1. Who we are
Pipli Stories ("Pipli Stories", "we", "us") is a storytelling app that plays curated audio stories and creates personalized AI-generated stories for children. Pipli Stories is operated by 16 App Labs LLC, 17th Cross, HSR Layout, Bengaluru, Karnataka 560102, India. We are the data fiduciary (data controller) for the personal data described here.
This policy applies to the Pipli Stories mobile apps, website at piplistories.com, and related services (together, the "Service").
2. Our commitment to families
Pipli Stories is built for children, but accounts are created and managed only by parents or legal guardians. We collect the least data we need to tell a good story, we never sell personal data, we never show behavioural advertising to children, and we never use a child's data to build an advertising profile.
3. Information we collect
| Category | Examples | Source |
|---|---|---|
| Parent account | Name, email, sign-in provider ID (Apple, Google), country, language | You, your sign-in provider |
| Child profile | First name or nickname, age band, pronouns | You |
| Family cast | Names, relations (e.g. "Mom", "Pet") and pronouns of people and pets you add to stories | You |
| Story preferences | Genre, moral, duration, tone, topics to avoid, custom lesson or worry text, saved presets | You |
| Generated content | Story scripts, narrated audio, titles you create | Created by the Service |
| Usage data | Stories played, completion, replays, feature use, crash logs | Your device |
| Device data | Device model, OS, app version, language, approximate region (from OS locale or IP), anonymous guest ID | Your device |
| Purchases | Subscription tier, renewal status, transaction ID | App Store or Google Play |
What we do not collect. We do not collect children's photos, voice recordings, precise GPS location, contacts, or payment card numbers. Card details are handled by Apple or Google, not by us.
Guest use. Before sign-up, the app uses an anonymous guest ID stored on the device to count free plays. It is not linked to your identity. If you sign in to an existing account, guest data is discarded, not merged.
Sensitive inputs. Fields like "things to avoid" or "a specific worry" are optional. Please don't enter health details, full names of others, addresses, or anything you would not want stored.
4. Children's privacy and parental consent
Children cannot create accounts. A parent or guardian must sign up, pass a parental check, and give verifiable consent before we process any child's data. Under India's DPDP Act, a "child" is anyone under 18; under the US COPPA Rule, it is anyone under 13. We apply the stricter standard wherever it applies.
- We do not track children's behaviour for advertising or profiling.
- We do not show third-party ads to children.
- Purchases, sign-in, settings and data deletion sit behind a parental gate.
- If we learn we collected a child's data without valid consent, we delete it promptly.
When you add other family members (for example a grandparent), you confirm you have their permission, or their guardian's, to use their name in stories.
5. How we use information
| Purpose | Legal basis (DPDP / GDPR) |
|---|---|
| Create and manage your account and child profiles | Consent; contract |
| Generate, narrate, save and replay personalized stories | Consent; contract |
| Apply safety filters and your "avoid" settings to every story | Consent; legitimate use for child safety |
| Process subscriptions and enforce plan limits | Contract |
| Keep the Service secure, prevent abuse and fix bugs | Legitimate use |
| Measure aggregate usage to improve the library and features | Consent; legitimate interest |
| Send service messages (e.g. "your story is ready", policy changes) | Contract |
| Send marketing to parents, only if you opt in | Consent |
| Comply with law and respond to lawful requests | Legal obligation |
6. AI story generation
To create a personalized story, we send your selected story settings and cast names to our AI and text-to-speech providers. We send only what the story needs, not your email or account ID.
- Every story is checked by automated safety classifiers. A small sample is reviewed by trained human reviewers to improve safety.
- Our contracts with AI providers prohibit them from using your inputs or stories to train their own models.
- We do not use children's names or personal inputs to train our own models without separate, explicit parental consent.
- AI output can occasionally be imperfect. Please tell us through support@piplistories.com if a story seems inappropriate.
7. How we share information
We never sell or rent personal data. We share it only with:
- Service providers that host, store, generate, narrate, analyse or secure the Service (for example cloud hosting, AI and text-to-speech providers, crash reporting, email). They act on our instructions under written contracts.
- App stores and payment processors to handle subscriptions.
- Authorities, when required by law or to protect a child's safety.
- A successor business, if Pipli Stories is merged or sold, under the same privacy protections and with notice to you.
Stories are private to your account. They are only shared if you choose to share them.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account, child profiles, family cast | Until you delete them or close your account |
| Generated stories and audio | Until you delete them, or the account is closed |
| Guest ID and free-play count | Until the app is uninstalled or you sign in |
| Usage and crash logs | Up to 12 months, then deleted or anonymized |
| Purchase records | As long as tax and accounting law requires |
| Backups | Purged within 30 days of deletion |
If an account is inactive for 24 months, we may delete it after notifying you.
9. Security
We encrypt data in transit (TLS) and at rest, restrict staff access on a need-to-know basis, and log access to production systems. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India.
10. Where data is processed
Pipli Stories is based in India and stores data on secure cloud servers, which may be located in India or other countries. Some providers may process data in other countries. We transfer data only where permitted by law and under contracts that protect it to the standard in this policy.
11. Your rights and choices
Depending on where you live, you and your child have the right to:
- Access the personal data we hold and how we use it.
- Correct inaccurate or incomplete data.
- Delete a child's profile, cast entries and every story featuring them, or your whole account. You can do this in Profile → Settings → Privacy, on the web at our account deletion page, or by contacting us.
- Withdraw consent at any time. This stops future processing but does not undo past lawful processing.
- Refuse further collection from your child while keeping existing stories (COPPA).
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP Act).
- Data portability and objection where GDPR or similar laws apply.
- Know, delete and opt out of sale or sharing under California law. We do not sell or share data for cross-context advertising.
We reply within 30 days, or sooner where the law requires. We may need to verify that you are the account holder. We will not treat you differently for exercising your rights.
If you are not satisfied, you may complain to the Data Protection Board of India, the US Federal Trade Commission, or your local data protection authority.
12. Changes to this policy
We will post updates here and change the "Last updated" date. For material changes, especially any affecting children's data, we will notify you in the app or by email and ask for fresh consent where required.
13. Contact and grievance officer
- Grievance Officer / Data Protection Officer: privacy@piplistories.com, 17th Cross, HSR Layout, Bengaluru, Karnataka 560102, India
- General privacy questions: privacy@piplistories.com
We acknowledge grievances within 48 hours and resolve them within 30 days.