NightNight – Privacy Policy

For parents, guardians, and users of the NightNight app

Tobias Munk, sole proprietor (Switzerland)

Effective 17 April 2026

NightNight — Privacy Policy

Effective date: 17 April 2026 Last updated: 17 April 2026 Version: 1.2

1. Introduction

NightNight (“NightNight”, “the app”, “we”, “us”, or “our”) is a mobile application for iOS that creates personalised bedtime stories for children aged 3 to 11, using artificial intelligence to write the text and to narrate it with character voices and ambient sound. Stories are available in English and German at launch, with more languages planned. NightNight is designed to be operated by a parent or legal guardian; children are only intended as listeners, not as app users.

Protecting children’s privacy — and the privacy of the wider family members a parent may mention when creating a story — is central to how NightNight is built. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the rights you and your family have. It is written to comply with:

the EU General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“FADP”);

the UK General Data Protection Regulation (“UK GDPR”), the UK Data Protection Act 2018, and the ICO’s Age Appropriate Design Code (the “Children’s Code”);

the United States Children’s Online Privacy Protection Act (“COPPA”) and, for California residents, the California Consumer Privacy Act / California Privacy Rights Act (“CCPA/CPRA”); and

Apple’s App Store Review Guidelines, including the Kids Category standards.

If anything in this policy is unclear, please email tobias.munk@night-night.app before using the app.

2. Plain-language summary

We know privacy policies are long. Here is the short version so you know the essentials before you read further:

NightNight is made and operated by Tobias Munk personally, from Switzerland. You can reach us at tobias.munk@night-night.app.

We collect the minimum information needed to let a parent sign in, create stories, share them with close family, and manage their account.

For each child (called a Protagonist in the app) we store a first name, gender, and the child’s favourite things (colours, foods, animals — including pet names if you enter them — activities, stories, and an optional “anything else” note). We never ask for, store, or infer a child’s age, date of birth, birth month, or birth year. Story complexity is chosen by the parent per story, not tied to a stored age.

Parents may optionally add household context (other family members, friends, pets, recent life events, notes for the storyteller) to make stories more personal. You confirm at the point of entry that you have the relevant permissions — see section 9.

We do not show advertising, we do not track your child across other apps or websites, and we do not sell or share personal information for cross-context behavioural advertising.

Story generation uses AI services from Anthropic (Claude) for the text and ElevenLabs for voice narration and sound effects. OpenAI is used for sound-effect verification and text embeddings and does not receive personal data. We take steps to ensure these providers do not train on your data.

Your account data and stories are stored in the European Union (AWS Frankfurt, Germany).

You can export or delete your account and all associated Protagonist and household data at any time from inside the app. Published community stories may survive in an anonymised form owned by NightNight, but all versions containing your or your children’s names are destroyed. See section 11 for details.

Important if you choose to publish a story to the community library: the version that appears in the community library is always anonymised — it uses NightNight’s default character names, never your child’s first name. Your personalised audio (with your child’s first name) stays on your account. Other families will see the anonymised version and, if they clone it, they will hear their own family’s names, not yours.

3. Who is the controller of your personal data?

The data controller is:

Tobias Munk, sole proprietor trading as NightNight Postfach, 6318 Walchwil, Switzerland Email: tobias.munk@night-night.app

As a Swiss-based controller we are the point of contact for all privacy matters. Because NightNight operates as a sole proprietorship at the date of this policy, you are contracting and dealing with Tobias Munk personally. If this changes (for example, following incorporation into a Swiss GmbH), this policy will be updated and the new controller clearly identified.

For EU/EEA data subjects, our Article 27 GDPR representative (once appointed; see section 15.1) is the contact point in the European Union. For UK data subjects, Article 27 UK GDPR matters may also be addressed to Tobias Munk directly until a dedicated UK representative is appointed.

4. What information we collect

We collect only the information we need. The sections below describe every category of personal data that NightNight processes.

4.1 Information you provide directly

We deliberately do not collect: a child’s age, date of birth, birth month, birth year, last name, school, home address, photograph, voice recording, precise location, contact list, calendar, or biometric identifier.

4.2 Information we generate when you use the app

We do not use third-party advertising networks, we do not build cross-app advertising profiles, and we do not use any SDK that collects device identifiers for advertising purposes (no IDFA collection).

4.3 How Protagonist and household information is used by AI services

When you ask NightNight to create a story, the personalisation fields you provide are sent to our AI sub-processors to create the story text and narration:

Anthropic (Claude) receives: plot instructions, the Protagonist’s first name, and the household context you have chosen to include (family members’ nicknames/roles, friends, pets, recent life events, and notes for the storyteller). Claude does not receive: your surname, your email, your child’s age, your address, your device identifiers, or payment information.

ElevenLabs receives: the generated story text (which at this stage resolves the name placeholders into real first names so the narrator can speak them) and voice-configuration parameters. ElevenLabs does not receive other account, device, or billing data.

OpenAI receives sound descriptions and text embeddings used for verifying and matching ambient sound effects. OpenAI does not receive first names, household data, account identifiers, or any other personal data.

See section 7 for the sub-processors involved and section 8 for international-transfer safeguards. See section 6 for more on the AI architecture.

4.4 Information we do not collect

To be explicit, NightNight does not collect or process:

A child’s age, date of birth, birth month, birth year, surname, home address, school, photo, or voice recording;

Microphone input or camera input from the user’s device;

Precise GPS or continuous location;

Contact lists, calendars, photo libraries, or health data;

Biometric identifiers (face, voice print, fingerprint);

Payment-card or bank-account data (Apple handles this; we never see your card number);

The email address of a person to whom you send a story-share invitation after the invitation email has been dispatched — see §11 for the sharing flow.

5. Why we use your data and the lawful basis

Under GDPR and UK GDPR we must tell you our legal basis for each processing purpose.

We do not use personal data for marketing without your separate, explicit opt-in. At the date of this policy NightNight sends only service/transactional email (password resets, receipts, invitation delivery, support replies). If we ever introduce optional marketing email, we will ask for a separate opt-in consistent with GDPR Article 6(1)(a) and the ePrivacy Directive.

Where the information you enter relates to a child below the relevant digital-consent age (16 in most EU states, 13 in the UK and under COPPA), we rely on parental consent combined with contract performance, as explained in sections 9 and 10.

6. How the app uses artificial intelligence

NightNight is an AI-powered app. All stories are generated automatically — no human reads or listens to your prompts in the ordinary course of using the app. The generation pipeline is:

Text generation (Anthropic / Claude): a four-stage prompting chain turns your plot inputs, Protagonist name, and household context into a story. Real names are represented as placeholder tokens (e.g. [CHILD]) at the text layer so that the stored text can be re-used for other families without exposing your child’s name.

Voice narration (ElevenLabs): the story text is rendered into audio using a fixed set of pre-selected voices. Name placeholders are resolved into real first names only at narration time. No voice cloning takes place and no microphone input from you or your child is ever captured or transmitted.

Sound effects (ElevenLabs for generation; OpenAI for verification): ambient sound descriptions are produced and matched to suitable effects. This step uses only the sound descriptions — no personal data is sent to the sound-effects pipeline.

Characteristics of our AI use:

We enable each provider’s zero-retention / no-training settings where such settings are available, so your content is not used to train their models.

AI-generated content can occasionally be inaccurate, unexpected, or unsuitable. An adult should preview a story if the theme warrants it. If you see a problem, email us at tobias.munk@night-night.app so we can investigate.

NightNight does not take automated decisions with legal or similarly significant effects about you or your child.

7. Who we share data with (sub-processors)

We share personal data only with the service providers below, each of which acts as our processor on our behalf under a written data-processing agreement. We do not sell personal data and we do not share personal data with third parties for their own marketing or advertising purposes.

We maintain an up-to-date list of sub-processors. If you email us we will confirm the current list. When we add or replace a sub-processor we will update this section before the change takes effect.

8. International transfers

Your personal data is primarily stored within the European Union (AWS Frankfurt) or within Switzerland. Some sub-processors are based in the United States. For each such transfer we rely on one or more of the following:

the European Commission’s Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum;

the Swiss Federal Data Protection and Information Commissioner’s approved SCCs for Swiss-origin data;

the EU–US, UK, and Swiss–US Data Privacy Framework self-certifications, where applicable;

a documented transfer impact assessment for each sub-processor.

If you would like a copy of the SCCs or our transfer impact assessment, email us.

9. Children’s privacy, household data, and information about third parties

NightNight is not directed at children: it is designed to be operated by a parent or legal guardian. Children are listeners, not users. Despite the parent-facing design, the app is built to comply with the strictest applicable children’s-privacy rules.

9.1 Creating a Protagonist

A Protagonist is the app’s term for a child profile. Creating a Protagonist is gated behind an active paid subscription via Apple. Starting an Apple subscription requires a credit or debit card on file with Apple, which the US Federal Trade Commission treats as evidence of verifiable parental consent under COPPA and which gives us independent evidence in the EU, UK, and Switzerland that an adult is responsible for the account.

For each Protagonist you provide: first name, gender, and favourites (colours, foods, animals/pet name, activities, stories, “anything else”). NightNight does not ask for or store the age, date of birth, birth month, or birth year of a child. Story complexity is chosen by the parent on a per-story basis.

9.2 Household context and information about third parties

You may optionally add household information — other parents and caregivers, grandparents, aunts and uncles, friends, pets, recent family events, and notes for the storyteller — so that stories feel more personal.

When you add information about another person (whether an adult family member or someone else’s child), you are processing that person’s personal data. By entering such information you confirm that:

you have permission from that person to share their information with NightNight for the purposes of story generation, or — if the person is a child — you have the permission of their parent or guardian;

the information is limited to what is strictly necessary for story personalisation;

you will not enter sensitive information (health, religion, political opinions, sexual orientation, or similar) about any person.

We will honour any request from a third party mentioned in your household data to have their details removed. If a third party emails us (tobias.munk@night-night.app) and asks, we will locate and delete their information from your household data as soon as we can verify the request.

9.3 What we do to protect children

Data minimisation. No age, no date of birth, no last name, no photo, no location, no voice. For each Protagonist, only a first name, a gender, and favourites.

No profiling. We do not build behavioural profiles of children, we do not infer characteristics beyond the fields you enter, and we do not pass child data to advertising networks or analytics providers that use it for profiling.

No advertising. NightNight contains no advertising of any kind.

Closed communications. Children cannot contact other users through the app. Story sharing between families happens only through parent-initiated email invitations (see §11) and through the optional community-library publishing flow.

Parental gate. Access to subscription management, account, settings, and external links is protected by Face ID / Touch ID (or the device passcode if biometrics are unavailable).

Default privacy. Stories are private to your account unless you deliberately publish them to the community library. Sharing a story with a friend requires you to issue an explicit invitation.

Placeholder tokens in stored text. Stored story text never contains a child’s real name; real names are resolved only at audio-rendering time. This means that stored prose never contains a child’s name, and audio that contains a child’s name lives only where it is needed.

A child’s first name never leaves the account that created it — when names are entered in structured fields. When you publish a story to the community library, NightNight generates an anonymised library version of the audio that uses a fixed set of NightNight’s own default character names, maintained by NightNight. Names you entered in structured fields — the Protagonist name, household member names and nicknames, and pet names — are configured as protected names and are substituted with NightNight’s defaults in the library version. Your personalised audio, with your child’s first name, remains on your account and is never distributed to other users.

Important boundary: names typed into free-text fields are not automatically protected. Real names you type into “anything else”, “recent life events”, “notes for the storyteller”, or free-form plot instructions are not registered as protected names and therefore will not necessarily be substituted in the library version. If you may later publish the story, please keep real names out of free-text fields and use the structured fields instead.

9.4 Parental rights

As the parent or guardian of a child whose personal data is processed by NightNight, you can at any time:

review the child’s Protagonist profile, the household context, and the stories generated for them inside the app;

edit or delete the Protagonist in the app;

export your data (section 12);

withdraw consent by deleting the Protagonist or the whole account; and

email us at tobias.munk@night-night.app to raise any concern.

If we learn that a Protagonist was created by someone who is not the parent or legal guardian, or that household information was entered without appropriate permissions, we will delete it as soon as we can verify this.

9.5 COPPA-specific notice (United States)

For users in the United States, NightNight is designed to comply with the COPPA Rule (16 C.F.R. Part 312). In summary:

We do not ask for, collect, or store the age, date of birth, birth month, or birth year of any child. We therefore do not have actual knowledge that any particular user whose information we process is under 13. Because NightNight’s subject matter may appeal to children, we nevertheless treat the service as one that could be directed to children and apply child-appropriate safeguards across the board.

Where we do process information that may relate to a child (first name, gender, favourites, household context, generated stories), we do so only after the adult account holder has started an active paid subscription through Apple. Apple’s credit-card-on-file step provides additional adult-in-charge verification, consistent with the Federal Trade Commission’s guidance on verifiable parental consent.

Parents can review the information we have about their family, request its deletion, refuse further collection, and revoke consent at any time by using the in-app controls or by emailing tobias.munk@night-night.app.

We do not condition a child’s participation in any activity on the provision of more personal information than is reasonably necessary.

The information we process about a child is used only to provide the NightNight service and is shared only with the processors listed in section 7.

9.6 ICO Children’s Code (United Kingdom)

For UK users, NightNight is built around the fifteen standards of the Age Appropriate Design Code, including best-interests-of-the-child, data minimisation, default privacy, no detrimental use of data, and transparency in language a child can understand. Because children do not directly interact with the app, the parent-facing summary in section 2 serves as the child-friendly overview.

10. Parental consent and age of digital consent

Under Article 8 GDPR, information-society services offered directly to a child require parental consent below a certain age (16 in most EU states, lowered to 13, 14, or 15 in some; 13 in the UK; 13 in the United States under COPPA).

NightNight is operated by an adult account holder who agrees to this policy on behalf of any child whose details they enter. Because we never ask for or store the age, date of birth, birth month, or birth year of a child, we do not process age data for which a per-child Article 8 consent would need to be verified. Where information you enter relates to a child in your care, the account holder acts as the parent or guardian providing the contextual consent for that processing. If we learn that an account holder is not an adult, we will delete the account.

11. How long we keep your data, account deletion, and the community library

This is the most technical section of the policy. It matters because NightNight’s community library introduces a “clone-chain” mechanism: published stories may have multiple personalised versions, and our deletion rules are designed so that your data is erased even when other families are still using a story you originally created.

11.1 Retention while your account is active

11.2 Story sharing by email invitation

You may share a story with a friend by issuing an email invitation from inside the app. We generate a share token tied to the story, and AWS SES sends an email to the address you enter with a deep link.

The recipient’s email address is used only to send the invitation email. It is not saved in our database beyond send (“fire-and-forget”).

When the recipient taps the deep link on their iPhone, they automatically claim the story into their own account’s downloads.

Share tokens are one-use and expire after 90 days.

If you delete the story, the token is invalidated immediately.

If you delete your account, all share tokens you issued are deleted.

11.3 Community library — publishing, anonymisation, and the clone chain

When you publish a story to the community library (an explicit, per-story action), NightNight generates an anonymised library version of the story using our own default set of character names, and it is that anonymised version — not your personalised audio — that becomes available to other families in the library.

What becomes audible when you publish. The library version uses only NightNight’s default character names where names were entered in the structured Protagonist, household, and pet fields; your child’s first name does not appear in the library audio for those structured-field substitutions. Stored prose never contained a real name from those fields (it uses placeholder tokens resolved only at render time).

What is and is not automatically anonymised. NightNight maintains an internal configuration that identifies the set of protected name fields — the Protagonist’s first name, household member names and nicknames, and pet names. Names entered in those structured fields are tokenised during generation and substituted with NightNight’s default character names in the anonymised library version. Real names that you type into free-text fields — the “anything else” note, “recent life events”, “notes for the storyteller”, or free-form plot instructions — are not automatically recognised by NightNight as protected names and therefore will not necessarily be substituted in the library version. If you want to publish a story to the library, please keep real names out of free-text fields. If a real name has slipped through into a published story’s library version, email us at tobias.munk@night-night.app and we will remove it.

Other families can then, at their option, clone a library story — which generates a new personalised version rendered with their own child’s first name, from their own account.

Versioning summary:

Your personalised version (private to you). Rendered with your child’s first name. Lives on your account only. Never distributed.

Library (anonymised) version. Rendered with NightNight’s default character names. Distributed to other NightNight users. Owned by NightNight once the story has been published (see section 7.3 of the Terms).

Other families’ clones. Each rendered with their own child’s first name. Lives on their account only. Never distributed back to the library.

What un-publishing does. You can un-publish a story at any time. Un-publishing removes the anonymised library version from the library’s discovery surfaces and prevents new clones from being created. Personalised clones that other families have already created are unaffected; they live on those families’ accounts with their names, not yours. Your own personalised version stays on your account privately, unless you delete it. Because NightNight owns the underlying text after first publication (Terms §7.3), we may continue to keep the anonymised library version available for other families even after you un-publish, but we do not have to.

11.4 What happens when you delete your account

When you delete your account, we run the following deletion process in order:

All private (unpublished) stories on your account are deleted in full — text, audio, and metadata are removed from the database and file storage.

All clones you created of other families’ stories — where your child’s name appears in the audio — are deleted in full. The underlying story text (which uses placeholder tokens) remains only in the original creator’s and any other families’ versions, none of which identify you or your child.

Published clone0 stories where at least one other family has created a clone: your clone0 is deleted. The first existing clone from another family (clone1) is promoted to become the new clone0. The story survives through that other family’s personalised version, which does not contain your or your children’s names.

Published clone0 stories with no clones from other families: we create an anonymised version — the authorship reference is reassigned to “NightNight”, your personalised audio (which contains your child’s name) is deleted, and the underlying story text (which uses only placeholder tokens, not real names) is retained. The story becomes NightNight-owned content. When a listener subsequently plays the story, audio is re-rendered with generic default names.

All remaining personal information is deleted: account credentials, Protagonist profiles, household data, star ratings, download records, share tokens, and support correspondence linked to your account (unless we are required by law to retain some of it, for example subscription and billing records under Swiss accounting law).

End result: no version anywhere in the system contains your or your children’s names after deletion is complete. Published stories that survive after deletion do so only through other families’ personalised versions (in which your child’s name does not appear) or as NightNight-owned content with generic names. Audio files you or others downloaded to a device before deletion remain on those devices; we cannot remotely remove downloaded content from user devices, and those files stop being re-downloadable from our systems once the corresponding version is deleted.

If you prefer to retain your account but remove only a specific story from the community library, you can un-publish it in-app; the original clone0 is retained privately on your account and all clones from other families continue to exist on their accounts.

11.5 Anonymisation note

Step 4 of the deletion flow in §11.4 is designed to produce genuinely anonymised content: the text contains only placeholder tokens, the audio is re-rendered with generic names, and the authorship reference points to NightNight rather than to any user. We do not retain internal links that would allow the anonymised story to be traced back to you. Under Recital 26 GDPR, once data is truly anonymised it falls outside the scope of GDPR.

12. Your rights

You have the following rights in relation to your personal data. Most can be exercised directly from the in-app Privacy & Data screen; all of them can be exercised by emailing tobias.munk@night-night.app.

Access — get a copy of the personal data we hold about you and your household.

Rectification — correct inaccurate or incomplete data.

Erasure / deletion — delete your account and associated Protagonist and household data. The clone-chain mechanism in §11 applies.

Restriction — ask us to stop processing in certain cases.

Objection — object to processing based on legitimate interests.

Portability — receive a machine-readable copy of the data you provided.

Withdraw consent — where processing is based on consent, withdraw it at any time.

Not be subject to solely automated decisions with legal or similarly significant effects — NightNight does not take such decisions.

Complain to a supervisory authority — see section 15.

We respond within one month for EU/UK requests and the statutory period elsewhere. If your request is complex we may extend by up to two months and will tell you why.

If you are a third party whose details appear in another user’s household data, you can write to tobias.munk@night-night.app to ask for your details to be removed. We will act on such requests once we can verify them.

13. Security

We protect your data with measures that are appropriate to the risk, including:

transport encryption (TLS 1.2+) for all data in transit;

encryption at rest for all stored data;

identity and authentication via AWS Cognito (passwords held only as salted hashes; we never see your plaintext password);

principle-of-least-privilege access controls, with multi-factor authentication for the operator;

regular dependency updates and vulnerability scanning;

EU data residency (AWS Frankfurt);

placeholder tokens in stored story text so that stored prose does not contain a child’s real name;

share-token expiry (90 days) and fire-and-forget email invitations that do not persist recipient addresses;

separation of Protagonist/household data from billing data.

No system is completely secure. If we ever discover a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authorities and affected users in line with Articles 33 and 34 GDPR.

14. Cookies and similar technologies

NightNight is a native mobile app and does not use cookies. We use essential local storage on your device (for login session and cached stories). We do not use analytics SDKs that set cross-app identifiers and we do not track you across other apps or websites. The night-night.app website on Vercel serves only the Privacy Policy and Terms as static pages; no behavioural analytics or cookies are enabled.

15. Jurisdiction-specific disclosures

15.1 Users in the European Economic Area and Switzerland

Controller: Tobias Munk, Postfach, 6318 Walchwil, Switzerland. Email tobias.munk@night-night.app.

Lead supervisory authority (Switzerland): the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — https://www.edoeb.admin.ch.

Supervisory authority in your country: you may also lodge a complaint with the data-protection authority of your own EEA member state.

EU representative (Article 27 GDPR): [To be appointed before EU launch — expected to be DataRep, Dublin, Ireland. The representative’s name and address will be inserted here once the mandate is signed.]

Data Protection Officer: not required under Article 37 GDPR for our current processing. You can reach the controller directly at tobias.munk@night-night.app.

15.2 Users in the United Kingdom

Supervisory authority: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — https://ico.org.uk.

UK representative (Article 27 UK GDPR): [To be appointed before UK launch if and when required.]

We comply with the ICO’s Age Appropriate Design Code as described in section 9.

15.3 Users in the United States

COPPA operator: Tobias Munk, as identified above.

Parental rights under COPPA are set out in section 9.5 and may be exercised at any time by emailing tobias.munk@night-night.app.

California (CCPA / CPRA)

Categories of personal information we collected in the last 12 months: identifiers (email, account ID, Apple transaction ID); customer records (parent first name and last name, child first name, child gender, favourites, household context, pet names); internet or other electronic network activity (app usage counters, diagnostic logs); inferences: none. We did not collect any age, date-of-birth, or precise-geolocation data.

Sources: directly from you.

Purposes: as listed in section 5.

Categories disclosed to service providers: the same categories, disclosed only to the sub-processors listed in section 7, under written service-provider terms.

Sale or sharing for cross-context behavioural advertising: No. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under the age of 16.

Consumer rights: right to know, delete, correct, and port; right to limit the use of sensitive personal information. We do not discriminate against you for exercising these rights. Exercise them by emailing tobias.munk@night-night.app.

Authorised agent: you may designate an authorised agent to make requests on your behalf; we will verify the agent’s authority.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Montana, Oregon, Tennessee, and other states with comprehensive privacy laws have similar rights to access, delete, correct, and port their personal information. Email us to exercise them.

16. Changes to this policy

We may update this policy from time to time. When we make a material change, we will:

update the “Last updated” date at the top;

notify you in the app; and, for substantive changes, ask for fresh consent where this is required by law.

The current version is always available inside the app and at the public URL linked from our App Store listing.

17. How to contact us

For any privacy question, rights request, or complaint:

Email: tobias.munk@night-night.app Post: Tobias Munk, Postfach, 6318 Walchwil, Switzerland

We acknowledge within 5 working days and give a substantive answer within the deadlines in section 12.

End of Privacy Policy.