ask the school to review or delete their child's information, and we help the school do it.
• When a school withdraws a student, the record is frozen and kept for the school's chosen retention period (365 days by default, which the school can set between 30 and 3,650 days) unless the school asks us to delete it sooner. When the school's agreement ends, we delete student records within 30 days.

If a family links a home account to a child's school record, the family's own consent covers the home use, and the school's authorization covers the school use. The two are recorded separately.

If we learn we collected information without consent

If we learn that we collected personal information from a child without verifiable parental consent, or without a school's authorization for school use, we stop the collection at once, pause the child space so the child cannot sign in, and delete the information within 30 days, unless a parent gives consent in that time. If we can reach a parent, we tell them what happened and how to give consent if they want the child to continue.

If you think a child is using TaleTykes without a parent's consent, email privacy@taletykes.com and we will look into it.

Changes to this notice

We may update this notice as the service or the law changes. Each version has a number and a date, and we keep a record of which version each parent saw.

If a change is material, for example if we want to collect a new kind of information from children, use it for a new purpose, or disclose it to a new kind of recipient, we will email you before the change applies to your child and ask for fresh consent. Until you consent, we will not apply the change to your child's information. If you do not consent, your child can keep using the service as before, as long as we can still provide it without the change. If we cannot, we will tell you and you can delete the child space.

For changes that are not material, such as clearer wording or a new contact detail, we will post the new version here and update the date.

We tell schools and account holders at least 30 days before we add a company that would receive personal information. The Subprocessors page keeps a change log.

Contact us

• Children's privacy questions and requests: privacy@taletykes.com
• In the service: Settings → Privacy & data
• Schools and school agreements: schools@taletykes.com
• Safety concerns and book reports: safety@taletykes.com
• Help with the service: Contact us
• Mailing address: available on request from legal@taletykes.com

If you believe we have not handled your child's information as this notice describes, you may also contact the Federal Trade Commission at www.ftc.gov.