This policy explains what data the Lunalulu app and its website process, why, on what basis, with whom and for how long, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties. The app tells stories in a parent's voice: your voice is personal data, and below we describe, leaving nothing out, what happens to it.
In short. No account, no ads, no data sold. Your voice is only sent with your explicit consent: your recording goes to Cartesia, our speech synthesis provider based in the United States, which creates from it a synthetic voice used to tell your stories. Our servers do not keep the recording; Cartesia keeps the recording and the synthetic voice until you delete your voice. Stories prepared with your voice stay on our servers in Europe for 7 days at most, then only on your phone. The storyteller's stories are downloaded from our storage in Germany (Hetzner), with no personal data. Also leaving your phone: an anonymous identifier, technical counters, your subscription status, the messages and reports you choose to send us, usage analytics (with no content, except the optional free answer "Another way" during onboarding), and crash reports. With "Create a story" (Lunalulu+), your child's name and your little idea are used only to write the story, by OpenAI's artificial intelligence, processed in the United States, and then to have it read by Cartesia: we do not keep them on our servers, and OpenAI never uses them to train its models. The photos you take or choose in the app stay on your phone. "Delete my voice" and "Erase everything," in the settings, delete your voice and your data, on our side and at our providers; otherwise, everything is erased automatically after 12 months without opening the app. Erased data disappears from the app and the service right away; our safety backups keep an inaccessible copy for 14 days at most before permanently erasing it.
1. Data controller
BAUGEY MATHEO, sole trader (EI), trading as DEVOLIM
248 rue de Bègles, 33800 Bordeaux, France
SIREN 948 000 757
Email: [email protected]
The publisher has not appointed a data protection officer: any question or request about your data is handled directly by the publisher, at the address above.
2. Our principles
- No account to create: you are never asked for a name, email address, phone number or password.
- Your voice only leaves your phone after your explicit consent, given on a screen that explains what happens.
- Once sent, your recording is kept neither on your phone nor on our servers (Cartesia, which creates your synthetic voice, keeps it until it is deleted: section 3.2). If it could not be sent, it waits to be sent in the app's private storage, excluded from backups, for 30 days at most.
- You can delete your voice, and everything prepared with it, at any time from the app.
- No advertising, no ad profiling, no geolocation.
- No data sold, rented, traded or transferred, to anyone.
- Usage analytics never contain your voice, the text of your stories or the titles of the stories you listen to. The only exception, if you fill it in: the free answer "Another way" during onboarding (section 5.6).
3. Your voice
3.1 What is recorded and sent
So that stories can be told in your voice, you record in the app a short sample of your voice, a few dozen seconds long, by reading a suggested text out loud. You can listen back and start over before sending it. Nothing is sent until you have given your consent.
Once you have given your consent and confirmed the upload, the sample is sent, encrypted, to our server function (Google Cloud Functions, europe-west1 region, in Belgium), together with the version of the consent you accepted and the app's language (one of the languages offered by the app). Our server checks the format and length of the sample, then sends it to Cartesia, our speech synthesis provider, which creates from it a synthetic voice (voice cloning) in that language: that is the language in which your voice tells the stories. Our server keeps no copy of the sample, and the app erases it from the phone as soon as the upload succeeds.
If the upload does not go through right away (no network, server unavailable, usage limit reached), you keep using the app as usual: the sample stays on your phone, in the app's private storage, excluded from iCloud and Google backups, with the version of the consent you gave, and the app sends it again on its own a little later (when the app opens, when the network comes back, at increasing intervals). It is erased as soon as the upload succeeds, if you tap "Don't send it" on the home screen, "Delete my voice" or "Erase everything," and no later than 30 days after the recording. It is never sent without the consent you gave: if you withdraw it, the sample is erased without being sent.
3.2 What is kept
- At Cartesia: the sample of your voice received to create the synthetic voice, and the synthetic voice itself. Both are kept until you delete your voice ("Delete my voice," a new recording that replaces it, "Erase everything") or, failing that, until the automatic erasure after 12 months without opening the app. Cartesia processes them on our behalf, as a processor, under its Data Processing Addendum, which governs the transfer to the United States with the European Commission's standard contractual clauses (section 8).
- On our servers (Google Cloud Firestore, in Europe): for each voice, its technical identifier at Cartesia, in an area that cannot be read from the app, its creation date and the version of the consent given, which prove the consent, its language and, if you give one, the name that identifies it in the app ("Who is speaking?").
3.3 What your voice is used for
Your synthetic voice is used to read the narrator's passages of the stories you choose to listen to with it, with the Lunalulu+ offer. These passages are read by Cartesia in your voice, then put together by our server with the characters' lines, recorded once and for all with other synthetic voices. Your voice is only used in your own app, is never shared with other people, and is not used to identify or authenticate you. Every audio file made with a synthetic voice carries a machine-readable label stating that it was generated by artificial intelligence (Article 50 of Regulation (EU) 2024/1689 on artificial intelligence); this label contains no data about you.
3.3a Training of Cartesia's models
We never use your voice to train a model. Cartesia's terms of use (section 5.3) nevertheless provide that, unless otherwise agreed, the content it receives from its customers (here, the sample of your voice and the texts to be read) and the content it produces may be used to train and improve its models; they allow customers to request that their content not be used for this, and such a request only applies going forward. We tell you this so that your consent is fully informed. Once this request is in effect for our account, we will say so here, with its date. You can delete your voice at any time, which removes it from our Cartesia account.
3.4 Personal data, processed on the basis of your consent
Your voice is personal data. It is not used to recognize or identify you: this is therefore not processing of biometric data for the purpose of uniquely identifying a person within the meaning of Article 9 of the GDPR. Should it nevertheless be regarded as sensitive data, the explicit consent you give would also apply under Article 9(2)(a) of the GDPR. We nevertheless apply the strictest precautions to it: sending it is based on your explicit consent (Article 6(1)(a) of the GDPR), obtained before any recording on a dedicated screen, through a checkbox and an "I agree" button. By giving your consent, you confirm that you are recording your own voice and that you are an adult. With the Lunalulu+ offer, other adults in the family can add their voice: each person reads the text themselves and gives their own consent on the same screen.
3.5 Withdrawing your consent
You can withdraw your consent at any time, as easily as you gave it: Settings, "Your voices," "Delete my voice." Your voice is then deleted at Cartesia, its identifier and the proof of your consent are removed from our servers, and the stories prepared with it are erased from our servers and from your phone. If Cartesia does not respond at that moment, the deletion request is kept on our servers (as the voice's technical identifier only) and retried automatically every 6 hours until it succeeds. Re-recording a voice deletes the old one in the same way; deleting one voice does not affect the others. Withdrawing your consent does not affect processing already carried out; the app's storyteller remains available.
Picture for a voice. You can give each family voice a picture: a photo taken on the spot with the phone's camera or chosen with its photo picker, cropped into a circle, or one of the app's drawn avatars. This picture stays on your phone, in the app's private storage, excluded from backups: it is never sent. It is erased with the voice, when you erase all your data, or when the app is uninstalled.
3a. Create a story
With the Lunalulu+ offer, "Create a story" lets you have a story written just for your child, then have it told in your voice. Here, leaving nothing out, is what happens to the information you provide.
What you provide
The hero's first name (usually your child's), and if you wish the name of a friend, a cuddly toy or a pet, a theme, a short sentence (for example "he's afraid of the dark"), the length and the child's age. Afterwards, you can edit it yourself, by hand, as much as you like, and ask Hibou for up to 3 revisions with a short instruction ("Shorter," "add their cat"). Do not provide a last name, address, phone number or health information: the app automatically rejects addresses, phone numbers, email addresses and links.
Who writes the story
The story is written by artificial intelligence: a language model from OpenAI (GPT), called by our server alone, through OpenAI's API. Before the first submission, the app asks for your consent and tells you what is sent. Our server sends OpenAI your scenario (or, for a revision by Hibou, the text of the story and your instruction; for an edit by hand, only the passages you changed, to be checked by OpenAI's moderation service), and receives the story. It attaches a safety identifier: a fingerprint of your anonymous identifier, which cannot be reversed, that helps OpenAI detect abusive use without knowing who you are. It sends neither your voice, nor your anonymous identifier itself, nor the cover photo.
OpenAI processes this data on our behalf, as a processor, in the United States (section 8). According to its documentation, data sent to its API is never used to train its models. We ask it to keep nothing from these exchanges ("store" option disabled, caching disabled); OpenAI only keeps abuse monitoring logs, for 30 days at most, unless required by law. The processing in Europe offered by OpenAI (data residency) is currently reserved for customers it approves after review: it is not available for this app.
What you write and the story returned are reviewed automatically, by OpenAI's moderation service and by rules given to the model: violence, sexual content, hate, dangers and other people's personal data are refused, with an explanation, and you can make corrections. Stories are written for children aged 3 to 10, and the model is told so. If the check cannot take place (service unavailable), the story is not delivered. A story written by artificial intelligence may contain awkward passages: read it over before having it told (you can revise it), and report to us from the app any passage that seems inappropriate (section 5.5).
Who tells it
Once you have read the story over, you choose who tells it: your voice (or that of another adult in the family), or one of the app's storytellers. In both cases, our server sends the text of the story, which contains the hero's first name, to Cartesia, our speech synthesis provider, in the United States (sections 7 and 8), which reads it and sends the audio back to us; when the story is made again, only new or changed passages are sent. With a storyteller, no family voice is used. You can also keep the story without a voice: nothing is then sent to Cartesia.
What our servers keep, and what they don't
Our servers keep neither your child's name, nor your idea, nor the text, nor the title of the story. They only keep, linked to your anonymous identifier: technical fingerprints of the passages (strings of characters from which the text cannot be recovered), used to know that a passage has already been reviewed and to redo only the passages that were changed; the language, the length, the age, the number of revisions made; and, for 7 days at most after it is made, the story read in your voice (audio files, Google Cloud Storage, in Belgium), while your phone downloads it. Your child's name is spoken in this audio file. The audio is erased from our servers 7 days after it is made, and sooner if you delete the story, delete or change your voice, or tap "Erase everything." The fingerprints and counters are erased when you delete the story, with "Erase everything," and automatically 180 days after the story's last revision.
What stays on your phone
The scenario, the text, the chosen cover, the cover photo if you choose one, and the story read in your voice are kept on your phone, in the app's private storage, excluded from backups. The photo is never sent: you take it with the phone's camera, or choose it with its photo picker, which gives the app only that photo; then the app crops it and keeps a reduced copy.
What is measured
Usage analytics and crash reports never contain the name, the idea, the text or the title of the story: only events with no content (story written, theme, length, age, refusal and its reason).
4. What stays on your phone
The following are stored only on your phone:
- the storyteller's stories you have downloaded and the stories prepared with your voice, so you can play them without a connection;
- your favorites and the number of times each story has been played;
- the stories you created ("My stories"): scenario, text, cover or photo, and story read in your voice, excluded from backups (section 3a); the child's age you entered, for the next story;
- your settings (chosen narrator, music after the story, screen kept on during the story, button sounds, chosen reminders) and the state of the app's onboarding;
- the pictures of your voices (photo or drawn avatar, section 3.5);
- the fact that you have given your consent to sending your voice, and that you have already responded to the request to rate the app.
During recording, the sample of your voice is kept in a temporary folder of the app, while you listen back and send it. It is erased as soon as the upload succeeds. If the upload could not go through, it waits in the app's private storage, excluded from backups, until the app manages to send it, you give it up, or for 30 days at most (section 3).
When you take or choose a photo, the camera or the photo picker hands the app an original file, which the app crops before keeping a reduced copy. This original file is erased from the app's temporary folder as soon as the reduced copy is made, or as soon as you leave the cropping screen; "Erase everything" also erases any that remain, for example after the app shuts down unexpectedly. It is never sent.
We do not have access to this information. It is deleted by "Erase everything" (Settings) or when the app is uninstalled. Stories prepared with your voice are also erased from the phone when you delete or change your voice.
5. What leaves your phone
5.1 From the first launch
- Anonymous identifier: the app creates a random technical identifier (Firebase Authentication anonymous sign-in). It contains neither your name, nor your email address, nor your number; we call it "anonymous" for that reason, but under the GDPR it is pseudonymous data, since it is specific to your installation. It is used to link your voice, your prepared stories and your subscription, to apply usage limits and to erase your data when you ask.
- Service protection: every request to our servers carries a Firebase App Check attestation (Apple's App Attest, Google's Play Integrity) proving that it comes from the genuine app. This attestation contains no personal content, is valid only once and is not kept by us.
- Subscription status: the app links your anonymous identifier to RevenueCat, our subscription management provider, to find out whether a subscription is active.
- Remote settings: at startup, then at most once an hour, the app reads from Firebase Remote Config (Google) settings shared by all users: minimum or recommended app version, update message, maintenance mode, feature switches and settings for the rating request. To do so, Google receives the phone's Firebase installation ID and technical information (app and version, operating system, language, approximate country), used to pick the right settings. We add no personal data to this: not your voice, not any text, not what you do in the app. The settings that are read stay on the phone.
Usage analytics (5.6) and crash reports (5.7) are also active from the first launch.
5.2 Your voice
Only with your consent, as described in section 3.
5.3 Stories prepared with your voice
When you listen to a story in your voice, our server checks that you have a voice, an active subscription (Lunalulu+ offer) and moons available; it sends Cartesia the text of the narrator's passages (the text of the story, never a text you have written) along with your voice's identifier, then assembles the audio file. This file is stored on our servers (Google Cloud Storage, europe-west1 region, in Belgium), linked to your anonymous identifier, for 7 days at most after it is made. The app downloads it through a secure link valid for 2 minutes, then keeps it on your phone: this copy is the one used from then on. If the file is no longer on our servers, it is made again, under the app's conditions. The server also records the preparation status of each story (ready or not, date, length) and a technical fingerprint of the voice used, which prevents you from being served a story prepared with an old voice.
Stories told by the storyteller are files shared by everyone, which contain no data about you (section 5.3b).
5.3a The stories you create
Only if you use "Create a story," as described in section 3a.
5.3b Downloading the storyteller's stories
The audio files of the storyteller's stories are stored at Hetzner, in its file storage located in Germany (Falkenstein). They are files shared by everyone: they contain no personal data. To download a story, the app asks our server for a secure link, valid for 10 minutes, then fetches the file directly from Hetzner. This link carries neither your anonymous identifier nor any information about you; as with any connection to a server, Hetzner sees the phone's IP address. Our server counts the downloads of each anonymous identifier, per day and per month, to prevent abuse (section 5.4).
5.4 Technical counters and subscription status on our servers
On our servers (Google Cloud Firestore, in Europe), the following are linked to your anonymous identifier:
- counters that apply usage limits (voices created and deleted, stories prepared, storyteller stories downloaded, messages sent, erasure requests), per day and per month, and the list of stories already prepared during the month;
- your moons (Lunalulu+ offer): the moons used in the current cycle, the list of stories already paid for in this cycle and, for carrying moons over from one cycle to the next, the number of moons of the last cycle;
- your purchased moons: a wallet identified by a random number, which only holds a number of moons, linked to your anonymous identifier; and, for each moon purchase, a non-reversible fingerprint of the store transaction (never its number in clear), with the product, the number of moons and the dates, so that a purchase is never counted twice;
- your subscription status (active or not, trial in progress or not, period dates), as provided by RevenueCat, remembered so it doesn't have to be requested again for each story, and a non-reversible subscription key used to count the moons of the same subscription after a reinstall.
These items contain neither your voice nor any text.
5.5 Ideas, reviews and reports
If you write to us from the app (Settings, "Ideas and bugs," or the form that follows a rating given to the app), we receive: the type of message (idea or problem), the text you write, the rating from 1 to 5 stars if you have just given one, the app version, the phone's system (iPhone or Android), the language and your anonymous identifier. These messages contain neither your name nor your email address: we cannot reply to them. Do not include personal information in them, about yourself or your child.
Reporting a story. If you report a story or a passage that seems inappropriate, we also receive the reference of the story concerned (catalog story or created story) and the passage in question, 2,000 characters at most. This passage may contain the first name you gave for a created story. It is used only to review the report and to fix the story or our checks, and is erased 90 days after it is sent, or sooner with "Erase everything."
5.6 Usage analytics with no content
To know how many people use the app and which features are used, the app sends to Google Analytics for Firebase, with a pseudonymous instance identifier: the screens displayed; the actions performed, without their content (for example: voice created, queued for upload or deleted, with the technical reason for an upload that did not go through, story started or finished and its mode, storyteller or parent's voice, favorite added, search started without the search term, music after the story set, stories downloaded, purchase started and its result, rating given to the app); two indicators, voice recorded or not and subscription active or not; if you answer the optional questions during onboarding, who you are (mom, dad, grandparent or other), your age range and how you heard about the app, with, if you choose "Another way" and type it, your free answer, exactly as you typed it (100 characters at most); and the information Google Analytics collects automatically (phone model and system, language, approximate country, sessions, first open). Never sent: your voice, the text and titles of the stories, what you write for "Create a story," your messages, the word you search for. The free answer "Another way" is the only typed text that is sent: do not write a name, contact details or information about your child in it. Advertising is always refused in Google Analytics consent settings, and the advertising identifier is not collected. "Erase everything" resets the instance identifier.
5.7 Crash reports
When the app crashes or runs into an error, Firebase Crashlytics receives a technical report: error trace, phone model, system and app version, and an installation identifier specific to Crashlytics. By design, these reports do not contain your voice or what you write.
5.8 Purchases
Payments are collected by Apple (App Store) or Google (Google Play): we see neither your identity nor your payment details. RevenueCat receives your anonymous identifier and, during a purchase or a restore, the transaction information provided by the store (product, dates, store country and currency, receipt), in order to open and verify your Lunalulu+ access. Our server queries RevenueCat with your anonymous identifier before preparing a story in a family voice or a created story.
5.9 Messages to support
If you email us, we use your address and your message only to reply to you.
5.10 Technical logs
The logs of our server functions record the type of event and numbers (durations, quantities, error codes), never your voice, a text, your identifier or your voice's identifier. As with any online service, Google Cloud request logs also record technical connection data, including the IP address from which each call originates. To limit abuse, our server also counts calls per IP address: we never store the address itself, only a fingerprint computed with a key drawn at random each day (for an IPv6 address, that of its prefix), erased with this counter after 3 days; two days cannot be linked to each other.
5.11 Notifications
During onboarding, the app asks whether you accept its notifications; you can decline, and turn them off or back on at any time in the phone's settings. They never contain ads. There are two kinds:
- Notifications scheduled on the phone (for example the story-time reminder, stories downloaded or moons recharged): the app prepares them itself, without sending anything.
- Notifications sent by our server, for example when a story prepared with your voice is ready while the app is closed: they go through Firebase Cloud Messaging (Google) and, on iPhone, through Apple's notification service. For this, the app stores on our servers a notification token specific to this phone, with the system (iPhone or Android) and the app language, linked to your anonymous identifier, in a space that cannot be read from the app. The message is a text from the app, in your language, and contains neither your voice nor the text of a created story.
The token is replaced when the phone provides a new one, and deleted with "Erase everything" or after 12 months without opening the app. If you decline notifications, no token is used to send you any.
6. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating your synthetic voice and telling stories with it (sending the sample to Cartesia, keeping the voice, preparing and storing the stories) | Explicit consent (Article 6(1)(a) of the GDPR), which can be withdrawn at any time with "Delete my voice" |
| "Create a story": writing and revising the story with artificial intelligence, checking its content, reading it in your voice or by a storyteller, keeping the audio | Performance of the contract (Lunalulu+ offer, at your request); reading it in your voice is based on your explicit consent to its use |
| Providing the app and the Lunalulu+ offer (anonymous identifier, catalog, storyteller stories, subscription status, purchase verification, cycle moons and purchased moons, remote settings) | Performance of the contract (terms and conditions) |
| Notifications sent by our server (notification token) | Performance of the contract, for a service you requested; display depends on your permission in the phone's settings |
| Usage limits, App Check, prevention of abuse and fraud | Legitimate interest (Article 6(1)(f) of the GDPR): ensuring the security and continuity of the service |
| Usage analytics, including the optional onboarding answers and the free answer "Another way" | Legitimate interest: measuring use of the app, understanding how people hear about it and improving it |
| Crash reports | Legitimate interest: fixing errors and keeping the app reliable |
| Ideas and bugs sent from the app, replies to your emails | Legitimate interest: improving the app and answering your requests |
| Reports of stories and content, and their handling | Legal obligation (Articles 16 and 17 of Regulation (EU) 2022/2065, the Digital Services Act) and legitimate interest: protecting the children who listen to the stories |
| Proof of your consent, handling of your requests to exercise your rights | Legal obligation (Articles 7(1) and 12 of the GDPR) |
7. Recipients and processors
Your data is accessible only to the publisher and to the providers below, who act on its behalf as processors (Article 28 of the GDPR), except for Apple and Google for sales, who act under their own responsibility.
| Provider | Role | Data concerned |
|---|---|---|
| Cartesia AI, Inc. (United States) | Speech synthesis: creating your synthetic voice and reading stories with it, only after your explicit consent to sending your voice; reading the stories you create, in your voice or in the voice of one of the app's storytellers (in the latter case, the text is sent without any family voice); deleting the voice | Sample of your voice, synthetic voice and its identifier, text of the stories to be read (including that of created stories, which may contain your child's name) |
| Google Ireland Limited (Firebase, Google Cloud), Gordon House, Barrow Street, Dublin 4, Ireland | Anonymous sign-in, server functions, database and file storage (Europe), App Check, Crashlytics, Analytics, Firebase Cloud Messaging (notifications), Remote Config (remote settings) | Anonymous identifier, Firebase installation ID, voice sample in transit (not kept), voice identifier and proof of consent, prepared stories, counters, subscription status, ideas, reviews and reports, notification token, crash reports, usage analytics (including the free answer "Another way"); scenario and text of created stories, in transit (not kept by our servers), and their audio |
| OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (processing by OpenAI, in the United States) | "Create a story": writing and revising stories with a language model, checking revised passages, moderating texts | Scenario (hero's name, friend or cuddly toy, theme, idea, length, age), instructions, text of created stories and revised passages; safety identifier (non-reversible fingerprint of the anonymous identifier) |
| RevenueCat, Inc. (United States) | Subscription management and verification | Anonymous identifier, transaction information provided by the store |
| Apple Distribution International Ltd (Ireland) and Google Ireland Limited (Google Play) | Distribution of the app, sales and payment, as controllers of their own processing; verification of the app's integrity (App Attest, Play Integrity) | Your Apple or Google account data; integrity attestation, with no content |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Storage of the audio files of the storyteller's stories (Germany) | No personal data in the files; the phone's IP address during a download |
| OVH SAS, 2 rue Kellermann, 59100 Roubaix, France | Website hosting | Website technical logs |
| Cloudflare, Inc. (United States) | Delivery and protection of the website, where applicable | Technical data from website visits (IP address, pages requested) |
Each of these providers is contractually bound to ensure the confidentiality and security of the data. No data is sold, rented or transferred to third parties. We would only disclose data to an authority upon a legally founded request.
8. Transfers outside the European Union
Our server functions, our database, the storage of prepared stories and that of the storyteller's stories (Hetzner, in Germany) are located in the European Union. Your voice, however, is processed by Cartesia, a company based in the United States: the sample of your voice, your synthetic voice and the text of the passages to be read (including that of the stories you create) may therefore be processed in the United States. Cartesia's Data Processing Addendum governs these transfers with the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914, controller-to-processor module). Created stories are written by OpenAI, in the United States: the scenario, the instructions and the text of these stories are processed there. OpenAI's Data Processing Addendum, entered into with OpenAI Ireland Limited, governs this transfer with the European Commission's standard contractual clauses (Article 46 of the GDPR), or with an adequacy decision (Article 45) where one applies. Other data may also be processed outside the European Union, particularly in the United States, by our providers or their affiliates: RevenueCat, Google for its global services (anonymous sign-in, App Check, Crashlytics, Analytics, Firebase Cloud Messaging, Remote Config) and, where applicable, Cloudflare for delivering the website. These transfers are governed by the EU-U.S. Data Privacy Framework when the recipient participates in it, and otherwise by the European Commission's standard contractual clauses. You can ask us for information about these safeguards at the address given in section 1.
9. Retention periods
| Data | Period |
|---|---|
| Sample of your voice (phone and our servers) | Erased from the phone as soon as the upload succeeds or you give it up; if the upload could not go through, kept in the app's private storage, excluded from backups, for 30 days at most; never kept by our servers |
| Sample of your voice and synthetic voice (Cartesia) | Both until "Delete my voice," the recording of a new voice, "Erase everything," or 12 months without opening the app; Cartesia may keep technical copies for a limited period, under its Data Processing Addendum |
| Identifier of each voice, creation date, consent version, language and name of the voice (our servers) | Until the voice is deleted, "Erase everything," or 12 months without opening the app |
| Pending request to delete a voice at Cartesia (technical identifier only) | Until the deletion succeeds, retried every 6 hours |
| Stories prepared with your voice: audio file (our servers) | 7 days at most after it is made; sooner when the voice is deleted or changed, or with "Erase everything" |
| Stories prepared with your voice: preparation status (our servers) | Until the voice is deleted or changed, "Erase everything," or 12 months without opening the app |
| Stories prepared with your voice (phone) | Until the voice is deleted or changed, "Erase everything" or the app is uninstalled |
| Created stories: scenario, idea, text and title (our servers) | Never kept: only for the time needed to write or check them |
| Created stories: scenario, instructions and text received by OpenAI | No retention requested ("store" option and caching disabled); abuse monitoring logs kept by OpenAI for 30 days at most, unless required by law; never used to train its models |
| Created stories: audio (our servers) | 7 days at most after it is made; sooner when the story or the voice is deleted, or with "Erase everything" |
| Created stories: technical fingerprints and counters (our servers) | Until the story is deleted or "Erase everything," and at most 180 days after the last revision |
| Created stories and cover photos (phone) | Until they are deleted, "Erase everything" or the app is uninstalled |
| Voice pictures: cropped photo or avatar (phone) | Until the voice is deleted, "Erase everything" or the app is uninstalled; never sent |
| Original file of a photo taken or chosen (app's temporary folder, phone) | Erased as soon as the photo is cropped; at the latest by "Erase everything", the system clearing that folder, or uninstalling the app; never sent |
| Download links for stories prepared with your voice and created stories | 2 minutes |
| Download links for the storyteller's stories | 10 minutes |
| Downloaded storyteller stories (phone) | Until they are deleted (Settings, "Downloaded stories") or the app is uninstalled |
| Favorites and settings (phone) | Until "Erase everything" or the app is uninstalled |
| Daily counters (our servers) | 3 days after their last update |
| Monthly counters and list of stories prepared during the month (our servers) | 62 days after their last update |
| Cycle moons and list of stories paid for in the cycle (our servers) | 40 days after the end of the cycle |
| Moon carry-over record (number of moons of the last cycle, our servers) | 400 days after the end of the cycle concerned |
| Purchased moons: wallet (a number) and its link to your anonymous identifier (our servers) | As long as purchased moons remain available, since they do not expire; "Erase everything" does not delete them, because they are something you paid for |
| Fingerprints of moon purchases (our servers) | For the whole life of the service, so that the same purchase is never counted twice; they contain neither your identity nor the transaction number in clear |
| IP address fingerprints and their counters (our servers) | 3 days |
| Notification token (our servers) | Until it is replaced, "Erase everything," or 12 months without opening the app |
| Remembered subscription status (our servers) | 30 days after the last check, or "Erase everything" |
| Ideas, bugs and reviews (our servers) | 180 days after they are sent, or "Erase everything" |
| Story reports, with the passage in question (our servers) | 90 days after they are sent, or "Erase everything" |
| All data linked to your anonymous identifier on our servers, and your voices at Cartesia | Erased automatically after 12 months without opening the app, except purchased moons and purchase fingerprints (above) |
| Copies in our safety backups (database and files on our servers) | 14 days at most after erasure. What is erased (with "Delete my voice", "Delete this story", "Erase everything", or after 12 months without opening the app) disappears from the app and the service right away; its copy stays inaccessible in the backups, then is permanently erased. The same applies to data erased when its period ends |
| Server technical logs | 30 days |
| Crash reports (Crashlytics) | 90 days |
| Usage analytics (Analytics) | 2 months |
| Anonymous identifier (Firebase Authentication) | As long as the technical account exists; it contains no information about you |
| Transaction information (RevenueCat) | Duration of the relationship, then legal time limits |
| Messages to support | 3 years after the last exchange |
| Website technical logs (host) | Limited period, according to the host's legal obligations |
Automatic erasures on our servers are carried out by Google when the scheduled period ends, generally within the following days. Important: uninstalling the app does not immediately erase your voice at Cartesia or the data on our servers, linked to an anonymous identifier that we cannot connect to you: they are erased automatically 12 months after the app was last opened. To erase them right away, tap "Delete my voice" or "Erase everything" before uninstalling the app or changing phones. In all cases, an inaccessible copy may remain for up to 14 days in our safety backups before being permanently erased (table above).
10. What we don't do
- No advertising, in the app or on the website.
- No ad tracking or profiling: the advertising identifier is not collected, and the app never asks for Apple's tracking permission (App Tracking Transparency), since it does not track your activity in other apps or websites.
- No geolocation, no access to your contacts, no access to your photo library: only the photo you take or choose for a cover or a voice is given to the app, and it stays on your phone. The camera is used only when you choose "Take a photo".
- No use of your voice outside your stories, and no sharing of it with other people.
- No selling, renting or trading of data, no data brokers.
- No account, and nothing is asked of your child. The name you provide for "Create a story" is only used to write and read it, is never kept by our servers and never goes into analytics.
11. Phone permissions
- Microphone: requested only when you record your voice. The app never listens outside the recording you start.
- Background playback and screen kept on: so the story keeps playing when the screen turns off, with its playback controls on the lock screen, or to keep the screen on if you chose that.
- Camera: used only when you choose "Take a photo," for the cover of a created story or the picture of a voice. On iPhone and iPad, permission is requested at that moment; on Android, the app opens the phone's camera without asking for any permission. Only the photo you confirm is handed to the app: nothing is filmed or recorded apart from it, it is not added to your photos, and it is never sent. The app crops it and keeps a reduced copy in its private storage, excluded from backups (sections 3.5, 3a and 4). You can refuse the camera and choose a photo you have already taken.
- Photos: no permission to access the photo library; the phone's photo picker gives the app only the photo you choose for a cover or a voice.
- Internet: for downloading stories, your voice, writing created stories, preparing stories, purchases, messages to the team, crash reports and analytics.
You can revoke these permissions at any time in your phone's settings.
12. Security
- All exchanges with our servers and with our providers are encrypted (HTTPS).
- Our servers only accept requests from the genuine app (App Check, single-use token) and from an identified session.
- Your voice's identifier at Cartesia, the counters and the subscription status cannot be read from the app; only you can read the status of your prepared stories, and audio files can only be obtained through signed links valid for 2 minutes (10 minutes for the storyteller's stories).
- The access keys for Cartesia, RevenueCat and OpenAI stay on the server, in a secrets vault readable only by our functions, never in the app; the artificial intelligence is called by the server alone.
- Usage limits protect the service and your voice against abuse.
- Data kept on our servers is erased automatically when the scheduled period ends, or at your request from the app.
- To repair the service after an outage or an error, our servers keep safety backups of the database and files. They are inaccessible from the app and serve no other purpose; erased data stays in them for 14 days at most, then disappears permanently.
No system is invulnerable: protect your phone with a passcode and keep its system up to date.
13. Your choices and your rights
At any time, in the app, you have:
- the "Delete my voice" feature (Settings, "Your voices"), which withdraws your consent and deletes your voice and the stories prepared with it, as well as the audio of created stories (section 3.5);
- deletion of a created story ("Delete this story" button), which erases it from your phone and from our servers;
- the "Erase everything" feature (Settings). It deletes your voices at Cartesia, your prepared stories, your created stories and their photos, the pictures of your voices, your voice's identifier and the proof of your consent, the subscription status kept by our servers, your notification token, your ideas, reviews and reports, as well as your favorites and settings on the phone; it resets the analytics identifier. Your anonymous identifier is kept, with no content left, so that usage limits keep applying. What remains: your technical counters and those of your moons, which are erased when their period ends (section 9), your purchased moons and the fingerprints of those purchases, which belong to you, the anonymous identifier (anonymous sign-in account at Google and record at RevenueCat), the subscription information at Apple or Google, and the logs, reports and analytics already sent, which are erased when their period ends (section 9). Without a connection, the phone is erased immediately and the erasure on our servers is retried the next time the app opens. Your subscription remains linked to your Apple or Google account: "Restore purchases" brings it back.
What you erase disappears from the app and the service right away; an inaccessible copy remains for up to 14 days in our safety backups, then is permanently erased (section 9).
In accordance with Articles 15 to 22 of the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time without affecting processing already carried out, and the right to set instructions regarding what happens to your data after your death (Article 85 of the French Data Protection Act). These rights are exercised by email at [email protected]. We reply within one month, which may be extended by two months for a complex request.
Since we do not know your identity, we cannot use your name or email address to find the data linked to your anonymous identifier: the app features above are the safest and fastest way to exercise your rights. You can object to usage analytics and crash reports by writing to us; since they are not linked to any information about you, we cannot find the ones that concern you, and uninstalling the app, after "Erase everything," is currently the sure way to stop them from being sent. Purchase information can also be managed with Apple or Google.
14. Children
Lunalulu is intended for parents and adults who care for children: the adult installs the app, records their own voice after confirming they are an adult, and manages the subscription. The child listens to the stories, written for children aged 3 to 10; those written by artificial intelligence are checked before they are delivered (section 3a), and you can report any story to us from the app. The app creates no account and offers the child no advertising, no purchases and no interaction with other people. Only the "Create a story" feature asks you, the adult, for a first name and an age: they are used solely to write the story (section 3a). Your child's first name is personal data of a minor: do not provide more (last name, school, address, health). Do not record a child's voice, and do not write information about your child in messages sent from the app. If you believe a minor has recorded their voice, write to us; "Delete my voice" and "Erase everything" delete it immediately.
Users in the United States (COPPA). The app is intended for adults: it is not directed to children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA). It does not collect personal information directly from a child, offers a child no account, no purchases and no interaction with other people, and does no targeted advertising or tracking. The first name and age entered for "Create a story" are provided by the parent, for the parent's own use: they are used only to write and read the story, and our servers do not keep them (section 3a). If you believe a child under 13 has given us personal information, for example by recording their voice or writing to us, contact us at [email protected] and we will delete it without delay.
15. Website
This website sets no cookies and uses no audience measurement tool, except the anonymous counter described below. The fonts are hosted with the website: your browser contacts no font, advertising or measurement service. The website is hosted by OVH and may be delivered through Cloudflare's network, which protects it against attacks and speeds up its display; these providers process, for these purposes only, the technical data of your visit (IP address, pages requested, date) for a limited period.
The only exception is the share page /app (the link shared from the app and posted on our social media), which keeps an anonymous counter: the number of visits and clicks to the App Store or Google Play, per day, with the page language, the type of device, the country and the source named in the link. No cookie is set, no identifier is created and no IP address is stored: these are totals only, which cannot identify anyone. The counter is hosted by Cloudflare on behalf of Devolim and its figures are deleted after 13 months.
16. Security incident
In the event of a personal data breach, we notify the CNIL under the conditions of Article 33 of the GDPR and, when it is likely to result in a high risk to your rights and freedoms, we inform you in the app or on this website, in accordance with Article 34.
17. Complaint to the CNIL
If, after contacting us, you believe your rights are not being respected, you may file a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr. If you live in another Member State of the European Union, you may also lodge a complaint with the supervisory authority of your country of residence (Article 77 of the GDPR).
18. Changes
This policy may be changed to reflect legal or technical developments. The date of the last update appears at the top of the page; substantial changes are announced in the app and, if they concern sending your voice, your consent is requested again.