Privacy policy

Last updated 27 September 2026. Anyone can browse and preview three pages. Adult accounts open complete stories.

Accounts

We store an adult account’s name, email address, optional username, password hash if used, sign-in provider IDs, passkey public keys, account creation date, and adult declaration date. A secure sign-in cookie can remember the account for 30 days. Email verification and password recovery use one-time links sent from our VPS mail relay.

Adults can download or delete their account from the account menu. For account support and verified privacy requests, the operator can use a passkey-protected admin workspace to view contact and sign-in details, end sessions, download an account record, or delete an account. The workspace does not display password hashes, private keys, session tokens, or reading activity.

On your device

Reading settings, saved stories, and reading progress remain in your browser’s local storage. Browser site-data controls can clear them.

Cookie choices and analytics

Optional first-party analytics use similar browser storage only if allowed. They record visits, stories and pages opened, reading level, appearance, device and browser category, setting changes, and time in a book when it closes. Events are retained for up to 90 days without your name, email address, full IP address, or full browser user-agent string. Analytics are not linked to account records. The interactive Privacy page lets you change your choice.

Children and contact

Accounts are for adults. WonderTales test accounts can save a first name or nickname, illustrated appearance and book editions privately to the adult account on our server. No exact date of birth or child photograph is requested. Account export and deletion include these records. Personalised names and book reading are excluded from optional analytics. For privacy questions or requests, email accounts@talewillow.com.