Privacy Policy

This Privacy Policy explains what information Nest & Quill collects, how we use and share it, and the choices you have. Nest & Quill is operated by Digital Official & Huerta Group (“we”, “us”, “our”). This policy covers our website, story creation, accounts, emails and the chat assistant on our website.

Nest & Quill is intended for adults age 18 or older who create personalized books for children. Children are not meant to create accounts or use the Service on their own. Much of the information we handle is about a child, but it is provided by an adult.

Account information

• Your email address and password. Passwords are managed by our authentication provider and are not stored in readable form.
• Account identifiers, account type and sign-in records kept by our authentication provider.
• Your Free-book usage and the plans, purchases and subscription periods available to your account.

Guest information

• If you create a story without an account: the email address you enter, and a guest token stored in your browser and with the story so you can follow it and later add it to an account.

Story personalization information

• The child’s name and age or age range.
• What you tell us about the child, such as personality, interests and appearance.
• Supporting characters you add, such as siblings, friends, relatives or pets, and their relationship to the child.
• Story choices such as theme, tone, setting, challenge, goal, lesson, character traits, illustration style and book length.
• Dedication, author or byline name, closing message and any extra notes you add.
• The language of the story and the adult authorization confirmation described below.

Generated content

• The story text and title, page-by-page scene descriptions, the story plan, and the instructions (prompts) used to create the text and illustrations, together with the AI provider’s responses and technical usage information.
• Illustrations, and PDF versions of books where they are created.
• Each story’s status and delivery history.

Purchase information (when paid plans are offered)

• Records of purchases and subscription periods (plan, amount, currency, dates and status) and identifiers from our payment processor, Stripe. You enter card details on Stripe’s checkout page; we do not receive or store your full card number.

Support and contact information

• When you contact us: your name if you give it, your email address, subject, category, message and any later correspondence.

Chat assistant

• Messages you type into the chat assistant are sent to our AI provider to produce a reply. We do not save chat conversations in our own database.

Email and marketing preferences

• Records of the emails we send you (type, recipient and date) and of any request to stop marketing email.

Operational and security information

• Processing, error, retry and delivery information for stories and emails.
• Rate-limit and abuse-prevention records. When a request is blocked by a rate limit, we may store a shortened one-way hash derived from the network (IP) address, not the address itself.
• Evidence of the adult authorization confirmation: whether it was given, when, and which version of the wording was shown.

We do not store your IP address, or a location derived from it, with your story records. Our hosting and infrastructure providers may process network addresses, device and browser information and request logs as needed to deliver and secure their own services (see “Service Providers” below).

We collect information about a child only from the adult creating the story. Before a story is submitted, that adult must confirm that they are an adult; that they are the child’s parent or legal guardian, or have permission from the child’s parent or legal guardian to provide the information; and that they have permission to provide information about any other people included in the story.

We store that this confirmation was given, when, and which version of the wording was shown. We do not verify the identity or age of the adult or their relationship to the child.

Story creation does not ask for photos, and we do not ask children to give us information directly. Please provide only what the story needs. If you believe a child gave us information directly, or that information was provided without the necessary permission, contact us.

We use information to:

• Create, illustrate, deliver and store your books
• Run accounts, guest stories and plan allowances
• Process purchases and subscriptions when paid plans are offered
• Send service emails and, unless you unsubscribe, marketing emails
• Answer support requests
• Prevent abuse, keep the Service secure and fix problems, which can include our team reviewing story records when needed for support, quality or safety
• Comply with legal obligations and handle disputes

We do not sell your personal information, and we do not use it for third-party advertising.

We use OpenAI to write stories, create illustrations and run the chat assistant. For each task we send OpenAI the information needed for it. For a story, this can include the child’s name, age and description, supporting characters, story choices, dedication and notes you provide. For the chat assistant, it includes the messages you type. We do not include your email address in story-generation requests.

OpenAI processes this information to return results to us, under its own terms and policies. AI-generated content can contain errors or unexpected results, so please review every book before sharing it with a child.

Each finished story has its own web address (a “story link”). Anyone who has the link can read the finished story without signing in and, where a PDF of the book has already been created, may also be able to download it. The link is not password-protected and should not be treated as a private vault.

• Our emails to you include your story link.
• Share the link only with people you want to see the story. Anyone you send it to can forward it to others.
• Archiving a story does not turn off its link. If a link has been shared more widely than you intended, contact us.

Service emails are sent when needed to provide the Service: submission confirmations, story-ready and story-failed notices, welcome and account-confirmation emails, password resets, and billing-related messages when paid plans are offered. Unsubscribing from marketing does not stop service emails.

Marketing emails: after you create a story or an account, we may send a short series of emails with tips, story ideas and offers. Every marketing email includes an unsubscribe link. When you unsubscribe, we keep your email address on a suppression list so we can keep honoring your choice, including if you create another story later.

We use only the cookies and browser storage needed to run the Service or to remember choices you make:

• Sign-in cookies from our authentication provider (Supabase) that keep you signed in.
• guest_token: a cookie that links a guest story to your browser for up to 90 days so you can follow it and add it to an account.
• nq_lang: a cookie and browser-storage entry that remembers your language.
• cookie_consent: browser storage that remembers your answer to the cookie notice.
• Your reading position in each story you read, stored in your browser.
• Your light or dark display preference, stored in your browser.
• Temporary storage in the current browser tab, such as your story answers while you complete checkout and whether you closed a guided tour.

We do not use advertising cookies, tracking pixels, tag managers, session-replay tools or third-party analytics. Some images, such as our logo, load from a content delivery network that receives standard request information.

Because everything listed above is needed for the Service or remembers a choice you made, choosing “Decline” on the cookie notice only records your choice; it does not turn this storage off. You can clear or block cookies and storage in your browser, but signing in, guest stories and saved preferences may then stop working.

We use these providers to run the Service and share with each the information it needs to do its job for us:

• Vercel: hosts our website and application servers and runs scheduled tasks.
• Supabase: database, sign-in, file storage for illustrations and PDFs, and the backend that creates stories.
• OpenAI: AI story text, illustrations and the chat assistant.
• Resend: sends our service and marketing emails.
• Bunny CDN: delivers some website images, such as our logo.
• Cloudflare: domain name services and forwarding of email sent to our contact address.
• Google (Gmail): the mailbox where messages to our contact address are received and answered.
• Stripe: when paid plans are offered, processes payments and subscriptions and receives the payment details you enter, your email address and purchase details.

Each provider handles information under its own terms and policies. Infrastructure providers such as Vercel, Supabase, Bunny CDN and Cloudflare may keep their own request and security logs, which can include IP addresses and browser information. We may also disclose information when required by law or when needed to protect the rights, safety or security of our customers, the Service or others.

We use reasonable safeguards to protect information. Illustrations and PDFs are kept in private storage and delivered through time-limited links. However, no system is completely secure, and anyone who has a story link can read that story.

We have not set fixed retention periods. We keep information for as long as it is needed to provide the Service and for related purposes, including:

• Account and story records while your account or story exists, including guest stories after the guest token in your browser expires
• Purchase and subscription records for accounting, tax and dispute purposes
• Marketing suppression records, so an unsubscribe keeps working
• Security, abuse-prevention and operational records
• A minimal record of each permanent story deletion (which account deleted which story, when, and whether the clean-up finished), for security, integrity, operational and accountability purposes
• Information we must keep to meet legal obligations

Copies of information may remain in backups and logs, and in the systems of our providers (including email, payment, AI and infrastructure providers) under their own retention practices. These copies cannot always be removed immediately.

Archiving a story hides it from your library. It is not deletion: the story, its text, illustrations and any PDF remain stored, its link keeps working, and you can restore it.

Permanent deletion is a separate action. You can permanently delete a story yourself only when it belongs to your account, its generation failed, you have archived it, and the Service confirms that it is not being worked on and is safe to remove. When you do, the story request, the information you gave us for that story (including the adult authorization confirmation recorded on it), the generated text, scene descriptions and prompts, and its illustrations and any PDF are removed from our active systems. Part of this clean-up may finish after your request has been accepted, and the Service retries it automatically until it is done. We do not promise a fixed completion time.

We keep a minimal record of the deletion for security, integrity, operational and accountability purposes, as listed under “Data Retention”. Purchase and subscription records are kept for the reasons listed there, with the deleted story no longer attached to them. Copies held in backups, logs or by our providers are handled as described under “Data Retention” and may not be removable right away.

Deleting a story is not account deletion and does not remove other information, such as your account details, your other stories or your purchase records. Finished stories, stories still in progress, guest stories and accounts cannot be deleted this way at this time. You can ask us to delete any story, your account or other personal information by writing to the contact address below. We will review the request and may need to confirm that it comes from the account holder or the person who created the story. Some information may be kept for the reasons described under “Data Retention”.

You can:

• Unsubscribe from marketing email using the link in any marketing email
• Leave out optional story details such as dedications and notes
• Clear or block cookies and browser storage in your browser
• Permanently delete a story that belongs to you when it is archived, has failed and is eligible, as described under “Archive, Deletion and Deletion Requests”
• Contact us to ask about, correct or delete information we hold about you or a story you created

Depending on where you live, you may have additional privacy rights. Contact us to make a request.

We may update this policy. When we do, we will post the new version on this page with a new “Last updated” date.

For privacy questions or requests, contact us at: contact@nestandquill.com.