Privacy Policy — Puppet Pals 1

Overview

Puppet Pals 1 is a creative storytelling app for children and families, distributed on the Apple App Store. We are committed to protecting the privacy of all users — especially children — and we comply with the Children's Online Privacy Protection Act (COPPA) and the General Data Protection Regulation (GDPR).

All content created in the app — puppet shows, recordings, drawn characters, photos imported from the device — is stored on the device and is never uploaded to our servers, with two clearly described exceptions: AI image processing (a paid feature) and optional video sharing (a paid feature behind a parent gate). Both are described in detail below.

Information We Collect

Anonymous Analytics

We collect basic, anonymous usage analytics through our own first-party analytics system. No third-party analytics services are used. This data cannot be linked to any individual user or device.

The anonymous analytics data includes:

• General app usage patterns and features used
• Country and region information in aggregate form
• Device type and operating system
• App version

AI Image Features (Subscription Only)

Puppet Pals 1 includes AI-powered features that allow subscribers to create stylized actors and backgrounds. Users can either submit a photo to be stylized into a puppet, or provide a text description to generate one from scratch. These features are only available to active subscribers and are disclosed during the subscription sign-up flow.

When you use an AI feature, the photo or text description is sent from your device to our servers, then forwarded to our AI processing partner fal.ai. fal.ai routes the request on our behalf to a third-party image model.

In plain English: when your child uses an AI feature, a photo from the device (with location and identifying metadata stripped) or a text prompt is sent through our servers to a third-party AI model. We do not store the photo or prompt on our servers. The third-party model processes the request and returns a generated image, which is saved on the device.

The current upstream image model is described on our AI Processing details page. Different models may have different terms regarding how they use customer inputs. Today's chain (Google's Gemini paid-tier API, reached via fal.ai) contractually prohibits training on customer inputs. We may change the upstream model in the future — based on cost, availability, abuse mitigation, or other operational needs — and future models may have different terms. We do not commit to advance notice of model changes. The AI Processing details page is updated when the chain changes.

Photos and prompts are not stored on Polished Play servers — only metadata about the request (timestamp, model, success/failure) is retained for billing and reliability monitoring.

Before sending photos to fal.ai, we strip EXIF metadata (including any GPS coordinates and device identifiers) from the image so that information does not leave the device. Generated images returned by fal.ai are stored on the fal CDN for 60 seconds (we set this explicitly per request — fal's default is 7 days), just long enough for our server to fetch and return the image to your device. Once on the device, generated images are stored on the device only.

Video Sharing (Subscription Only, Optional)

Subscribers can optionally share puppet show recordings through the app. This feature is gated behind both the subscription and a parent confirmation. When a video is shared:

• The video is uploaded to our servers (hosted on Amazon Web Services in the United States).
• Shared videos are automatically deleted after 10 days.
• No personal information is attached to shared videos.

Subscription Data

Puppet Pals 1 offers a subscription through Apple In-App Purchases. We store transaction identifiers from Apple on our servers solely to verify subscription status and enforce fair-use limits on AI features. All payment processing is handled entirely by Apple — we do not receive or store any payment information such as credit card numbers.

Parent Email Addresses (Optional)

Within the app, parents or guardians may optionally provide an email address to receive notifications about Puppet Pals updates. This feature is:

• Completely voluntary and optional
• Never shown to children — gated to adult-facing screens
• Used solely for sending app update notifications
• Never shared with third parties for marketing purposes

Feedback (Optional)

Parents or guardians may submit feedback about the app. Any information provided in the feedback form is voluntary and used only to improve the app.

What We Don't Collect

We do not collect any personally identifiable information from children. Specifically, we do not collect:

• Names, usernames, or contact information from children
• Precise location data
• Device identifiers or advertising IDs
• The contents of puppet shows, recordings, or any creations stored on the device
• Any information that could identify individual child users

There are no user accounts or logins in Puppet Pals 1.

How We Use Information

Anonymous Analytics

Anonymous usage analytics are used solely to:

• Improve app functionality and user experience
• Understand which features are most used
• Identify and fix technical issues
• Make informed decisions about future app updates

AI Image Data

Photos and text descriptions submitted for AI image generation are used by Polished Play solely to generate the requested image. Polished Play does not store them on our servers or use them for any purpose other than fulfilling the request. They are forwarded to the third-party AI processing chain documented on our AI Processing details page; how the upstream provider handles inputs depends on that provider's terms, which may change over time.

Parent Email Addresses

Parent email addresses are used solely to:

• Send notifications about app updates and new features
• Allow parents to stay informed about the app their children use

Feedback

Feedback submissions are used solely to understand user needs and improve the app.

Data Sharing and Third-Party Services

We do not sell, trade, or share user data with third parties for marketing or advertising purposes. We do not use any third-party analytics services.

The following third-party services are involved in the operation of Puppet Pals 1:

• fal.ai — AI image processing partner. Receives the EXIF-stripped photo or text prompt at request time, returns the generated image. fal.ai forwards the request to an upstream image-model provider on our behalf; the current upstream provider is named on the AI Processing details page. Generated images are stored on fal's CDN for the 60-second window we configure per request.
• Upstream image-model provider (reached via fal.ai) — The specific provider and model receiving the prompt and any photo at any given time is listed on the AI Processing details page. Different models have different terms regarding training and retention. We may route different requests to different models (for example, a different model for a subscriber who has hit usage limits), and we may change the default upstream provider over time. We do not commit to advance notice of these changes.
• Amazon Web Services (AWS) — Hosting for optionally-shared videos. Videos are automatically deleted after 10 days.
• Apple — Processes In-App Purchase subscriptions. Payment is handled entirely by Apple.
• Vercel — Hosts our API and website.

See the AI Processing details page for the technical specifics of each hop, including what we cannot promise about every link in the chain.

Changes to the AI Processing Chain

We may change the upstream image-model provider or model over time — for example, to manage cost, respond to model availability, address subscriber abuse, or take advantage of a new model. We may also route specific requests to different models (for instance, routing a subscriber who has exceeded usage limits to a different model). We do not commit to advance notice of these changes, and we do not commit that every model we use will have the same data-handling terms as the current upstream model. The AI Processing details page describes the current chain and is updated when the chain changes.

Parents who prefer not to continue using AI features after a change — or at any other time — may cancel their subscription through Settings → Subscriptions on the device. The rest of Puppet Pals 1 — all non-AI creation, recording, and playback features — continues to work without a subscription.

Data Retention and Deletion

• Photos and prompts sent for AI processing: not retained by Polished Play. Held by fal.ai during processing and up to 60 seconds afterward, then expired.
• Generated images: stored on the device only.
• Anonymous analytics: retained in aggregate form for product improvement; cannot be linked to individuals.
• Shared videos: automatically deleted after 10 days.
• Subscription transaction identifiers: retained for the duration of the subscription.
• Parent email addresses: retained until the parent requests removal.
• Feedback submissions: retained for as long as they are useful for improving the app.

Parents or guardians may request deletion of their email address or feedback at any time by contacting us at privacy@polishedplay.com.

Children's Privacy

Puppet Pals 1 is designed for children. We do not knowingly collect personal information from children. AI image features and video sharing require an active subscription and are disclosed in plain language during the subscription sign-up flow, which is intended for the adult who owns the device and Apple ID. The email-collection and feedback features are presented only on parent-facing screens.

We comply with the Children's Online Privacy Protection Act (COPPA) and the General Data Protection Regulation (GDPR).

Data Security

We implement appropriate technical and organizational security measures to protect the limited data we handle. All data transmission between the app, our servers, and our processing partners is encrypted using industry-standard TLS encryption. Server access is restricted to authorized personnel and requires multi-factor authentication. For full details, see the Data Security & Privacy Plan.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated effective date. Changes to the AI processing chain — including changes to the upstream model or model provider reached via fal.ai — follow the separate notice commitment in "Changes to the AI Processing Chain" above.

Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at privacy@polishedplay.com.