Privacy
Cookies and device storage
Last updated November 3, 2026
This page lists every cookie TaleTykes sets, everything we keep in your browser's storage, and what our iPhone and iPad app stores on the device. It is part of our Privacy policy.
TaleTykes uses cookies only to make the Service work: to keep a grown-up signed in, to remember that a grown-up trusted a device for children's sign-in, to keep a child signed in on that device, and to remember a step you were in the middle of. We don't use advertising, analytics, tracking or social media cookies, and no other company sets cookies on our pages.
What cookies and storage are
A cookie is a small piece of text a website asks your browser to keep and send back on later visits. A "first-party" cookie is set by the site you are visiting; a "third-party" cookie is set by another company whose content is on that page. Browser storage (such as "local storage") is a similar place where a site can keep small values on your device. On an iPhone or iPad, apps keep secrets such as sign-in tokens in the Keychain, a protected store that iOS manages.
Cookies we set
Every cookie on TaleTykes is first-party. Every one is marked HttpOnly, so scripts on the page can't read it, and SameSite=Lax, so other sites can't use it to make requests in your name. Our site works only over encrypted connections (HTTPS, with HSTS), and the sign-in, device, sign-up and help cookies are also marked Secure.
| Cookie | What it does | How long it lasts |
|---|---|---|
| __Secure-better-auth.session_token | Keeps a grown-up signed in after you use an email link, a code, a passkey, Google, Apple or school sign-on. It holds a random session token, signed so it can't be changed. | 30 days, refreshed as you use TaleTykes. We also end sessions sooner: parents after 30 days without use or 90 days in all, teachers after 12 hours without use or 30 days in all, staff after 8 hours without use or 24 hours in all. |
| __Secure-better-auth.session_data | A short cache of your session, so we don't look it up on every page. | 1 minute |
| Sign-in step cookies (names begin with __Secure-better-auth.) | Hold a random value while you finish a Google or Apple sign-in, a passkey sign-in, or an authenticator check, so the step can't be hijacked. | Minutes, and removed when the step ends |
| __Host-tt_device | Marks a browser that a grown-up trusted for children's sign-in. It holds a random token; we store only a hash of it. | 180 days, or until a grown-up removes the device |
| __Host-tt_child | Keeps a child signed in on a trusted device. It holds a random token; we store only a hash of it, and a grown-up can sign the child out at any time. | Family device: ends after 4 hours without use, 24 hours at most. Class device: 10 hours. |
| tt_intent | Remembers whether you started a family or a teacher sign-up while you open the email we sent you. | 1 hour |
| tt_plan | Remembers the plan you picked on the pricing page before you signed up. | 24 hours |
| tt_ce | Remembers which email address a sign-in code went to, so the code page can say where to look. It is signed so it can't be changed, and is sent only to sign-in pages (path /auth). | 10 minutes |
| tt_hv | A random help-center visitor id, so one person's "Was this helpful?" vote counts once. We store only a hash of it, never your IP address. Sent only to help pages (path /help). | 1 year |
| tt_more | Remembers that a child asked for more library books today, so the library shows the same extra books. Sent only to library pages (path /read/library). | 36 hours |
On a local development computer (not on www.taletykes.com), the device and child cookies drop their "__Host-" prefix because the computer doesn't use HTTPS. That doesn't affect anyone using TaleTykes.
We don't use a cookie to remember your color theme: light, dark and high contrast follow your device's setting.
Browser storage
We use the browser's local storage for two small values, both on a child's reading device. Neither is sent to us.
| Key | What it does | How long it lasts |
|---|---|---|
| tt_goal_seen | Remembers that the child already saw this week's "goal met" card, so it doesn't show again. It holds the date the week started. | Until the browser's storage is cleared; replaced each week |
| tt_kept_words | Up to 40 words a child chose to keep after tapping them for help, so the child can see them again on that device. | Until the browser's storage is cleared or the list is replaced |
We don't use session storage, IndexedDB, or any other browser storage, and we don't use storage to identify you or follow you across sites.
The iPhone and iPad app
The TaleTykes app for iPhone and iPad doesn't use cookies. It keeps two sign-in tokens in the iOS Keychain:
- A device token, which marks the device as one a grown-up trusted for children's sign-in.
- A child session token, which keeps a child signed in on that device for up to 30 days, until a grown-up signs the child out, or until the device is removed.
The Keychain items are set so they can be read only on that device, after someone has entered the device passcode once since it started up, and they don't move to a new device. On our server we store only hashes of these tokens. The app reads book text aloud with the device's built-in speech voice, and the spoken text doesn't go to any other company. The app sends no notifications to children.
What we don't use
- No advertising cookies, and no advertising identifiers on the app.
- No third-party analytics, such as page-view or event-tracking tools.
- No tracking pixels or web beacons, on the site or in our emails.
- No session recording or replay tools.
- No tag managers.
- No social media plugins, "like" buttons, or embedded social feeds.
- No embedded video players or other third-party widgets.
- No chat widgets.
- No device fingerprinting.
- No third-party fonts. Our fonts are built into the site, so loading a page doesn't contact a font service.
Book pictures and audio are served through our own server from private storage. They are never public links, and loading them doesn't send anything to another company. Payment pages are the one place you interact with another company: when you pay, Stripe shows its own page or form, and Stripe may set its own cookies there under its own privacy policy, to process the payment and prevent fraud.
Why there is no cookie banner
Every cookie and storage key on this page is strictly necessary to provide something you asked for: signing in, children's sign-in on a trusted device, finishing a sign-up or a sign-in step, counting a help vote once, or keeping a child's library and words on the device. US law doesn't require consent for cookies like these, and we don't use any cookie that would need it. A banner would only add a click with no real choice in it, so we don't show one.
If we ever want to add a cookie that is not strictly necessary, we will update this page first, and we will ask for consent where the law requires it. We will never add advertising or third-party tracking cookies.
Global Privacy Control and Do Not Track
Global Privacy Control (GPC) is a signal some browsers send to say you want to opt out of the sale or sharing of your personal information. We treat it as a valid opt-out request. Because we don't sell or share personal information, or use it for targeted advertising, receiving the signal doesn't change anything about the cookies on this page.
Do Not Track (DNT) is an older browser signal with no agreed meaning. We don't track you across other sites or apps and don't let anyone else do so on TaleTykes, so a DNT signal doesn't change anything either.
Our emails don't contain tracking pixels or web beacons, and we have turned off open tracking and click tracking at our email provider (Twilio SendGrid). That means we don't know whether you opened an email, and links in our emails go straight to TaleTykes, not through a redirect that counts clicks. Our emails don't load images from any server. SendGrid keeps its own delivery records, such as whether a message was delivered or bounced, which help us fix delivery problems.
How to clear cookies and storage
You can see and delete cookies and site storage in your browser's settings. Look for "Cookies and site data", "Privacy" or "Website data" in Safari, Chrome, Edge or Firefox, and search for taletykes.com. If you clear them:
- Grown-ups will need to sign in again.
- A trusted device for children will need to be trusted again by a grown-up, and the child will need to sign in again.
- The child's kept words and the weekly goal card on that device will reset.
You can also remove a trusted device, or sign a child out, from your family settings, and sign out of your own sessions in Account → Security. On iPhone or iPad, deleting the TaleTykes app removes what it stores; a grown-up can also remove the device from family settings to make its tokens stop working.
If you block all cookies, you won't be able to sign in to TaleTykes, because sign-in needs a cookie.
Changes
If we add, remove or change a cookie or storage key, we update this page and the date at the top before the change goes live. A change that matters to your privacy is handled as the Privacy policy describes.
Questions
Email privacy@taletykes.com.