At CoCoBun AI, we care about your personal information, therefore we have prepared this Privacy Policy to explain how we collect, use, share, and protect information when you use the CoCoBun AI mobile application, our website, and related services (the "Service"). Most of what we collect happens inside the app. Our website collects very little: an email address if you choose to give us one, and the details you fill in if you use our account deletion form. See section 3(D).
1) General
- We collect only what we need to provide the Service.
- We do not sell personal information, including children's personal information, to third parties.
- We do not allow targeted behavioral advertising in the child experience.
- Parents/guardians control the child's information.
2) COPPA and Children Under 13
CoCoBun is designed for children, but a parent or legal guardian must provide consent where required by COPPA before we collect personal information from a child beyond what is permitted for "internal operations."
How we ask for permission. Setup starts with a grown-up's email address. We email a link to that address, and the account cannot be set up until the link is used. A day or two later we send a second email confirming that permission was given, so a parent who did not set the account up can tell us and we will delete it. We do not collect anything about a child until that is done.
Parents have the right to:
- review the child's information,
- request deletion,
- refuse further collection/use,
- withdraw consent (which may limit features).
To protect children's privacy, certain areas of the app - including account settings, registration, and any subscription or payment-related screens - are accessible only through a parent gate secured by a passcode known to the parent or guardian. Children cannot access, modify, or delete account information without parental authorization.
To make a request, contact us at: privacy@cocobunai.com
3) Information We Collect
A) Information Parents Provide
- Parent email (account, support, required notices)
- Billing/subscription info (handled by Apple/Google; we typically do not receive full payment card details)
- A voice recording, if a grown-up chooses to record their own voice for story narration (see section 6)
B) Information Children (or Parents on behalf of children) Provide
Depending on features enabled:
- Child nickname / profile name (can be an alias)
- Child's age in years (for COPPA and age-appropriate content). We do not ask for a date of birth.
- Text prompts (story ideas, character names)
Children do not record their voices. Only a person aged 18 or over can record a voice in CoCoBun, and only their own voice. See section 6.
We do not intentionally request a child's:
- address, phone number, precise geolocation, government ID
If you enable parental activity monitoring, we may collect data such as time spent in the app and features used. This information is visible to parents or guardians only, is not shared with third parties, and is processed via Apple's Family Controls framework.
C) Automatically Collected (Device/Service Data)
- device type, OS version
- basic log data (IP address, timestamps, crash reports)
- performance metrics necessary to keep the Service working
- a notification token for each device, if you turn notifications on, so we can send alerts such as a story waiting for your approval. A device's token is deleted when you sign out on that device, and all tokens are deleted when you delete your account.
We use these for internal operations such as security, debugging, and reliability.
If a user chooses to use the voice-to-text (dictation) feature while using the app, this functionality is provided by the device's built-in dictation feature (such as Apple's iOS dictation) and is subject to Apple's own privacy policy. We do not collect or store the audio input from dictation; only the resulting text is received.
D) Information Collected Through Our Website
Our website collects an email address, and only when you choose to give us one — by joining the waitlist, or by writing to us at one of the addresses published on the site. Our website carries no advertising trackers and no third-party analytics.
- What we use it for: to send you news about CoCoBun, including when the app becomes available, and to reply to you if you have written to us.
- What we do not do with it: we do not sell it, we do not share it with advertisers or data brokers, and we do not use it for behavioral advertising.
- How to get off the list: every email we send has an unsubscribe link, or you can write to privacy@cocobunai.com and we will remove you and delete the address.
- How long we keep it: until you unsubscribe or ask us to delete it.
The waitlist is for grown-ups. Please do not enter a child's email address, and please do not let a child submit the form.
The account deletion form. Our account deletion page is the one other form on the site. It asks for the email address on the account, what you would like us to delete, a note if you want to tell us which child profile you mean, and a tick to confirm the account is yours. We use it only to find the account and carry out your request, and we delete the request itself once the work is done.
4) How We Use Information
We use information to:
- create and deliver personalized stories and audio,
- maintain account functionality and story history,
- provide customer support,
- protect safety and security, prevent abuse,
- improve reliability and performance (bug fixes, crash diagnostics).
We do not use children's information for behavioral advertising.
5) How We Share Information
We share information only with service providers that help operate the Service, such as:
- cloud hosting and storage providers, which hold your account, your stories, and your voice model;
- a generative text provider, which receives the story prompt in order to write the story;
- a generative image provider, which receives the image prompt in order to draw the illustrations;
- a text-to-speech provider, which receives the story text and the voice model in order to narrate the story;
- app store providers for subscriptions (Apple and Google).
We send these providers only what they need to do their job. The providers that write the story, draw the pictures and read it aloud receive the story text and the prompts, and nothing else. We do not send them your child's profile, your account details, or any identifier that would let them work out who a story belongs to. Our cloud host is the exception, because storing the account is its job. Every provider must handle what we send on our behalf and on our instructions only, consistent with this Privacy Policy. None of them use it to train their own AI. With most providers this is a term of our written agreement. Where a provider offers it as an account setting instead, we have turned that setting on and we check it.
We do not share children's personal information with:
- advertisers,
- data brokers,
- social networks for targeting.
6) AI Processing, Voice and Biometric Data
CoCoBun stories are made by AI. The words, the pictures and the narration in a CoCoBun story are generated by artificial intelligence, not written or drawn by a person. We say so in the app as well.
If you enable AI/voice features, relevant text and/or audio may be processed by third-party AI providers to generate story content.
Important: AI outputs are generated from the inputs we send. A provider may keep short-term logs for safety and abuse prevention. We configure providers to keep as little as possible, and none of them use what they receive for their own purposes.
Voice recordings and voice models
When you record a voice so CoCoBun can narrate stories in it, two different things exist, and we treat them differently.
- The original recording. This is the audio you actually recorded. It is used once, to create the voice model, and is then permanently deleted from our systems immediately. We do not keep it, we do not store a copy, and we do not share it.
- The voice model. This is what the recording produces — a synthetic version of the voice. We do keep this, because it is what lets you narrate new stories in that voice later without recording again. Without it, you would have to re-record every time.
The voice model is stored with your account and is used only to narrate stories for your account. It is not shared with other families, it is not used to narrate anyone else's stories, and it is not used to train anyone's models.
You can delete a voice model at any time from inside the app, and doing so removes it from our systems. It is also deleted if you delete your account. Note that deleting a voice in the app deletes the voice model — the original recording is already gone, because we deleted it when the voice was first created.
Who may record
Only a person aged 18 or over may record a voice, and only their own voice. Children do not record. The recording screen sits behind the grown-up passcode, and before recording starts the person is asked to confirm that they are 18 or over and that the voice is their own.
Voice models and biometric laws
Some state laws, including in Illinois, Texas and Washington, treat a voiceprint as biometric information. A CoCoBun voice model is built from a person's voice, so we treat it as biometric information whether or not a particular law would require us to.
Before anyone records, we tell them on screen what we collect, what it is for, and how long we keep it, and we ask for their agreement. We keep a record of that agreement. We never sell, lease, trade or otherwise profit from a voice model, and we never use one to identify anybody.
How long we keep a voice model, and how we destroy it
- Until the person who recorded it, or the account holder, deletes it in the app.
- Until the account is deleted.
- Until 12 months pass with nobody signing in to the account.
- Three years after the day a voice was recorded, we email the account and ask whether the voice is still wanted. If nobody confirms, we delete it. If it is confirmed, we ask again three years later.
Whichever comes first is when we destroy it. Destroying it means deleting the voice model from our systems and instructing our text-to-speech provider to delete its copy. Encrypted backups are purged on the schedule in section 7.
One exception. When someone agrees to have their voice recorded, we keep a short record of that agreement: the name they gave, the date, which version of this notice they saw, and a scrambled code made from the account's email address. The code lets us match the record to the right account after the account is deleted. It is one-way, so it cannot be turned back into the email address, and we do not keep the email address itself in this record. We keep that record for up to five years, even after the voice itself is gone, because it is our proof that permission was given. The record does not contain the voice or any audio.
If you recorded a voice and the account is not yours
A grandparent, a family friend, or anyone else who recorded a voice can ask us to delete it directly, without going through the family. Write to privacy@cocobunai.com and tell us the name you gave when you recorded. We will delete that voice model and write back when it is done.
7) Data Retention
We keep information only for as long as we need it to run the Service, and we do not keep any of it indefinitely. This is what we hold and for how long.
| What we hold | How long we keep it |
|---|---|
| Original voice recording | Deleted immediately once the voice model has been created. Never stored, and never kept if the cloning fails. |
| Voice model | While your account is open, or until the voice is deleted in the app. Purged within 30 days of a deletion request. Deleted after 12 months with no sign-in. We email for confirmation every 3 years from the day it was recorded, and delete it if nobody confirms. |
| Parent account details (email, name, sign-in tokens) | While your account is open. |
| Child profile (nickname, age, avatar, preferences) | While the parent account is open. |
| Saved stories, and their text, illustrations and audio | While your account is open. Deleting a story deletes its pictures and audio with it. |
| Stories you didn't save | Deleted as soon as the session ends. They never reach our database. |
| Activity data (if parental monitoring is on) | While your account is open. Visible to the parent only. |
| Sign-in session tokens | For the length of the session. Refreshed when you sign in, cleared when you sign out. |
| Payment details | We never store these. Subscriptions are handled entirely by Apple and Google. |
| Usage and feature analytics | 12 months, on a rolling basis, then automatically purged. |
| Questions a child asks that we pass to a parent | 90 days, then deleted. Never used for anything else. |
| Content moderation flags | 12 months, after which only anonymous totals remain. |
| Server and error logs | 90 days, then automatically purged. |
| Waitlist email address | Until you unsubscribe or ask us to delete it. |
When you delete your account. A parent can delete the account at any time, from inside the app or by using our account deletion request page. We purge everything — account, child profiles, stories, voice models and their assets — within 30 days. Deleted data may persist in our encrypted backups for up to 90 days before those backups are fully purged.
If you stop using CoCoBun. We don't hold on to a family's data forever. If nobody signs in to an account, we work to a clear schedule:
- 3 months: we email to check whether you'd like to come back.
- 6 months: we email again to ask whether you'd like to come back.
- 11 months: we send a final notice warning that the data is about to be deleted.
- 12 months: if we still haven't heard from you, we permanently delete the account, the child profiles, the stories, the voice models and every associated file.
Removing the app from your device does not by itself delete your account — if you want the data gone, please delete the account, or simply let the 12-month schedule above run its course.
A lapsed subscription is not a deletion. If a paid subscription ends, the account stays open on the free plan and nothing is deleted.
Staying signed in. If you choose to remain signed in, your session is maintained until you sign out or we detect a security concern that requires you to sign in again.
8) Security
We use reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit and access controls. No method of transmission/storage is 100% secure, but we work to protect your data.
In the event of a data breach that affects your personal information, we will notify you as required by applicable law.
9) CoCo's Library and Third-Party Services
The Service includes CoCo's Library, a parent-gated community where families can share the stories they have made. Sharing is optional and off by default: everything your family creates stays in your own Bookshelf unless it is published from your account. A child can ask to share a story, but it is only published after a parent approves it, and a parent can unpublish any story at any time.
When a story is published, other families see the story, the profile name on it, and the profile picture. They do not see your email address, your child's age, or anything else from your account. We ask that you do not use your child's real name or a real photograph of your child as the profile name or picture on a published story — the app offers names and pictures you can pick instead.
Anything published can be reported with the Report button in the app, or by writing to us at hello@cocobunai.com, and a parent can unpublish or delete their family's own stories at any time. We review reports and may remove a story, or suspend an account, where content breaks our Terms of Service.
The Service may also contain links to third-party websites or services. These links are intended to be accessed by parents and are governed by the third party's own privacy policies. CoCoBun AI is not responsible for third-party practices.
We may use trusted third-party service providers to operate and support the Service in accordance with this Privacy Policy.
10) Your Privacy Rights
Depending on where you live, you may have rights to access, correct, or delete personal information. Parents may exercise COPPA rights for children as described above.
You may also request a copy of the personal information we hold about you or your child by contacting us at privacy@cocobunai.com. We will respond to data access and deletion requests within 30 days.
To delete your account, you can use the delete option in the app's account settings, or fill in our account deletion request page if you no longer have the app installed.
If you live in the UK or the European Union
You have everything above, and these as well. Write to privacy@cocobunai.com and we will reply within one month.
- Object to processing we carry out on the basis of our legitimate interests, such as content moderation.
- Restrict processing while we look into a dispute with you.
- Port your data. We will send you an export of your child's stories in a format you can use elsewhere.
- Withdraw consent at any time, and as easily as you gave it. Voice recording and marketing email are both switches in Settings.
- Complain to a regulator. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EU it is the data protection authority for the country you live in.
A voice model counts as special category data under UK and EU law. We only make one where the person has given clear, separate permission first, and we never make one from a child's voice.
Our UK and EU representatives
We are based in the United States. If you live in the United Kingdom, the European Union or the wider European Economic Area, you can contact the representative we have appointed there. This is required by Article 27 of the UK and EU GDPR. The representative receives privacy questions and requests on our behalf and passes them to us. You are also welcome to write to us directly at privacy@cocobunai.com.
EU representative
Euverify Limited (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road, Cork
T23 AT2P, Ireland
Email: gdpr@euverify.com
UK representative
Euverify Ltd (UK)
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom
Email: gdpr@euverify.com
This badge confirms that we have appointed representatives in the EU and the UK under Article 27.
Where your information is held
CoCoBun is run from the United States, and information is stored and processed there. If you are in the UK, the EU, or another country with rules about sending data abroad, that transfer is covered by Standard Contractual Clauses — the standard terms approved by the European Commission for this purpose — together with the UK Addendum. We put the same safeguards in place with the providers that handle this data on our behalf.
Everywhere else
CoCoBun is available in many countries. Wherever you live, you can ask us to show you what we hold about you or your child, correct it, delete it, or stop using it. Write to privacy@cocobunai.com. Where the law where you live gives you more than this policy does, we follow the law where you live.
11) Changes to This Policy
If we materially change this Privacy Policy, we will update the "Last Updated" date and may notify parents via email and/or in-app notice.
12) Contact Us
Privacy questions or requests: privacy@cocobunai.com
CoCoBun AI, Inc.
92 Corporate Park, Ste C #1066
Irvine, CA 92606
Phone: +1 (949) 436-9778
Email: privacy@cocobunai.com