Privacy Policy

1. Introduction

Welcome to SleighTalk ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"). SleighTalk is a voice conversation application designed for children ages 3-12 to speak with an AI-powered "Santa Claus" character.

2. Information We Collect

Parent Account Information

• Email address: For account creation and communication
• Display name: Optional, for personalization
• Payment information: Processed securely through Stripe (we never store credit card details)

Child Profile Information

• First name only: Used in conversations with Santa
• Age: To ensure age-appropriate interactions (3-12 years old)
• Interests: Optional, to personalize conversations
• Avatar (optional): Photo stored encrypted in Firebase Storage, never shared

Voice Data

• Voice recordings: Processed in real-time by ElevenLabs for conversation
• NOT STORED PERMANENTLY: Voice data is immediately discarded after processing
• Transcripts: Text summaries stored temporarily (24 hours) for wish list creation

3. How We Use Your Information

• Provide voice conversations between your child and Santa
• Generate personalized wish lists from conversation content
• Provide parent dashboard with conversation summaries
• Enforce daily usage limits and safety controls
• Process subscription payments
• Send important account notifications
• Improve app quality and safety features

4. Data Sharing and Third-Party Services

Third-Party Services

We use the following services to provide our app:

• Stripe: Payment processing (no child data shared)
• OpenAI: Voice transcription and conversation AI (no permanent storage)
• ElevenLabs: Voice synthesis for Santa's voice (no child data shared)
• Firebase (Google Cloud): Authentication, Firestore, and secure storage for optional avatars (encrypted at rest and in transit)
• Sentry: Error and crash reporting (no child-identifiable data shared, used only for app stability monitoring)

We NEVER:

• Sell your child's information
• Share child data for advertising purposes
• Allow third-party tracking or analytics of children
• Store voice recordings permanently

5. Children's Privacy (COPPA Compliance)

Parental Consent

We obtain verifiable parental consent before collecting any personal information from children under 13. Parents must:

• Create a parent account using their email address
• Explicitly consent to their child's use of the Service
• Review this Privacy Policy before creating child profiles

Minimal Data Collection

We collect only the minimum information necessary:

• Child's first name (for personalization)
• Age (to ensure age-appropriate content)
• Interests (optional, for conversation topics)
• Avatar (optional, stored encrypted)

Parental Rights

Parents can at any time:

• Review all data collected about their child
• Request deletion of their child's data
• Refuse further collection of their child's information
• Delete child profiles and all associated data
• Review conversation summaries and wish lists

6. Data Retention and Deletion

• Voice recordings: NEVER stored (processed in real-time only)
• Conversation transcripts: Automatically deleted after 24 hours
• Wish list items: Stored until manually deleted by parent
• Child profiles: Deleted immediately when parent removes them
• Parent accounts: Deleted within 30 days of account deletion request

7. Security Measures

• End-to-end encryption for all data transmission
• Encrypted storage in Firebase (AES-256)
• Secure authentication via Google Sign-In
• Regular security audits and penetration testing
• Strict access controls (only authorized personnel)
• Real-time content moderation using OpenAI

8. Your Privacy Rights

Access and Control

• Access all data we have collected
• Request data export (in JSON format)
• Correct inaccurate information
• Delete your account and all associated data
• Opt-out of marketing communications

California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we never sell data)
• Right to non-discrimination for exercising privacy rights

9. International Users (GDPR Compliance)

For users in the European Economic Area:

• Legal basis: Parental consent for children; contract for parents
• Data transfers: We use Firebase (Google Cloud) with adequate safeguards
• Additional rights: Data portability, right to object, right to restrict processing

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Email notification to your registered email address
• In-app notification
• Updating the "Last Updated" date at the top of this policy

11. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

• Email: info@sleightalk.com
• COPPA inquiries: info@sleightalk.com
• Support: help@sleightalk.com