Privacy Policy
We build BookIt for children and parents, and protecting your privacy matters a lot to us. This page explains simply what information is collected, why, who it is shared with and how you control it. It was written in line with the California Online Privacy Protection Act (CalOPPA), the U.S. Children’s Online Privacy Protection Act (COPPA), the Israeli Protection of Privacy Law (including Amendment 13) for users in Israel, and the EU GDPR for users in Europe.
1. Who is responsible
The controller of the information is Kenneth rose Entrepreneurship LLC, a California limited liability company (entity no. B20250220690), 1442 Bahama Way, San Jose, CA 95122, USA. For any privacy question or request: support@bookitshop.com.
2. What we collect
- Account details: the parent’s name (shown in books as “By”), email address and password. The password is stored only in a one-way encrypted form that cannot be turned back into the password. We also record when the terms were accepted.
- Content you create: character names and descriptions, page text, book titles and the pictures that were made.
- A face photo (Premium, only after a separate consent from the parent): it is sent to Google to check it and draw the character. We do not keep the original photo, not on our server and not on the device. Only the finished drawing is kept.
- AI voices: the text is sent to Google to make the voice, and the recording is kept for up to a year so it doesn’t have to be made again.
- Speaking into the microphone: speech is turned into text by your browser and operating system (for example Apple or Google) under their privacy policies. We only receive the text.
- Account usage: Premium status, a log of AI pictures (when each one was made and what kind, to count the quota and work out refunds), codes used, and pauses caused by banned words.
- Technical information: your IP address and browser details are processed by our server providers to run and protect the Service. The device keeps your sign-in code, settings (language and accessibility) and a copy of your books.
3. What we do not do
- There are no ads, and we do not sell information to anyone.
- No advertising cookies, no tracking tools, and no marketing profiles of children or parents.
- We do not ask children for identifying details. Please avoid writing a full name, address, school or phone number in books.
4. How we use information
Only to run the Service: to save and sync books, draw and read aloud, fix spelling, count the picture quota, protect children from unsuitable content and misuse, and answer your messages.
5. Who we share it with
Only with providers the Service cannot work without, and only what they need. Sharing with them is part of how the Service works:
- Cloudflare: the server and database where accounts and books are kept, and the “I’m human” check (Turnstile) at sign-up.
- Google (Gemini API): receives the text or photo needed to draw, read aloud, check a photo or fix spelling. Under Google’s terms for paid services, Google does not use this data to improve its products, and may keep it for a limited time to detect abuse.
- Paddle.com: our payment provider and Merchant of Record. It receives your email, country and payment details to take payment, send the invoice and handle taxes and refunds. Card details go straight to Paddle; we never see or store them.
- Authorities: only when the law requires it.
6. International transfers
The company is registered in the United States, and information is stored and processed mainly in the United States and Europe, by the providers listed above. If you live in Israel or Europe, your information is transferred there. Transfers are made as the law allows, to providers who are bound to protect the information.
7. Children and parental consent (COPPA)
BookIt is made for children, including children under 13, using it together with a parent. We follow the U.S. Children’s Online Privacy Protection Act (COPPA):
- Only a parent aged 18 or over opens an account. The parent confirms their email with a code we send, and that email also gives them direct notice of what we collect and how we use it.
- From the child we collect only what they write or say inside the book (text, character names and descriptions) and, if the parent agrees, a face photo. We use it only to make the book.
- Before a face photo is used for the first time, the parent gives a separate, clear consent. It can be withdrawn at any time.
- We do not make any part of the Service depend on giving more information than it needs.
- A parent can at any time review and download all the information (the “Download all my data” button at the bottom of this page), correct it, delete the account and all its information, and stop further collection.
- The operator and contact details are in section 1.
8. How long we keep it
We keep information only as long as it is needed:
- An account not used for 2 years is deleted with all its books and pictures. A month before, we email the parent a reminder; logging in once keeps the account.
- An account whose email was never confirmed is deleted after 7 days.
- Deleting the account immediately removes the account, books, pictures and picture log.
- Backups are kept for 30 days and then deleted.
- Voice recordings are kept for up to a year.
- Payment records (ID, amount and date, no card details) are kept as long as tax law requires, also after the account is deleted.
- Logging out removes the copy on the device. A sign-in code expires after 60 days.
9. Security
Connections are encrypted (HTTPS), passwords are stored encrypted, and access to information is limited. No security is perfect. If we find a serious security incident, we will act and notify you and the authorities as the law requires.
10. Your rights
You have the right to see the information, get a copy of it, ask us to correct or delete it, restrict or object to its use, and withdraw any consent you gave. You can download all the information, and delete the account, yourself at the bottom of this page. For anything else, email support@bookitshop.com and we will answer within 30 days.
EU residents: we process information to provide the service you asked for (performance of a contract), face photos only with your consent, and technical information for security (legitimate interest).
California residents: we do not sell or share personal information for advertising.
If you think your privacy was harmed, you can also contact the Israeli Privacy Protection Authority. EU residents may contact their local data protection authority, and U.S. parents may contact the Federal Trade Commission.
11. Cookies and device storage
We use only what the Service needs to work: one cookie for the access code during the testing period, and the sign-in code, settings and a copy of your books kept on the device. There are no advertising cookies, no third-party analytics, and the fonts load from our own server.
12. Changes to this policy
We will update this policy from time to time and show the date here. We will tell you about important changes in the app or by email.