Privacy Policy

Last updated August 4, 2026

Protecting children's privacy and complying with COPPA is our top priority.

Effective January 15, 2025.

1. Introduction

Welcome to SleighTalk ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"). SleighTalk is a voice conversation application designed for children ages 3-12 to speak with an AI-powered "Santa Claus" character.

2. Information We Collect

Parent Account Information

• Email address: For account creation and communication
• Display name: Optional, for personalization
• Payment information: Handled entirely by Apple as an in-app purchase. We never see or store your card details

Child Profile Information

• First name only: Used in conversations with Santa
• Age: To ensure age-appropriate interactions (3-12 years old)
• Interests: Optional, to personalize conversations
• Avatar (optional): Photo stored encrypted in Firebase Storage, never shared

Voice Data

• Voice recordings: Processed in real-time by ElevenLabs for conversation
• NOT STORED PERMANENTLY: Voice data is immediately discarded after processing
• Transcripts: Text transcripts stored for 30 days by default (parent-adjustable from 0 to 90 days) so parents can review conversations and so we can build the wish list

3. How We Use Your Information

• Provide voice conversations between your child and Santa
• Generate personalized wish lists from conversation content
• Provide parent dashboard with conversation summaries
• Enforce daily usage limits and safety controls
• Process subscription payments
• Send important account notifications
• Improve app quality and safety features

4. Data Sharing and Third-Party Services

Third-Party Services

We use the following services to provide our app:

• Apple App Store: Payment processing for in-app purchases (no child data shared)
• OpenAI: Voice transcription and conversation AI (no permanent storage)
• ElevenLabs: Voice synthesis for Santa's voice (no child data shared)
• Firebase (Google Cloud): Authentication, Firestore, and secure storage for optional avatars (encrypted at rest and in transit)
• RevenueCat: Subscription management and App Store receipt validation (no child data shared, used only for parent subscription processing)
• Google reCAPTCHA and Firebase App Check: Abuse and fraud protection on our website and app. reCAPTCHA collects device and browser signals to tell humans from bots, and is subject to Google's privacy policy
• Google Fonts: Typefaces on our website are served by Google, which receives the requesting browser's IP address

We NEVER:

• Sell your child's information
• Share child data for advertising purposes
• Allow third-party tracking or analytics of children
• Store voice recordings permanently

5. Children's Privacy (COPPA Compliance)

Parental Consent

Parental consent is built into how SleighTalk accounts work: children cannot create accounts. Before any child can use the Service, a parent must:

• Create the account themselves, signing in with their own Google or Apple ID
• Accept the Terms of Service and this Privacy Policy during signup -- we record that acceptance with a timestamp and the version accepted
• Create each child's profile themselves, choosing what information to provide

Minimal Data Collection

We collect only the minimum information necessary:

• Child's first name (for personalization)
• Age (to ensure age-appropriate content)
• Interests (optional, for conversation topics)
• Avatar (optional, stored encrypted)

Parental Rights

Parents can at any time:

• Review all data collected about their child
• Request deletion of their child's data
• Refuse further collection of their child's information
• Delete child profiles and all associated data
• Review conversation summaries and wish lists

6. Data Retention and Deletion

• Voice audio: Not stored by default -- audio is processed in real time by our voice provider (ElevenLabs). A parent can explicitly enable call recording in settings, and only then are recordings kept
• Conversation transcripts: Deleted automatically after 30 days by default. Parents can set this to anything from 0 days to 90 days in the app's Privacy settings. Our automated cleanup runs every few days, so a transcript is removed within about 3 days of reaching its deadline
• Safety events: Records of flagged content are retained for safety and compliance purposes
• Wish list items: Stored until manually deleted by parent
• Child profiles: Deleted immediately when parent removes them
• Parent accounts: Deleted within 30 days of account deletion request

7. Security Measures

• TLS encryption for all data in transit
• Encryption at rest for data stored in Firebase
• Secure authentication via Google Sign-In and Apple Sign-In
• Server-side Firestore security rules scoping every read to the requesting parent
• Strict access controls (only authorized personnel)
• Real-time content moderation using OpenAI

8. Your Privacy Rights

Access and Control

• Access all data we have collected
• Request data export (in JSON format)
• Correct inaccurate information
• Delete your account and all associated data
• Opt-out of marketing communications

California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we never sell data)
• Right to non-discrimination for exercising privacy rights

9. International Users (GDPR Compliance)

For users in the European Economic Area:

• Legal basis: Parental consent for children; contract for parents
• Data transfers: We use Firebase (Google Cloud) with adequate safeguards
• Additional rights: Data portability, right to object, right to restrict processing

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Email notification to your registered email address
• In-app notification
• Updating the "Last Updated" date at the top of this policy

11. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

• Email: help@sleightalk.com
• COPPA inquiries: help@sleightalk.com
• Support: help@sleightalk.com