Privacy Policy

Once is built for families, and Your World, as you fill it in, is a profile of a specific child, written by their parent. We treat it that way. This policy explains what we hold, who else sees it, and the choices you have.

Once is operated by Strode Media Company, LLC. For anything in this policy, contact info@strodemedia.com.

What we collect

• ✦Account info: your email and display name, via Sign in with Apple or Google (handled by Firebase Authentication), which we also keep on our own server with your account.
• ✦Your children's first names, ages and pronouns, and — if you add it — the month and day of their birthday, for a birthday story.
• ✦Anything optional you choose to add about a child: how they fall asleep, something they say, and whether they use glasses, a wheelchair, a hearing aid, a cane, a walker or a prosthetic. That last one is information about a health condition or a disability, and we treat it as such: it is never required, it is asked for one reason only — so the illustration can show it rather than leave it out — and you can clear it from the same screen that sets it.
• ✦Your World: the pets, people, places and things you choose to add, the details you write about them, whether someone is no longer with you, and anything you ask stories never to include.
• ✦Stories generated for your family, and a count of them for your monthly allowance.
• ✦Which nights you read a story, roughly how long for, and whether you reached the end, so the app can show you how many nights you have read together.
• ✦When you gave or withdrew permission for stories to be written by AI, and your subscription and free-trial dates.
• ✦Ordinary technical details of each request to our server, including your IP address, kept briefly in server logs.

We record the date you read and when our server received that record, and we never record a night you did not read. There is no streak to lose and nothing that counts against you — the app can tell you that you have read forty nights together, and cannot tell you that you missed one.

Stories are written by AI, with your permission

Once does not write stories itself. To write one, our server sends your child's first name and age and the relevant parts of Your World to Claude, an AI service operated by Anthropic. Your account identity — your email, your name, your sign-in — is never sent. Anthropic processes this to return the story and does not use it to train their models. They hold it briefly for their own abuse-monitoring and then delete it, on their schedule rather than ours — at the time of writing, up to 30 days, and longer for anything flagged for a safety review — so deleting a story here removes it from Once, and does not reach back into their logs.

We ask for your explicit permission before any of this is sent, and nothing is shared until you grant it. That moment is earlier than it may sound: saving a child, or adding something to Your World, sends what you typed to be checked before it is stored, so the question is asked the first time you save anything about your family rather than the first time you ask for a story. If we ever materially change what is shared or who it is shared with, we will ask again rather than rely on the permission you gave for something else.

We also send the details you type — tonight's extras, the names and descriptions in Your World, your child's name — to a second, smaller Anthropic model to be checked before a story is written, and send the finished story back to be checked again, so that what a child hears stays suitable for a child.

Withdrawing that permission

You can take it back at any time, in the app: Profile → Settings → "Stories written by AI" → Withdraw permission. Once will stop writing new stories for you immediately, and nothing further will be sent to Anthropic on your account until you allow it again. Stories already written stay in your archive and remain readable. Granting permission again takes one tap, in the same place.

Permission belongs to a person, not to a household, and we would rather say so than let you assume otherwise. If you share a family with another adult, withdrawing yours does not withdraw theirs: either guardian may permit a service for their own child, and one member should not be able to switch the app off for everybody. If you want your child's details to stop being sent entirely, removing the child — or deleting your account — is the lever that does it.

Who else processes this

These companies handle parts of Once on our behalf, and none of them may use what they see for their own purposes. Our own hosting and the service that delivers story illustrations also see the ordinary technical details of a request, including your IP address:

• ✦Anthropic — writes the stories, and checks the details you type before one is written. Receives what is described above.
• ✦Google (Firebase) — handles sign-in. Receives your email or Apple private-relay address, and nothing about your children.
• ✦Apple — handles Sign in with Apple and every payment. Receives what Apple receives for any App Store purchase, and nothing about your children.
• ✦RevenueCat — handles subscriptions. Receives your Once account ID, your App Store purchase details and your device’s IP address, and nothing about your children.
• ✦Sentry — receives crash and performance reports so we can fix what breaks. We configure it not to collect personal information or request contents, not to store IP addresses, and to scrub reports on arrival, and we design our reports to leave out children’s details.
• ✦Amazon Web Services (Lightsail) — hosts our server and database, in the United States.
• ✦Cloudflare — stores and delivers the story illustrations, which are the same library pictures for every family and never pictures of your child.

Sharing a story on the web

You can create a link to a story, which opens a plain web page anybody holding the link can read — that is what makes it possible to send one to a grandparent who does not have the app. That page names your child and whoever else is in the story, so it is only ever created when you ask for it.

No story is on the web until you share it. A link stops working thirty days after you create it, and you can turn it off before then from the story itself — the link stops opening immediately, including for anyone you already sent it to. Deleting a story turns its link off at the same moment. Shared pages ask search engines not to index them.

When you paste a link into a message, the messaging app shows a preview with the story’s title and its illustration — never anyone’s name beyond what the title already says. Messaging apps keep their own copy of that preview, and turning the link off cannot remove it from their servers or from the conversation.

Reading aloud

When you turn on follow-along, Once listens through the microphone so the page can dim behind whoever is reading. That recognition happens entirely on your device: no recording and no transcript is sent to us or to anyone else, and nothing is stored. On phones or languages where on-device recognition is unavailable, the feature simply does not work rather than falling back to sending audio elsewhere.

Telling us a story was wrong

Every story is written for one family and read by one family, so if the writing goes somewhere it should not, there is nobody else to notice. You can report a story from your archive — "Something was wrong with this story" — and we read every one.

A report keeps a copy of the story it is about: its title, its text, the age it was written for, and anything you choose to add. It has to, and this is the part worth being plain about. The story itself comes off your shelf the moment you report it and is erased thirty days later, and "More" adds to a story as you read, so without a copy taken at the time there would shortly be nothing left to look at. For the same reason a report outlives the account that made it: somebody upset enough to report a story may well delete their account the same evening, and those are exactly the reports that should not disappear.

We keep reports for 12 months, then delete them. They are read by us, never used for advertising, never sold, and — unlike everything else you type — what you write in a report is not sent to Anthropic to be checked. A complaint about a model is the one thing in this app that should not be handed to that model to judge.

Records of what the writing did

When a story is generated we keep a short technical record of it: how long it took, how long the story was against the length asked for, the age it was pitched at, and why the model stopped writing. It holds no account details and no entries from Your World.

Where a story failed — it came back empty, or too short to be a story, or the safety check refused it — the record also keeps up to the first two thousand characters of what did come back, because a failure nobody kept is a failure nobody can fix. A story that reached you is not copied here; it is already in your archive. These records are deleted after ninety days.

Children's privacy

Once is intended to be used by parents and guardians. Accounts are created and managed by adults, and we do not knowingly allow a child to create one. Information about a child is added at a parent's discretion and used only to personalize stories for that family. It is never used for advertising, never sold, and never shared except with the processors named above, the members of your family, and anyone you send a story link to.

Storage and security

Data is stored on our servers and cached on your device, so stories can be read with no signal. Authentication is handled by Firebase, and every request to our server is verified before a story is generated. Deleted information may remain in encrypted backups for up to 14 days, after which the backups holding it are erased. We keep Your World and your stories for as long as your account exists, with four exceptions: a story you delete is held for thirty days and then erased for good; the technical record of a generation is deleted after ninety days; a story you report is kept as described above; and the allowance count described at the end of this page outlives the account it belonged to.

Your choices

• ✦Edit or remove anything in Your World at any time.
• ✦Turn off a shared story link, at any time, from the story itself.
• ✦Leave a family you were invited into, from Profile → Your Family. The children, the stories and Your World stay with that household — they were shared into it — and you start again with a world of your own.
• ✦Delete a single story — it disappears from your archive on every device in the family straight away, any web link to it stops working, and it is erased from our servers thirty days later.
• ✦Withdraw AI permission, as described above. It is recorded on your account rather than on one phone, so it applies wherever you are signed in.
• ✦Delete your account (Profile → Settings → Delete account). If you are the only person in your family this erases your children, Your World and your stories, and removes your sign-in. If you share a family, they pass to the other members instead — see below. If removing the sign-in itself fails we record that and remove it by hand; your data is already gone at that point.
• ✦Report a story that was wrong for your child, from your archive. It comes off your shelf at the same moment, and any link to it stops working.
• ✦Manage your subscription through your Apple account.

Two things worth stating plainly

If you share a family with another parent and you delete your account, your children and stories pass to them rather than being erased. The household keeps its memories — they are not lost, they become theirs.

A count of how many stories have been written stays attached to your sign-in after deletion. It holds nothing about the stories themselves — not a title, not a word of one. It exists so the free monthly allowance cannot be reset by deleting an account and starting again.

Where your information is processed

Our server and most of our providers are in the United States, so if you live in Canada, the UK, Australia or New Zealand your information is processed outside your country, under our providers’ contractual safeguards for international transfers.

How we measure Once

We count how the app and this website are used — which screens are opened, how far stories are read, when a plan is chosen or a gift is given — so we can improve Once. These usage statistics are recorded on our own server, by us, and are not shared with any other company or used for advertising. They never include a child’s name, anything you type, or the text of a story.

In the app they are linked to your account and to a random identifier the app creates for itself, which is replaced when you sign out. You can turn them off under Settings › Your family’s data › Share usage statistics; the record that a purchase happened is kept either way, because it is a record of a sale. Raw usage statistics are deleted after 180 days, and deleting your account deletes them straight away.

This website

getonce.app sets no cookies and keeps no identifier in your browser. We count visits ourselves with a code made from your connection that changes every day and cannot identify you or follow you between days; your IP address and browser details are not stored. Nothing is counted if your browser sends Do Not Track or Global Privacy Control. Fonts load from our own server rather than from a third party. If you choose a text size on a shared story, that choice is saved in your own browser and never sent to us.

The website also uses Google Analytics, but only if you say yes when we ask. Until then, and if you say no, nothing of Google's is loaded and no cookie is written. If you accept, Google sets its own cookies (named _ga and _ga_…) so a returning visitor can be told from a new one, and receives the page you are on, where you arrived from and your IP address, as a processor on our behalf. Google's advertising features are switched off either way, so nothing here is used to advertise to you. Shared story links and gift codes are never sent to Google: pages are reported as patterns such as /s/:token, never the address itself. A browser sending Do Not Track or Global Privacy Control is never asked and never counted by Google. The app itself contains no Google Analytics and no third-party analytics of any kind.

Your choice on this browser, which you can change at any time:

Your rights

Wherever you live, you can ask us for a copy of what we hold about you and your children, ask us to correct it, or ask us to delete it, by emailing info@strodemedia.com. We will answer within 30 days. Most of it you can already change or delete yourself in the app.

In the UK we process your children’s details, including any health information, with your explicit consent, which you can withdraw as described above; your account details to provide the service you signed up for; technical logs in our legitimate interest in keeping Once secure; and usage statistics in our legitimate interest in improving Once, which you can turn off at any time. You can complain to the Information Commissioner’s Office (ico.org.uk). In Canada you can contact the Office of the Privacy Commissioner (priv.gc.ca), in Australia the Office of the Australian Information Commissioner (oaic.gov.au), and in New Zealand the Office of the Privacy Commissioner (privacy.org.nz). In California you have the right to know, delete and correct, and we do not sell or share personal information as those words are used in California law.

Contact

Questions about privacy, or a request to see or delete what we hold? Email info@strodemedia.com and we will answer within 30 days. See also our privacy promise and how to delete your account.