Privacy
Data retention schedule
Last updated November 3, 2026
We keep personal information only as long as we need it to provide TaleTykes, keep it safe, and meet our legal duties. Then we delete it. This page is our written retention schedule. It is part of our Privacy policy and the Notice for parents about children's information, and for schools it is part of the School terms.
Times are counted from when the information was created, unless the table says otherwise. "Deleted" means removed from our live database and file storage; copies in backups are overwritten as backups roll over, within 30 days. Where a school agreement sets a shorter period for student information, the school agreement wins.
Children's information
| Information | How long we keep it | Then |
|---|---|---|
| Profile: nickname, grade, band, optional birth year, animal picture, interests, settings a grown-up chose | While the child's space is open | Deleted within 30 days of the child being deleted or core consent being withdrawn |
| Sign-in details: picture password, passphrase or username (secret stored only as a hash), failed tries and lockouts | While the child's space is open | Deleted within 30 days, as above |
| Skill estimates, lessons, lesson attempts, skill checks, recommendations, and notes to adults such as "stuck on a skill" | While the child's space is open | Deleted within 30 days, as above |
| Reading activity: books opened and closed, pages read, words tapped for help, replays, answers to questions | 24 months, rolling | Deleted; anything newer is deleted with the child |
| Oral reading scores (only with voice consent): words correct per minute, accuracy, error counts | 30 days | Detailed scores deleted; what they showed stays only as part of the child's skill estimates |
| Read-aloud audio | Never stored. The recording stays on the device for one replay and is never uploaded. | Not applicable |
| Writing built from tiles and prompts | While the child's space is open, or until a grown-up deletes the piece | Deleted within 30 days |
| Books made for the child, including any with the child's first name | While the child's space is open | Deleted within 30 days; never added to the shared library |
| Experiment assignments (only with research opt-in or a school agreement) | While the experiment runs, and no longer than the child's space is open | Deleted with the child |
| Child sessions | Family device: 4 hours without use, 24 hours at most. Class device: 10 hours. iPhone or iPad app: 30 days. | Expired at once; the record is deleted within 30 days of expiry |
| Trusted devices | 180 days from when a grown-up trusted the device, or until removed | Stop working at once; the record is deleted within 30 days |
| Consent records for the child | 3 years after the child's space or the account closes | Deleted |
Adults' information
| Information | How long we keep it | Then |
|---|---|---|
| Account: name, email, role, family role, time zone | While the account is open | Deleted within 30 days of closing |
| Family settings: time limits, topic blocks, goals, notification choices, quiet hours | While the account is open | Deleted within 30 days of closing |
| Mobile number for text tips | Until you remove it, reply STOP and remove it, or close the account | Deleted within 30 days of closing, or at once when you remove it |
| Sign-in sessions, including IP address and browser user-agent | Until the session expires or you sign out | Deleted within 30 days of expiry |
| Passkeys (public keys), linked Google or Apple sign-ins, authenticator settings | Until you remove them or close the account | Deleted within 30 days of closing |
| One-time sign-in links and codes (stored as hashes) | Minutes, until used or expired | Deleted |
| Family invites (stored as hashes) | Until accepted, revoked or expired | Deleted within 30 days |
| Notes between parents and teachers | While the class link is open | Deleted when the link ends or the school's records are deleted |
| Support email | 2 years from the last message | Deleted |
| Help-article feedback, with a hashed visitor id | 2 years | Deleted |
| School quote requests | 2 years from the last contact, unless the request becomes a school agreement | Deleted, or kept with the agreement's records |
| Email and text delivery records (what we sent, when) | 30 days | Deleted |
| Book reports and safety cases | 3 years after the case closes | Deleted, unless a legal hold applies |
| Email addresses blocked for abuse | While the block is needed | Removed when the block ends |
Schools and students
| Information | How long we keep it | Then |
|---|---|---|
| Student records a school provides or creates (rosters, classes, reading records, writing) | For the term of the school agreement | Deleted within 30 days of the school's request or the end of the agreement |
| Students withdrawn from a district's roster | The district's chosen retention period after withdrawal: 365 days unless the district sets between 30 and 3,650 days | Deleted, unless the school asks sooner or the student returns |
| Classroom plan student records after the plan ends | 30 days after the plan ends, so the teacher can export | Reminder on day 23; erased on day 30 |
| Teacher and administrator accounts | While the account is open | Deleted within 30 days of closing |
| Integration tokens (rostering, Google Classroom, learning platforms), encrypted | Until the integration is turned off | Deleted at once when turned off |
| Classroom and learning-platform links and student ids | While the integration is on | Deleted when turned off or with the school's records |
| Data protection agreement status and school settings | For the agreement and 3 years after | Deleted |
Technical and security records
| Information | How long we keep it | Then |
|---|---|---|
| Server logs at our hosting provider (request time, page, IP address, browser, errors) | 30 days or less | Deleted by the host |
| Audit log of sensitive actions, including every staff access to a child's information | 3 years | Deleted |
| Request-limit counters (keyed by one-way hashes) | Minutes, and cleared within a day | Deleted |
| Staff access windows and two-person approvals | 3 years, with the audit log | Deleted |
| Backups of the database | Rolled over within 30 days | Overwritten |
| Aggregate statistics with no names or ids | As long as useful | Not personal information |
Billing and legal records
| Information | How long we keep it | Then |
|---|---|---|
| Billing records: plan, subscription history, payments, refunds, book packs, billing events | 7 years, as tax law requires | Deleted |
| Stripe customer and subscription ids | 7 years, with the billing records | Deleted |
| Card fingerprint hash (one trial per card) | 7 years, with the billing records | Deleted |
| Consent records: notice version, scope, method, time, evidence hash | 3 years after the account closes | Deleted |
| Notice acceptances (which version of our terms you accepted) | 3 years after the account closes | Deleted |
| Privacy requests and our answers | 24 months | Deleted |
Stripe keeps its own records of payments under its own legal duties and privacy policy.
How deletion works
Deletion happens in steps, so that a mistake can be caught and so that nothing is left behind.
- Mark. When you ask to delete a child or close your account, we record a deletion request with a due date 30 days away. You can see it on the Privacy & data page.
- Stop. At once, a deleted child is signed out on every device and can't sign in or get new books. When an account is closed, its sign-ins and its children stop working.
- Hide. The information is taken out of every screen, report and email, and is no longer used to make books.
- Purge. A scheduled job deletes the records and files from our database and private file storage by the due date. Where a record must stay for one of the reasons in the billing and legal table, the job removes everything else and keeps only that record.
- Backups roll over. Our database provider keeps backups for point-in-time recovery for a short window. Deleted information leaves the backups as they roll over, within 30 days. We don't restore deleted information from backups except to recover from a technical failure, and if we ever do, we delete it again.
- Confirm. We email the account holder when the deletion is complete.
Within the first 30 days, if you closed your account by mistake, write to privacy@taletykes.com and we may be able to reopen it. After the purge, the information can't be recovered.
What each action does
Deleting a child
Deleting a child from the Privacy & data page signs the child out of every device at once and stops new books. Within 30 days we delete the child's profile, sign-in details, reading records, skill estimates, lessons, writing, oral reading scores and books made for them. We keep the consent record for 3 years, as COPPA record-keeping requires, and the audit log entries that record what happened. Other children in the family are not affected.
Closing an account
Closing the family account deletes every child in it as above, and deletes your account, settings, sessions, passkeys, linked sign-ins and mobile number within 30 days. If you have a paid plan, cancel it in Account → Billing first; we keep billing records for 7 years and consent records for 3 years. If the family has another parent or grown-up, their access ends too.
A teacher or school administrator can close their account by writing to privacy@taletykes.com, or by asking their school. Student records belong to the school and are kept or deleted as the school agreement says.
Withdrawing consent
- Core consent. Withdrawing core consent for a child stops collection at once (the child can't sign in) and starts deletion of the child's information within 30 days, as for deleting a child.
- Voice. Withdrawing voice consent turns off read-aloud recording at once. We delete the stored oral reading scores within 30 days.
- Name in books and messages. Withdrawing this stops books, emails and texts from using the child's first name at once. Names are added when a book is shown, not written into the stored book, so books already made stop showing the name too.
- Research. Withdrawing research consent takes the child out of any comparison at once. Experiment assignments for the child are deleted within 30 days.
Withdrawing an optional consent never stops the child using the core reading space.
When a child's school link ends
If a family account was linked to a child's class, ending the link stops sharing between home and school at once. The school keeps its own records under its agreement, and the family keeps its own.
Schools
Roster retention
When a district connects a rostering service, students who disappear from the roster are not deleted straight away, because students often move between schools in the same district or return. Instead, the student's record is frozen: the student can't sign in, and nothing new is added. The record is kept for the district's chosen retention period and then deleted. The default is 365 days. A district administrator can set any period from 30 to 3,650 days on the district's governance page. If the student returns to the roster before then, the record is restored.
End of a Classroom plan
When a teacher's Classroom plan ends and isn't renewed, and there is no school or district agreement covering the class:
- The teacher can still sign in and export the class's records for 30 days.
- On day 23, every teacher of the school gets an email reminder with the deletion date.
- On day 30, the class's student records are erased: reading records, lessons, writing, scores, files and class links. Each student's name and sign-in details are removed, and only an empty placeholder with no personal information stays so linked records stay consistent.
End of a school or district agreement
When a school or district agreement ends, or the school asks us in writing, we delete the school's student information within 30 days, after returning it in a usable format if the school asks first. We confirm the deletion in writing. A district administrator can also ask for deletion from the district's governance page.
Legal holds and exceptions
We may keep specific records longer than this schedule says only:
- when a law requires us to, such as tax law for billing records or COPPA for consent records;
- when a court order, subpoena or other legal process requires us to preserve them;
- to establish, exercise or defend a legal claim or resolve a dispute; or
- to resolve a safety matter, such as a report about a child's safety or abuse of the Service.
A hold covers only the records it needs, not the whole account. Records under a hold are taken out of normal use, and only the people handling the hold can see them. When the hold ends, we delete the records on the normal schedule. If we keep something after you ask us to delete it, we will tell you what and why, unless the law forbids it.
De-identified and aggregate information
We don't keep de-identified copies of individual children's or adults' records after deletion. What we keep are aggregate statistics, such as how many children completed a skill check in a week, or how often a help article was marked helpful. These are counts and rates for groups. They contain no names or ids, and groups too small to hide any one person are left out. They can't be linked back to anyone, so they are not personal information, and we may keep them for as long as they are useful to improve lessons and books.
How to ask
- To delete a child or close a family account, use the Privacy & data page in your family settings.
- To download your family's information first, use the same page.
- For anything else on this page, or to ask about a record, email privacy@taletykes.com.
- Schools and districts can write to schools@taletykes.com.
We answer within 45 days, and usually much sooner. See Your choices and rights for how we verify requests.