What we collect, and what we deliberately don’t
Effective 17 August 2026 · Applies to bookshelf.kids on the web and to the bookshelf.kids Android app.
The short version. The account belongs to an adult. We ask for your child’s first name so it can be printed in the book and spoken in the narration — but the app replaces it with a placeholder before the story and the pictures are generated, so the service that writes and draws the book never receives it. Photos are held in memory only while the illustrations are being made, then dropped. We show no ads, we run no advertising trackers, and we do not sell anything about you.
1. Who we are
bookshelf.kids is operated by Webway, South Africa. For anything in this policy, contact hello@bookshelf.kids. The same address is our child-safety contact.
2. What we collect and why
| What | Why | Kept |
|---|---|---|
| Your name and email address | To create and run your account, and to contact you about your books and orders | Until you delete the account |
| Your password | To sign you in. Stored only as a bcrypt hash — we cannot read it | Until you delete the account |
| The child’s first name, and the names of any family, friends or pets you add | To print them in the book and speak them in the narration. Not sent to the story or illustration service — see section 3 | Stored with the book, until you delete the book or the account |
| What you tell us about the story — age, language, theme, interests, your own story idea, special details, dedication | To write the story you asked for | Stored with the book |
| Photos you upload of the child or other cast members | So the illustrations resemble them. Held in server memory only — see section 4 | Until the illustrations are made, or about 30 minutes, whichever is first |
| The finished book — story text, illustrations, narration audio | So you can read it again in your account, and so we can print it if you order a printed copy. There is no download — the book is read on the site | Until you delete the book or the account |
| Purchase records — what was bought, the amount, the currency and the payment reference | To give you what you paid for, and because tax and accounting law requires us to keep records | Retained after account deletion, in anonymised form, for as long as the law requires |
| The delivery address and phone number for a printed book | So the printer can post the book and the courier can reach you. The address is kept on the order it was given for, and separately as the address we offer back to you next time | On the order, with the other order records. On your account until you change it or delete the account |
| Your IP address | Used at the moment of the request to work out your country (so prices show in your currency and we only offer printing where we ship) and to enforce fair-use limits | Not stored on your account |
If you report a generated page as inappropriate, we keep the report and the page it refers to so we can review it and improve our safety filters.
3. How your child’s name is handled
This is the part we designed most carefully, so it is worth being precise about it.
- Before the app asks for a story or a picture, it swaps your child’s name — and every cast member’s name — for a placeholder such as {{CHILD NAME}}. The service that writes the story and draws the illustrations receives only the placeholder. The app puts the real name back on your device, for you to read.
- The name is sent to us and stored with the book, because it is printed on the pages you bought.
- The name is sent to the text-to-speech service when narration is produced, because the narrator has to say it out loud.
We do not ask for your child’s surname, birth date, school, address or any other detail, and you should not put them into the story fields. Free-text fields are automatically scanned and stripped of email addresses and phone numbers before they are sent anywhere.
4. Photos of children
Uploading a photo is optional; the book can be made without one. If you do upload one:
- You must confirm that you are the parent or legal guardian, or otherwise have permission from the person pictured. We record that you gave that confirmation, and when.
- The photo is held in server memory only. It is never written to our database or to disk, and it is never included in the saved book.
- It is sent to our illustration provider solely to generate the pictures you asked for.
- It is used for one drawing — the character sheet the rest of the book is drawn from — and released the moment that drawing is locked. Every later page is drawn from that drawing, not from the photo. In any case it is released after about 30 minutes or a limited number of uses, whichever comes first.
- In the Android app the photo is re-encoded on your phone before it is sent, which removes embedded location and camera metadata.
If you save someone to My family (part of a membership), we keep the cartoon character we drew of them, together with the name, relationship and age you typed. We do not keep the photo — it is used once, to draw that character, and released exactly as above. Deleting them, or deleting your account, removes the drawing and those details.
5. Who else processes your information
- Google (Gemini) — writes the story, draws the illustrations and produces the narration, as our processor. An alternative provider may be configured for the same purpose; the handling described here does not change.
- Our payment provider — takes payments made on the website and tells us that a payment succeeded. Your card details are entered on their page and never reach us.
- Google Play — processes purchases made inside the Android app, and tells us that a purchase is valid. We never see your card details.
- Our bank — where a member asks to be paid out what they earned by inviting other families, we send their payment details to the bank to make the transfer.
- Our hosting provider — runs the servers the service is on.
- Our printing and delivery partners — receive the approved book and the delivery details, and only when you order a printed copy.
Country detection uses a licensed database held on our own server; your IP address is not sent to a third party to do it. We do not sell personal information, we do not share it for advertising, and we do not use it to train anyone’s models beyond producing your book.
6. If you were invited by someone
If you signed up through another member’s invite link, that member earns a share of what you spend — and so we tell them how their invitation went. They can see your name, the email address you signed up with, the date you joined, and whether each purchase you made was a book or a membership payment, together with the commission it earned them.
They are never shown what you paid, which book you made, its title, or anything at all about the child in it. If you would rather not appear on that list, ask us at hello@bookshelf.kids and we will detach your account from the invitation.
7. What we deliberately do not collect
- No advertising identifier, and no third-party advertising or analytics trackers of any kind. The app does not ask for one, and the website loads no tracking script from anyone else. We do count visits ourselves, in a way that identifies nobody — see section 8.
- No precise location. The app requests no location permission.
- No microphone, contacts, calendar or phone-number access.
- No photo-library permission. The Android app uses the system photo picker, so you choose one picture and we see only that picture.
- No device identifiers such as IMEI, MAC address or serial number.
8. How we count visits
We measure how the website is used with our own software, on our own servers. Nothing is shared with an analytics company, an advertising network or anyone else, and no script from another company runs on these pages.
For each visit we record the page, the country your connection appears to be in, whether you are on a phone, tablet or computer, roughly which browser and operating system you use, whether you came through our app or the website, and the website or link that sent you here. We also record which steps of the book maker you reached and which of a small, fixed list of buttons you pressed, so that we can see where the process is confusing. We also record a random identifier that your browser generates for itself and keeps in its own storage — it is not derived from anything about you or your device, and clearing your browser data replaces it, after which you are simply a new visitor to us.
We do not store your IP address. It is used once, at the moment of the request, to work out a country, and then discarded. We do not store the full address of the page that referred you, only the site it was on, and we do not build a profile, sell anything, or use any of this for advertising. Raw visit records are deleted automatically after a few months.
If your browser sends a Global Privacy Control signal we do not record the visit at all.
9. Emails we send you
We email you about your own account and orders — a payment receipt, an order moving on, an answer to something you asked us. Those are part of the service and are not marketing.
We also send two automatic messages. If you write a book and do not unlock it, we may remind you that it is waiting, and that reminder may carry a discount code. A few days after your first purchase we may ask you once — once ever, not once per order — to leave a review. Every one of those messages carries an unsubscribe link that stops both of them, and using it does not affect your account or your books.
Ticking the newsletter box in the footer adds your address to a separate mailing list. You can ask us to remove it at any time, and deleting your account removes it automatically.
10. Cookies
We use two cookies and neither of them tracks you. One keeps you signed in for as long as your session lasts. The other remembers which language you asked the site to be written in, so that choosing it once is enough — it holds a two-letter language code and nothing else, it is set only on our own site, and it is never used for advertising or shared with anyone.
If you have never chosen a language, we pick one from the country your connection appears to be in, using the same one-off lookup described in section 8, and we default to English whenever that is unavailable or points somewhere we do not have a translation for. No cookie is needed for that, and none is set until you make a choice.
11. Children
bookshelf.kids is a tool for adults to make something for a child. Accounts, payments, photo consent and sharing decisions are the account holder’s, who must be 18 or older. Children do not register, do not sign in and are not asked for personal details. A child may help make the book alongside you, on your account; there is no separate child account and children are not signed in.
Where a child’s personal information is processed, we rely on the consent of the parent or other competent person, as required by section 35 of South Africa’s Protection of Personal Information Act, and we follow the equivalent duty under the United States Children’s Online Privacy Protection Act. If you believe a child has provided us with information without that consent, email hello@bookshelf.kids and we will delete it.
12. Your choices and rights
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. You can also do the last one yourself, at any time:
- In the app — Account → Delete my account.
- On the web — bookshelf.kids/account/delete, which works whether or not the app is still installed.
- By email — hello@bookshelf.kids.
Deleting your account removes your books, their illustrations and their narration, anyone you saved to My family (including the character we drew of them), your delivery address and phone number — on the account and on every printed order — your mailing-list subscription and any bank details you gave us for a payout. Purchase records are kept in anonymised form where tax, accounting or fraud-prevention law requires it. Deleting your account does not cancel a Google Play subscription — cancel that in Google Play first, or it will keep billing you.
13. Security
Traffic is encrypted in transit. Passwords are stored only as bcrypt hashes. Source photos never touch persistent storage. Access to the administration console is restricted and separate from the app’s sign-in. No system is perfect: if a breach affects you, we will tell you and the regulator where the law requires it.
14. Automatically generated content
Stories, illustrations and narration are produced automatically and can be wrong, odd or unsuitable despite the safety filters we apply to both what goes in and what comes out. Every generated page carries a report control. Please use it — reports are reviewed by a person and are what we use to tighten the filters.
15. Changes to this policy
If we change how we handle your information we will update this page and change the effective date at the top. Material changes will also be announced in the app. This policy should be reviewed by South African legal counsel before commercial launch.