Last updated: April 2026
Effective date: April 2026
Truth and Tales is operated by ALL CRIACAO DESENVOLVIMENTO E PRODUCAO DE INOVACAO LTDA, a company registered in Brazil, trading as "Truth and Tales" (referred to in this policy as "Truth and Tales", "we", "us", or "our").
Data Protection Officer / Encarregado: Leonardo Guedes Bilck
Contact: support@truthandtales.app
Website: https://truthandtales.app
This policy covers all Truth and Tales products and services: the mobile app (iOS and Android), the web app (play.truthandtales.app), and the website (truthandtales.app).
Truth and Tales is a platform for children ages 4-8. We take children's privacy seriously and have built the platform with privacy by design. Specifically:
Truth and Tales operates in two modes:
A parent or guardian creates an account (using Google Sign-In, Apple Sign-In, or email) and sets up child profiles. The adult account manages subscriptions and settings. Child profiles do not have their own login credentials in this mode; they access content through the parent's account.
Schools license Truth and Tales for classroom use. Each child receives an anonymous login code consisting of a 3-letter school identifier and a 5-digit number (for example, "abc12345"). No email address, social login, device identifier, or other personal account is required for children in school mode. The school acts as the data controller and Truth and Tales acts as the data processor under a signed Data Processing Agreement.
| Data | Context | Purpose | Stored where |
|---|---|---|---|
| First name | School use only (entered by the teacher) | Identify the child within the school's own reporting | PlayFab, AWS database |
| First letter of surname | School use only (entered by the teacher) | Distinguish children with the same first name within a class | PlayFab, AWS database |
| Year of birth | B2C (entered by parent) | Show age-appropriate content and accessibility settings | PlayFab, AWS database |
| Anonymous user ID | All users | Link gameplay progress to the correct account | All systems |
| Gameplay and progress data | All users | Save progress, generate usage reports for schools, improve the platform | PlayFab, AWS database |
| Mood check-in responses (if enabled) | All users (when feature is available) | Provide engagement data for educators; not clinical or diagnostic | PlayFab, AWS database |
| Anonymous analytics events | All users | Understand how the platform is used, fix bugs, improve quality | Mixpanel, Firebase Analytics (mobile only) |
| Crash reports | Mobile app users | Identify and fix technical issues | Firebase Crashlytics |
| Data | Context | Purpose | Stored where |
|---|---|---|---|
| Email address | B2C parent accounts | Account creation, login, communication | PlayFab |
| Name | B2C parent accounts (from social login, if provided) | Account identification | PlayFab |
| Subscription status | B2C parent accounts | Manage subscription access | Adapty, PlayFab |
| Educator login credentials | School use | Access school reporting tools | PlayFab, AWS database |
Truth and Tales uses the device camera, microphone, and augmented reality features for gameplay on iOS and Android (not on the web version):
These features require the user to grant camera and microphone permissions on their device. The permissions are used solely for gameplay. If permissions are not granted, the app continues to function but the specific gameplay mechanics that rely on camera or microphone will not be available.
We do not collect: full surnames of children, dates of birth (only year of birth in B2C), home addresses, phone numbers, photographs, voice recordings, face or depth data, device advertising identifiers (IDFA/GAID), precise or approximate location data, contact lists, browsing history outside the app, or biometric data.
Although the app accesses the camera and microphone during gameplay, no data from these sensors is recorded, stored, or transmitted. All processing happens on the device in real time.
| Purpose | Data used | Legal basis (UK GDPR) | Legal basis (LGPD) |
|---|---|---|---|
| Provide the service (save progress, deliver content) | User ID, gameplay data, first name (B2B) | Contract performance (Art. 6(1)(b)) / Public task for schools (Art. 6(1)(e)) | Contract performance (Art. 7, V) / Public policy (Art. 7, III) for public schools; consent for private schools (Art. 14) |
| Improve the platform (analytics, bug fixes) | Anonymous analytics events, crash reports | Legitimate interest (Art. 6(1)(f)), assessed via LIA | Legitimate interest (Art. 7, IX / Art. 14, II, applicable where processing is strictly necessary and proportionate) |
| Generate school usage reports | User ID, gameplay data, first name, first letter of surname | Contract performance with the school | Contract performance with the school |
| Manage parent account and subscription | Email, name, subscription status | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, V) |
| Send service communications (not marketing) | Parent email | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Send newsletter (if subscribed) | Parent email | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Mobile attribution analytics | Anonymous event data (no ad IDs) | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
Under COPPA, we rely on the following bases for collecting data from children under 13:
When providing services to US schools, Truth and Tales acts as a "school official" with a "legitimate educational interest" under FERPA (34 CFR 99.31(a)(1)). We use student education records only for the purposes specified in our agreement with the school. We do not disclose student education records to any other party without the school's authorization, except as required by law.
For users in Quebec, we confirm that: personal information is not transferred outside Quebec except to jurisdictions recognized as providing adequate protection (the European Economic Area, where our database is hosted, is recognized as adequate by Quebec); we have conducted a privacy impact assessment; and our Data Protection Officer is responsible for ensuring compliance with Quebec privacy legislation.
We use a limited number of third-party services to operate the platform. None of these services receive advertising identifiers, dates of birth, full surnames, or location data. A complete, current list of our sub-processors is maintained at:
files.truthandtales.app/truth-and-tales/sub-processors.html
Key sub-processors include:
All primary data is stored in the European Economic Area (specifically eu-west-1, Dublin, Ireland) on AWS infrastructure, encrypted at rest using AWS Key Management Service. PlayFab data is stored in Microsoft Azure's West Europe region.
Some sub-processors may process data in locations outside the EEA. In all cases, appropriate transfer mechanisms are in place:
When a school's contract or pilot period ends, all student data associated with that school is deleted within 30 days of the end date. During this 30-day period, the school may request a data export. After deletion, the data cannot be recovered.
Account data is retained for as long as the account is active. If you request account deletion, we will delete all associated data within 30 days of the request.
Inactive accounts (no login for 12 consecutive months) will receive a notification email. If there is no response within 30 days of that notification, the account and all associated data will be deleted.
Anonymous analytics data (which cannot identify any individual) may be retained indefinitely for product improvement purposes. This data contains no personal information.
If you are in the United Kingdom, you have the right to: access your personal data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interest; and lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
If you are in Brazil, you have the right to: confirmation of processing; access to your data; correction of incomplete or inaccurate data; anonymization, blocking, or deletion of unnecessary data; data portability; information about shared data; information about the possibility of denying consent and its consequences; and revocation of consent. You may also lodge a complaint with the ANPD (Autoridade Nacional de Protecao de Dados).
If you are in Canada, you have the right to: access your personal information held by us; challenge the accuracy and completeness of your information and have it amended; and withdraw consent to the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions). In Quebec, you also have the right to data portability and the right to be informed of automated decision-making.
Parents and guardians have the right to: review the personal information we have collected from their child; request deletion of that information; and refuse to allow further collection. Schools that have consented on behalf of parents retain these same rights on the parents' behalf. To exercise these rights, contact us at support@truthandtales.app.
Parents of students (or eligible students aged 18 or older) have the right to inspect and review education records maintained by Truth and Tales on behalf of the school. To exercise this right, contact the school directly; the school will coordinate with us.
Truth and Tales does not sell personal information as defined by the California Consumer Privacy Act (CCPA). We do not use student data for advertising, build non-educational profiles, or engage in targeted advertising. When providing services to California schools, we comply with the Student Online Personal Information Protection Act (SOPIPA).
To exercise any of the rights described above, contact us at support@truthandtales.app. We will respond within 30 days (or within the shorter period required by applicable law). We may need to verify your identity before processing your request.
The Truth and Tales website (truthandtales.app) uses essential cookies required for the site to function. We do not use advertising cookies or tracking cookies.
The web app (play.truthandtales.app) uses local storage for session management and game state. No third-party tracking cookies are set in the web app.
The mobile apps (iOS and Android) do not use cookies. Firebase and Mixpanel SDKs use anonymous instance identifiers that do not track users across apps or websites.
We protect personal data using industry-standard measures including:
Despite these measures, no method of electronic storage or transmission is completely secure. If we become aware of a data breach affecting personal information, we will notify affected users and relevant authorities in accordance with applicable law.
Truth and Tales is designed for children ages 4-8 to use with adult involvement. In family (B2C) mode, a parent or guardian must create the account. Children do not interact with account settings, payment, or communication features.
We encourage parents and educators to engage with children during their use of Truth and Tales. The platform is designed for children to explore independently while adults facilitate understanding through open-ended questions.
If you believe we have collected personal information from a child without proper consent, please contact us immediately at support@truthandtales.app and we will delete the information promptly.
We may update this policy from time to time. When we make material changes, we will:
We encourage you to review this policy periodically.
No. Truth and Tales is 100% ad-free. There is no advertising of any kind in the app, and no child data is shared with advertisers.
No. We do not sell, rent, or share personal data with any third party for marketing, advertising, or commercial purposes.
In school mode: first name, first letter of surname (entered by the teacher), an anonymous user ID, and gameplay progress data. In family mode: the same, plus year of birth (entered by the parent). We do not collect full surnames, email addresses, home addresses, phone numbers, photographs, location data, or device advertising identifiers from children.
Yes, on iOS and Android only. The camera is used for augmented reality features (character masks, filters, and placing scenery in the real-world space). The microphone is used for audio interactions during gameplay (for example, blowing to light a fire or roaring like a lion). All camera and microphone data is processed on the device in real time. Nothing is recorded, stored, or sent to any server.
Each child receives an anonymous code (for example, "abc12345"). No email address, password, social login, or personal account is needed. The code contains no personal information.
All data is stored in the European Economic Area (Dublin, Ireland) on encrypted servers. Push notification data is stored in Germany. Newsletter data is stored in France/Germany. No primary data is stored outside the EU.
School data is deleted within 30 days of the end of the school's contract or pilot. Family account data is deleted within 30 days of an account deletion request. Inactive family accounts are deleted after 13 months of no login (with a warning email sent at 12 months).
Yes. We comply with the Children's Online Privacy Protection Act (COPPA). We rely on the internal operations exception for anonymous analytics, parental consent for family accounts, and school consent (acting in loco parentis) for classroom use.
Yes. We comply with all 15 standards of the ICO Age Appropriate Design Code, including: best interests of the child, data minimisation, no profiling, no nudge techniques, no advertising, and high privacy settings by default.
Yes. We comply with the Brazilian General Data Protection Law (LGPD) and the Digital ECA (Law 15,211/2025). Our Data Protection Officer (Encarregado) is Leonardo Guedes Bilck, reachable at support@truthandtales.app.
Yes. Parents can request deletion at any time by contacting support@truthandtales.app. Schools can request deletion of all student data associated with their institution. We will delete the data within 30 days.
Truth and Tales is an award-winning platform developed in Florianopolis, Brazil (founded 2014), as a spin-off of an internationally awarded children's entertainment company. The platform's content is designed in collaboration with doctors, educators, and neuroscientists, and is based on Teaching Stories, traditional narratives researched by Idries Shah, Robert Ornstein, and Arthur Deikman. Truth and Tales has received the Mom's Choice Gold Award, a Common Sense Media 5-star rating, the GESAwards for EdTech, the ComKids Best Interactive App award, and was featured as Apple App of the Day.
Yes. Truth and Tales was designed from the ground up with child safety in mind. The platform is 100% ad-free, collects minimal data, does not profile children, and does not use nudge techniques, streaks, points, or badges. Content is curated by doctors, educators, and neuroscientists for children ages 4-8. The app complies with COPPA (USA), the UK Children's Code, LGPD (Brazil), and PIPEDA (Canada). All data is stored on encrypted servers in the European Union. The calming, non-overstimulating design respects each stage of child development. Truth and Tales holds a Mom's Choice Gold Award and a Common Sense Media 5-star rating, both of which evaluate child safety and content quality.
No. All stories, illustrations, narration, music, and activities in Truth and Tales are created by people. The audiobooks feature professional human narration, never AI-generated voices. This is a deliberate choice: human voice narration serves as a reference for pronunciation and for recognising the intonations that carry implicit meaning, intentions, and emotional states.
Yes. Truth and Tales offers school licensing with anonymous student login codes (no personal accounts required for children), pedagogical guides for educators, and a Data Processing Agreement that meets UK GDPR, LGPD, COPPA, and PIPEDA requirements. The platform is designed for children to explore independently while educators facilitate deeper understanding through open-ended questions. Schools in the United Kingdom, Brazil, and Canada are currently using Truth and Tales in classroom settings.
No. Truth and Tales does not build behavioural profiles of children, does not use personal data for advertising or marketing, and does not engage in behavioural targeting. The platform collects anonymous analytics events (which stories are played, how long sessions last) solely to improve the product. These events contain no personally identifiable information and cannot be linked to any individual child.
No. Push notifications are sent only to parent devices through the family (B2C) account. Children using school accounts do not receive push notifications. This aligns with the ICO Children's Code, which requires that default settings for children prioritise privacy and limit engagement-driven features.
Truth and Tales maintains a written data breach notification playbook. If a breach affecting personal data is confirmed, we will notify affected schools within 48 hours and relevant supervisory authorities (such as the ICO or ANPD) within 72 hours, as required by law. Affected families will be notified as soon as possible. Our security measures (encryption at rest and in transit, two-factor authentication, restricted access) are designed to minimise the risk and impact of any breach.
Truth and Tales is designed so that all children can benefit from Teaching Stories. The platform includes fonts developed to support reading for children with dyslexia, read-along word highlighting synchronised with narration, a colour palette suitable for colour blindness, adjusted visual contrast, subtitles across all content, professional narration for children with visual impairments, and simple game mechanics with accessible controls for children with reduced mobility.
Yes. Truth and Tales is currently available in English and Portuguese, with content localised for international audiences. The platform is used by over 100,000 families and educators worldwide. This privacy policy is available in English, Brazilian Port