NANUKI

For grown-ups

Your family’s information.

Nanuki is a story app for adults and children to enjoy together. This policy explains our website, adult accounts, personalised reading and optional saved voices.

Effective: 30 September 2026. The app is currently in private testing. Publishing this notice does not announce a public app-store release.

Who is responsible

Nanuki is operated by Dharmendra Kumar Choudhary, an individual based in Portugal, using the developer display name Hello Nanuki. Public correspondence address: Travessa de Santo Antonio a Graca 10, 1-D, 1170-336, Lisbon, Portugal.

For privacy, access, correction, deletion or support, email support@nanuki.co. Never send your password or sign-in code.

Information we use

Why we use it

We use account information to provide the service an adult requests; profile and reading information to select and personalise supported stories; optional recordings to save and restore the readings you ask us to keep; and limited operational information to prevent misuse, diagnose failures and protect accounts. We also handle support requests and comply with legal obligations.

For EEA and UK data-protection purposes, our grounds are performance of our agreement with the adult for necessary account and service functions; consent for optional recording and account-backup processing; legitimate interests in proportionate service security, troubleshooting and support; and legal obligations where applicable. Child-profile processing requires particular care and is not justified merely by an adult’s contract. You can ask us which ground applies to a specific use, object to processing based on legitimate interests, and withdraw consent for optional processing. Withdrawal does not affect prior lawful processing.

Without the account information required for sign-in, we cannot provide an account. Recording and cloud backup are optional. We do not use automated decision-making with legal or similarly significant effects. Story selection uses your choices and previous assignments.

Children and parents

An adult must create and manage the account and supervise children’s use. A child should not submit account details or contact support independently. Parents can review available profile information, correct it, remove recordings or request deletion. Do not upload a child’s voice unless you are the parent/guardian or have the necessary permission.

Adult email sign-in and device microphone permission are not, on their own, verified parental consent. Our private-testing arrangements do not establish that public availability in every country is appropriate. Applicable children’s notice, consent and verification requirements must be satisfied before wider release or new collection from children. If you believe a child provided information without appropriate permission, contact us so we can investigate and remove it where required.

Personalisation and AI

In the prepared-library app, Create selects an existing story. Supported Read and Record editions insert names on the device; this substitution does not send names to OpenAI or ElevenLabs. Profiles are still stored with the account. Listen plays prepared narration using the story’s original names.

OpenAI and ElevenLabs are used separately to prepare fictional stories, pictures, music or narration. The consumer app contains no provider API keys and does not call those AI providers directly. Family recording and backup features do not send recordings to AI providers, clone a voice or train a narrator.

Earlier testing: live generation used OpenAI and could include a child’s first name, age, companion details and previous story text. Turning off live generation does not erase earlier processing. Account copies are handled through account deletion; provider copies depend on their applicable retention and deletion arrangements. Contact us about an earlier test account.

Recording, backup and replacement

Recordings start on your device. Only selecting “Back up to my account” or “Back up all” uploads an account copy; Back up all applies to the selected child. “Backed up” means the app verified the account file’s size and checksum. An offline status can show the last verification rather than a fresh server check.

A verified replacement retires the old account recording for that story. This is not a library of previous takes. Export important voices before replacing or deleting them and keep an independent copy. Restore requires access to the same account. No online service can promise permanent preservation.

Account-backed recordings also receive a separate encrypted disaster-recovery copy in a private Cloudflare R2 bucket. Phone-only recordings are not included. Retired or deleted recovery audio and its detailed metadata are scheduled for removal after 30 days. A minimal encrypted marker without audio, names or story text remains to prevent an old database restore from reviving the recording. Active recovery copies remain while the corresponding account recording is current. Failures can delay cleanup and require investigation.

Providers and international processing

Only information needed for the relevant purpose is shared with service providers. Authorised support/technical access may be needed to resolve a problem. We may also disclose information when legally required. We do not sell family data, use it for targeted advertising or publish family recordings to other users.

Providers can process information internationally, including in the United States; this is not an assurance that every copy stays in the EU. Applicable transfer requirements may involve adequacy decisions or approved contractual safeguards. Contact us for information about the providers and safeguards applicable to your data. Provider-contract and transfer arrangements are part of the assessment required before wider app release.

Retention and deletion

Account and profile information remains while needed to provide the account or until removed. Prepared-library assignments and allowance history may stay linked to the adult account after removal of a child, to avoid repeats and quota evasion; full account deletion removes account-linked history. Separately de-linked counters do not contain account, child, story or session identifiers.

Local recordings remain until removed from that device. Account recordings remain until deleted, replaced or removed with the account. After a successful replacement cleanup, retired primary recording details are cleared, with limited identity records retained to reject stale retries. Incomplete uploads and failed deletions can retain information needed to finish or retry the operation; they are not represented as successfully erased.

Support messages and security/operational records are retained for the relevant request, investigation, follow-up or legal requirement. The criteria are whether the issue remains open, whether a record is necessary to demonstrate its handling, and whether an applicable legal obligation or dispute requires preservation. They are not retained for advertising. Ask us for the retention applying to your request.

Infrastructure backup copies expire according to the provider’s backup cycle and are not ordinary account access. Account deletion is not a promise that every historical backup is instantly erased. The separate family-audio recovery period is stated above. When restoring a backup, deletion/replacement records must be respected. Copies you exported or kept on another device require separate removal.

Your rights and requests

Depending on the applicable law, you can request access and a copy, correction, deletion, restriction, portability, or object to processing. You may withdraw consent where we rely on it. Email support or use the available Profile controls. We verify ownership proportionately and never ask for a password or one-time sign-in code. There is normally no fee. We respond within the applicable legal deadline; EEA/UK requests normally require a response within one month, with notice if a permitted extension is necessary.

You may complain to Portugal’s CNPD, your local EEA supervisory authority, the UK ICO, or the relevant authority where you live. You do not have to contact us first to exercise that right.

For deletion, use Profile → Delete account or our instructions without the app. Uninstalling is not account deletion. Signing out removes account access on that installation; operating-system credential storage, particularly iOS Keychain, may otherwise survive a reinstall.

This website and security

These pages use no advertising, analytics scripts, tracking pixels, external fonts or optional tracking cookies. Cloudflare processes technical request information to deliver and protect the site and may use security mechanisms where necessary. Following an email link opens your chosen email service; external links have their own privacy practices.

We use HTTPS, authenticated account access and private recording storage. Separate recovery copies are encrypted. These controls reduce risk but do not guarantee security. Protect your email and device, and report concerns to support.

Changes

We will update the date above when this policy changes and provide an appropriate notice of material changes. Where new processing requires consent, we will seek it before that processing begins. Contact: support@nanuki.co.