Privacy Policy

The Short Version

• You (the parent or guardian) give us your child's first name, age, how their hero should look, a description of what they are going through, your email and, if you choose, a photo. We use it to write and illustrate their book, and for nothing else.
• The story and pictures are made with AI. To do that we send your child's details to AI, hosting, email and printing companies that help us (listed below). We do not sell your information, and we do not show ads on our site.
• We use analytics and a bot check that see some information about your visit. If you say yes on our banner, we also use a Meta (Facebook) pixel to see which of our ads work. It never receives your child's name, their story or your email.
• You can ask to see, correct or delete your information at any time by emailing edwin@tinyheroes.co.

Who We Are

TinyHeroes (tinyheroes.co) is a personalized children's storybook service operated by Edwin Bazerji (TinyHeroes), Quebec, Canada. We make illustrated stories, written and drawn with AI, about the big feelings and changes in a child's life. Edwin Bazerji is the person responsible for the protection of personal information at TinyHeroes. You can reach him at edwin@tinyheroes.co. We follow Quebec's Act respecting the protection of personal information in the private sector (as updated by Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Children's Privacy

TinyHeroes is for parents and guardians. Children do not create accounts, do not fill in forms, and we do not ask children for information. A parent or guardian types in everything we know about the child.

• By giving us your child's details, you confirm that you are their parent or legal guardian and that you agree to our use of those details as described here, on your child's behalf.
• Under Quebec law, information about a child under 14 is collected with the consent of a parent or guardian, which is you. For families in the United States: we do not knowingly collect personal information directly from children under 13 (the US Children's Online Privacy Protection Act, COPPA). If you believe a child has sent us information, email edwin@tinyheroes.co and we will delete it.
• We only ask for a child's first name and age (3 to 10), how their hero should look, a description of their situation, and, if you choose, a photo. We do not ask for a child's last name, address, school or birth date.
• We do not use children's information for advertising, and we do not build advertising profiles.
• What you write about your child's situation can be sensitive (for example bullying, fears or family changes). We treat it that way: it is used to make the book and to keep your child safe (see "Safety checks" below), not for anything else.

What We Collect

What you give us

• Your email address. It is required to see your free story preview: we send the preview and the finished book there. We also ask for it if you join our email list, sign in or buy.
• About your child: first name, age, and the situation you describe, including your answers to our follow-up questions and any changes you ask for on the preview. Also how the hero should look: your answers about hair colour and style, glasses, skin tone and whether the hero is a boy or a girl, or a hero you pick or describe.
• An optional photo of your child. If you choose "Upload Photo" (JPG, PNG or WEBP, up to 4 MB), we use it only so the illustrated hero looks like your child. We show you a first picture of the hero made from it before we ask for your email. See "Photos" below.
• Payment details. Payments are handled by Stripe. Your card number goes to Stripe, never to us. We receive the payment status, amount, and Stripe reference and receipt links.
• Delivery details for printed books. For hardcover orders, Stripe's checkout asks for the recipient's name, shipping address and a phone number (printers and couriers often need one) and passes them to us.
• Grandma's address. If you buy the "second copy for Grandma" add-on, we ask you by email, after checkout, for the name and address it should be sent to.
• Referrals. If you share your referral link and a friend buys, we record that your code was used, the friend's email and order, and a one-way fingerprint made from the payment and country (not your IP address), so we can check the program rules.
• Your answers after you buy (optional). After payment we ask a few questions you can skip: who the book is for, the occasion, where you heard about us, what almost stopped you, why now, your child's birth month (the month only, never the day), and whether something big is coming up (a new baby, a new school, moving, the dentist or doctor). We keep the answers with your order to understand our customers and, for the birth month and the next big moment, so we may suggest a new story at the right time (only if you haven't unsubscribed). We never send them to Meta or any other advertising or analytics company. They are kept with the order; ask us at any time to delete them.
• Feedback and support. What you tell us if something is not right with a book, or when you email us. After delivery we ask "How did your child like their book?": we keep your answer, what you ask us to fix, and any review you write on our page (we quote it only if you tick the box). These stay with your order and are never sent to Meta or any advertising company.
• Account data. If you sign in, we store your email address and a sign-in record. You can sign in with an emailed code, with Google or with Apple. If you use Google or Apple, they tell us your email address.

What we collect automatically

• Analytics. We use Vercel Web Analytics and Vercel Speed Insights, which record which pages are visited, basic device and browser information, and how fast pages load. We also record steps in the story-creation and checkout journey (for example "started", "reached the preview", "began checkout", "paid") along with a random visitor ID kept in your browser and our order number. These events never include your email or your child's name, and the address of a custom book (which contains your child's first name) is shortened before it is sent. These events are kept by Vercel and in our own database.
• Bot check. Before generating a preview we run Cloudflare Turnstile to tell people from bots. Cloudflare sees your IP address and some browser signals to do this.
• Fonts. Our pages load fonts from Google Fonts, so Google receives your IP address when a page loads.
• Technical data. Our server briefly uses your IP address to limit abuse (for example, too many requests in a minute) and keeps error logs.
• Ad measurement, only if you agree. See "Cookies, Ad Measurement and Browser Storage" below.
• Browser storage. See the same section.

What we create for you

Your child's story text, illustrations and, when included, narration audio, and the files we send to the printer. If you upload a photo, we also create a short written description of your child's face (hair, eyes, face shape and similar) so every page draws the same child.

If you buy through Etsy

If you order from our Etsy shop, Etsy gives us your email, shipping address and the personalization text you entered, so we can make and ship your book. Etsy's own privacy policy applies to what you give Etsy.

How We Use Your Information

• To write, illustrate, check and deliver your child's book.
• To take payment, print and ship books, and handle refunds.
• To email you about your order: preview and story-ready notices, receipts, shipping updates, and a short check-in a couple of days after your book is ready.
• To run the referral program and promotional codes, and to prevent abuse of them.
• To keep children safe: we screen what parents write (see "Safety checks").
• To support you, fix problems, and understand how people use the site so we can improve it.
• To send marketing email, as described in "Marketing Emails and Order Emails" (with your consent, or where the law allows, based on your recent dealings with us).

We do not sell or rent your personal information, and we do not use it for third-party advertising. With your consent, we tell Meta that a visit, a preview request or a purchase happened, so we can measure our own ads (see "Cookies, Ad Measurement and Browser Storage").

Safety Checks and Human Review

Before we draw anything, an automated check reads what you wrote about your child's situation. If it suggests a child may be at risk, we stop, show you support resources instead of a story, and send the text to Edwin so that nobody is turned away unseen. Edwin may also read a book, including your child's name, your description and the pictures, before it is released to you, especially printed books. That is part of how we make sure every book is appropriate.

Photos

• If you upload a photo of your child, we use it only to draw your child's character for their book. It is sent to Google's AI (Vertex AI) to draw your child as a storybook hero and to check that the pictures look like them. It is not used to identify anyone, and we do not use it for anything else.
• The photo and the written description of your child's face are kept on our private server storage, not on the public picture network that serves finished books, so we can redraw a page if one needs fixing.
• If you never buy: a photo from a preview that is never paid for is deleted automatically 30 days after the preview.
• If you buy: the photo and face description are kept as long as your book's files are kept. Your book stays available in your library, and we do not have a fixed end date for it, so they are kept until you ask us to delete them. You can ask us to delete your photo at any time at edwin@tinyheroes.co.

Who We Share Information With

We use these companies to run TinyHeroes. Each receives only what it needs for its job, and they may process it in other countries (see "Where your information is stored").

• Google Cloud (Vertex AI / Gemini): writes parts of the story, screens text for safety, draws the pictures and checks them. Receives your child's first name and age, your situation text, your photo if you upload one, and the pictures. Under Google's terms for this service, our content is not used to train Google's models. See Google's Privacy Policy.
• Anthropic (Claude): may edit the story's narration (we use it when it is switched on in our pipeline). Receives the story text and a short summary of the situation. We use a placeholder instead of your child's name wherever the book allows it, but if you type the name into your own description it may be included. See Anthropic's Privacy Policy.
• ElevenLabs: may turn the story into narrator audio, when audio is switched on in our pipeline. Receives the story text with your child's first name filled in. See ElevenLabs' Privacy Policy.
• Cloudflare: stores and delivers your book's pictures and audio (R2 and its content network) and runs the Turnstile bot check. See Cloudflare's Privacy Policy.
• Render: runs our server and its storage, where orders, previews, uploaded photos and email-list records are kept. See Render's Privacy Policy.
• Vercel: hosts the website and provides analytics and speed measurement. See Vercel's Privacy Policy.
• Supabase: accounts and sign-in, and our records of orders (email, order and book IDs, tier, payment status and amount, Stripe references), referral codes, journey events and support cases. See Supabase's Privacy Policy.
• Stripe: takes payments and collects shipping details for printed books, and issues refunds. See Stripe's Privacy Policy. We pass it your email and your child's first name (as order information).
• Resend: sends our emails. Receives your email address and the content of each message, which includes your child's first name. See Resend's Privacy Policy.
• Lulu and Gelato: print and ship hardcover books. We use Lulu for addresses in the United States and Gelato for the other countries we ship to. They receive the recipient's name, address, phone number and email, and the print-ready book (which contains your child's name and the pictures). Delivery companies they use then see the name and address. Lulu and Gelato each have their own privacy policy.
• Google Fonts: supplies the fonts our pages use.
• Meta (Facebook), only if you agree: receives that a page was viewed, that a preview was requested, that checkout started or that a purchase was made (with its amount in Canadian dollars and our order number), along with the page address (with any child's name removed), the ad-measurement cookie ids described below, and, like any website, your IP address and browser type. It never receives your email, your child's name, their photo or what you wrote about their situation. See Meta's Privacy Policy.

We may also share information if the law requires it, to protect someone's safety or our rights, or if TinyHeroes is sold or merged (in which case this policy would continue to protect your information).

Where Your Information Is Stored

Our server runs in Oregon, in the United States. Most of the companies above are based in, or process information in, the United States, and some may use servers in other countries. Our content network is global. This means your information, including your child's, may be stored and processed outside Quebec and outside Canada, where privacy laws may differ from Quebec's. If you are not comfortable with that, please do not use the service, or write to us first.

Marketing Emails and Order Emails

We send marketing email in two ways, depending on our relationship with you:

• With your express consent. Our welcome series (a short series of emails over about two weeks, which includes a discount code) is sent only if you ticked the "send me tips & offers" box when you started a story, or signed up through our email pop-up. Entering your email to see a preview is not, by itself, a request for the welcome series.
• Without a box, where Canadian anti-spam law allows it (implied consent). If you made a preview in the last 6 months, we may send one reminder that it is still saved, about a day later. (The email telling you your preview is ready, or that we couldn't finish it, is not marketing: you asked for it.) If you bought from us in the last 2 years, we may send an offer for a sibling's book or your next book.

Every marketing email has an unsubscribe link and our mailing address. Unsubscribing stops all of them straight away, including any already scheduled. You can also withdraw your consent by writing to edwin@tinyheroes.co.

Order emails are always sent. We email you about an order you placed or a preview you asked for (your preview or book is ready, we couldn't finish your preview, receipts, shipping updates, support replies, and a short check-in a couple of days after your book is ready), because you need them. Unsubscribing from marketing does not stop these.

Your Book's Link

Your finished book is shown at a web address that includes a reference to your child's first name and the story's topic. The pictures are stored on a public content network. We do not list custom books publicly, but anyone who has the exact link may be able to open them. Please share it only with people you trust, and write to us if a link has been shared by mistake and you want it disabled.

How Long We Keep Information

We keep information for as long as we need it for the purposes above, then we delete it or anonymize it. In practice:

• Orders, payment references and receipts are kept for as long as the law requires us to keep business and tax records.
• Books and their pictures stay available to you so you can read and download them again.
• Photos from previews that are never paid for are deleted automatically 30 days after the preview. Photos and face descriptions for paid books are kept as long as the book's files are kept, and deleted on request.
• Preview data and email-list records are kept until we delete them. We do not yet run an automatic deletion timer for them, so please ask us if you want something removed sooner.
• Unsubscribing keeps your email on a do-not-email list, so we remember not to write to you again.
• Data held by the companies above follows their own retention rules.

Security

We use secure connections (HTTPS), restrict who can open our admin tools, and choose providers with security measures of their own. Still, no system is perfectly secure. If something happens that puts your information at serious risk, we will tell you and the privacy regulators as the law requires.

Your Rights

Under Quebec and Canadian privacy law (and, where they apply, laws where you live), you can ask us to:

• tell you what personal information we hold about you and your child;
• correct information that is wrong or out of date;
• delete your information, or your child's photo and details;
• give you a copy of your information in a common electronic format; and
• withdraw a consent you gave us, for example to marketing email.

To ask, email edwin@tinyheroes.co from the address you used with us (so we know it is you). We will answer within 30 days. We may need to keep some records (for example, a paid order) because the law requires it, and deleting a book's information may mean we can no longer re-send or fix it. Signing out or clearing your browser does not delete anything on our side. We do not currently have a self-service "delete my account" button, so please email us.

If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

Changes to This Policy

We may update this policy as the service changes. We will post the new version here with a new date, and if a change is significant we will email you or put a notice on the site.

Contact

For privacy questions, access, correction or deletion requests, email edwin@tinyheroes.co.