Privacy Policy
What WhimKid collects, how children's photos and story content are handled, who processes the data, and how to have it deleted.
Last updated:
WhimKid is a web application for creating illustrated children's storybooks. This policy explains what personal data we collect, why we collect it, who processes it, how long we keep it, and how you can get it removed.
Two things make our data handling different from a typical web app, and we want to be explicit about both: you may upload photographs of your children, and you may generate content with AI services. Both are covered in detail below.
Who we are
WhimKid is operated by SylwairTech LLC. SylwairTech LLC is the data controller for the personal data described in this policy. For any privacy question, or to exercise any right described below, email support@whimkid.com or use our contact form.
Data we collect
Account data. Your email address, display name, and password hash (or the identifier returned by Google if you sign in with Google). This is what lets you sign in and keep your books.
Children's images and likeness references. If you upload a photograph of a child to use as a character reference, we store that image and use it to generate illustrated characters and pages. This is the most sensitive data we handle and we treat it accordingly — see Children's data below.
Story content. Story ideas, generated text, illustrations, narration audio, background music selections, page layouts, and any edits you make.
Payment data. If you subscribe, our payment provider collects your payment method details. We never receive or store your full card number. We store only a customer identifier, the plan you are on, and a transaction history.
Usage and device data. IP address, browser type, operating system, pages viewed, and interactions such as button clicks and session recordings (see Analytics below).
Children's data
WhimKid is designed to be used by adults — parents, guardians, and creators — on behalf of children. It is not directed at children, and we do not knowingly allow anyone under the age of majority in their jurisdiction to create an account.
- Consent. By uploading a photograph of a child, you confirm that you are that child's parent or legal guardian, or that you have the permission of their parent or guardian, and that you have the right to use the image.
- Purpose limitation. We use an uploaded child's image for one purpose only: producing the storybook you asked us to produce.
- No advertising use. We do not use children's images or story content for advertising, and we do not sell this data.
- No training of our own models. We do not use your uploaded images or story content to train machine-learning models of our own.
- Third-party AI processing. To generate results, your content is sent to the AI service providers listed below. Those providers process it in order to return a result for your request, and their handling of it is governed by their own terms and data-processing terms rather than by this policy.
- Removal of a child's image. You can delete individual images and characters from your account. To have all content associated with a child removed, contact us and we will action the request — see Your rights.
How we use data
- To create your account and sign you in
- To generate story text, illustrations, narration, and page layouts
- To save, edit, share, and export your books
- To process payments and manage credits and subscriptions
- To send transactional email (sign-in links, receipts, security notices)
- To respond to support requests
- To detect abuse, fraud, and technical faults
- To understand which parts of the product are used, so we can improve it
We do not sell your personal data.
Service providers
We share data with the processors below only to the extent needed for them to provide their service to us.
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting, database, file storage, CDN, image delivery, outbound email | All data, at rest and in transit |
| fal.ai | AI image generation and image editing | Reference images, prompts, generated images |
| DeepSeek | AI script and story text generation | Story ideas and story text |
| MiniMax | Text-to-speech narration | Story text and voice settings |
| Stripe / Creem / Waffo | Payment processing | Billing details, handled directly by the provider |
| Resend / Cloudflare Email | Transactional email delivery | Email address and message content |
| Google Analytics (GA4) | Product usage analytics | Usage and device data, identifiers |
| Microsoft Clarity | Session recording and interaction analytics | Page interactions and content visible on screen |
| Plausible Analytics | Privacy-oriented aggregate analytics | Page views, referrer, country |
| Umami Analytics | Privacy-oriented aggregate analytics | Page views, referrer |
| Cloudflare Web Analytics | Aggregate traffic analytics | Page views, referrer |
| Discord / Feishu | Internal operational notifications | Event summaries, not full user content |
Analytics and cookies
We use the analytics services above to measure traffic and improve the product. Google Analytics (GA4) and Microsoft Clarity load only after you accept them in the cookie banner; if you decline or do not choose, they are not loaded and set no cookies. Plausible, Umami and Cloudflare Web Analytics set no cookies and run without consent. You can change or withdraw your choice at any time from the "Cookie settings" link in the footer.
You can also block cookies through your browser settings. Blocking analytics cookies does not prevent you from using WhimKid. Our Cookie Policy lists the cookies we set.
Data retention
- Account data is kept for as long as your account exists.
- Story content and uploaded images are kept until you delete them or delete the story they belong to.
- Payment records are kept for as long as tax and accounting rules require.
- Analytics data is retained according to each provider's own retention settings.
- Backups. Deleted content is removed from our active systems promptly. It may remain in encrypted backups for a limited period before those backups are cycled out, and is not restored from them except where necessary for disaster recovery or where the law requires it.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these:
- Story content and images can be deleted directly in the app.
- Account deletion is currently handled by our support team rather than as a self-serve button: email support@whimkid.com from your account address and we will delete your account and the content associated with it.
- You can ask us for a copy of your data in a portable format.
- You can object to analytics processing by declining or withdrawing consent, or by blocking cookies.
We will respond to verified requests within the timeframe required by the applicable law in your jurisdiction.
International transfers
Our infrastructure and providers operate in multiple countries, including the United States, the European Union, and the Asia-Pacific region. Where personal data is transferred internationally, we rely on the transfer mechanisms offered by our providers, such as standard contractual clauses.
Security
Data is encrypted in transit with TLS. Access to production systems is limited to those who need it. Story sharing links can be protected with a password and an expiry date, and revoked at any time. No system is perfectly secure, so please use a strong password and treat sharing links as you would any shared secret.
Changes to this policy
When we make a material change we will update the date at the top of this page and, where the change is significant, tell you by email or in the app.
Contact
Email support@whimkid.com, or use our contact form.