Privacy Policy

1. Introduction

Welcome to Dr Will's Bedtime Stories. We are committed to protecting your privacy and the privacy of your children. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and audio streaming service.

Dr Will's Bedtime Stories provides clinically-informed audio bedtime stories designed to help children relax and drift into restful sleep. Our service is operated in the United Kingdom and we comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Children's Online Privacy Protection Act (COPPA) where applicable.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Display name (optional)
• Profile avatar (optional)
• Password (encrypted)

2.2 Child Account Information

Parents/guardians may create child accounts linked to their own account. For child accounts, we collect:

• Display name chosen by the parent
• Listening preferences and history
• No direct contact information is collected from children

2.3 Usage Data

We automatically collect certain information when you use our service:

• Listening history (which stories have been played)
• Playback progress and completion rates
• Favourites and playlist information
• Story ratings and feedback
• Session start and end times
• Conversations with the Ask Dr. Will AI assistant
• Sleep records and 'fallen asleep' timestamps
• Bedtime routine checklist completions and streaks

2.4 Technical Data

For security and service improvement, we collect:

• IP address
• Browser type and version
• Device type and operating system
• Device identifiers
• User agent information

2.5 Subscription & Payment Data

If you subscribe to a paid plan, we collect subscription tier, billing period, and payment status. Payment processing is handled by our third-party payment processor, and we do not store your full credit card details on our servers.

3. Children's Privacy (COPPA Compliance)

We take children's privacy extremely seriously. Our service is designed for families, with parents/guardians maintaining control over their children's accounts.

3.1 Parental Control

• Child accounts can only be created by a verified parent/guardian account
• Parents have full visibility and control over their children's listening activity
• Parents can view, modify, or delete their children's data at any time
• Children cannot make purchases or change account settings

3.2 Limited Data Collection

We do not collect personal contact information directly from children under 13. We do not use children's data for targeted advertising. We only collect the minimum data necessary to provide the service.

3.3 Parental Rights

Parents have the right to:

• Review the personal information collected about their child
• Request deletion of their child's personal information
• Refuse further collection or use of their child's information
• Contact us with any questions about children's privacy

4. How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain our audio streaming service
• Track listening progress so you can resume where you left off
• Personalise your experience with favourites and recommendations
• Process subscriptions and manage account access
• Communicate with you about your account and service updates
• Analyse usage patterns to improve our content and service
• Protect our intellectual property and prevent unauthorised use
• Comply with legal obligations

5. Audio Watermarking & Content Protection

5.1 What is Audio Watermarking?

Audio watermarking is a technology that embeds invisible, inaudible identification data within audio streams. This watermark is imperceptible during normal listening but can be detected using specialised tools.

5.2 Information Embedded in Watermarks

Each audio stream contains a unique watermark that includes:

• A unique session identifier
• User account identifier
• Timestamp of playback
• Device information

5.3 Purpose of Watermarking

The sole purpose of audio watermarking is to protect our copyrighted content from unauthorised distribution. If our content is found being distributed illegally, the watermark allows us to identify the source of the leak and take appropriate action.

This is not surveillance. We do not use watermarking to track your listening habits beyond what is already collected for service functionality. The watermark data is only accessed if we need to investigate a copyright infringement.

5.4 Playback Logging

We maintain logs of audio playback sessions that include the watermark signature, IP address, user agent, and timestamps. These logs are used exclusively for content protection and security purposes.

6. AI-Powered Features

Dr Will's Bedtime Stories offers AI-powered features to enhance your experience. This section explains how we collect and use data in connection with these features.

6.1 Ask Dr. Will AI Assistant

Our Ask Dr. Will feature uses artificial intelligence to provide personalised sleep and bedtime advice. When you use this feature:

• Your questions and conversations are sent to AI service providers for processing
• The AI may access your account data (listener names, achievements, sleep patterns, listening history) to provide personalised responses
• Conversation history is stored in your account so you can continue previous conversations
• You can delete your conversation history at any time from your profile

6.2 Calm Notes

Our Calm Notes feature uses AI to extract helpful tips and summaries from our blog content. This feature does not use any of your personal data—it only processes our published blog articles to create useful nuggets of advice.

6.3 How AI Data is Protected

• All data sent to AI services is transmitted over encrypted connections (HTTPS/TLS)
• Your conversations are tied to your account and only visible to you
• We do not use your conversations to train AI models
• AI service providers are contractually bound to protect your data
• You can delete your AI conversation history at any time

7. Data Sharing & Third Parties

We do not sell your personal information. We may share data with:

7.1 Service Providers

• Cloud hosting and database providers (to store and serve content)
• Payment processors (to handle subscription payments)
• Analytics providers (to understand service usage)
• AI service providers (to power the Ask Dr. Will assistant and content analysis)

7.2 Legal Requirements

We may disclose information when required by law, court order, or government request, or when necessary to protect our rights, property, or safety.

7.3 Copyright Enforcement

If our content is found being distributed without authorisation, we may share watermark and account information with legal representatives or law enforcement to pursue copyright infringement claims.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Specific retention periods include:

• Account data: Retained until you delete your account
• Listening history: Retained for service functionality; can be cleared by request
• Playback logs (with watermarks): Retained for up to 3 years for copyright protection
• Payment records: Retained as required by tax and accounting laws

Upon account deletion, we will delete or anonymise your personal information within 30 days, except where retention is required by law or for legitimate legal purposes (such as copyright enforcement).

9. Your Rights

Under UK GDPR and applicable data protection laws, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data (subject to legal exceptions)
• Restriction: Request limitation of processing in certain circumstances
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent

To exercise these rights, please contact us using the details in Section 13. We will respond within 30 days.

10. Cookies & Similar Technologies

We use cookies and similar technologies to operate our service. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Access controls and authentication
• Regular security assessments
• Secure cloud infrastructure

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

12. International Transfers

Our service is primarily operated in the United Kingdom. Your information may be transferred to and processed in countries outside the UK where our service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

14. Referral Payouts & Bank Details

If you participate in our referral programme as a free user and choose to receive cash rewards, we collect and store the UK bank details you provide on your Profile page (account holder name, sort code, account number) along with a payout email address. These details are used solely for the purpose of paying you the rewards you have earned via UK BACS bank transfer.

Bank details are stored in our database with row-level security so that only you and authorised system administrators processing your payout can access them. We retain a snapshot of the bank details used for each completed payout for accounting and audit purposes for at least 6 years, in line with HMRC record-keeping requirements. You may delete your stored bank details at any time from your Profile; this will not affect already-completed payouts.

We do not share bank details with any third party other than our regulated banking provider used to execute the transfer. The lawful basis for processing this data is the performance of a contract (the referral programme terms) under UK GDPR Article 6(1)(b).

15. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us: