Privacy Policy
Nestoz, a Singapore company (“we”), operates Little Story (littlestory.me). We comply with Singapore’s Personal Data Protection Act (PDPA) and, for users in the Republic of Korea, with the applicable provisions of Korea’s Personal Information Protection Act. This policy explains what we collect, why, how it is protected, and the rights you have.
1. What we collect
- Account — email address and name/nickname (Google sign-in or email link sign-up)
- Family-space content — photos and videos of your child that you upload, milestone titles/descriptions, letters, and profile details such as your child’s name and birthday
- Automatic — access logs, browser information, and cookies (language preference, login session, PIN unlock state)
2. Why we use it
- Running your family space (storage, display, invite-only access control)
- Authentication and account management
- Safety screening of guest letters and KO/EN translation (AI processing, see §4)
- Anonymous usage statistics to improve the service
- Responding to support requests
3. Our promise about your child’s data
Content about your child is uploaded by you and visible only to the people you invite. We never use your child’s content for advertising, never sell or share it, and never use it to train AI models. When your child grows up and wants their records removed, they (or you) can request deletion at any time.
4. Processors we rely on
| Provider | Purpose |
|---|---|
| Google Firebase | Authentication and data storage |
| ImageKit | Image/video delivery (CDN) and optimization |
| Vercel | Hosting |
| AI content processing (currently: Google Gemini API) | Content safety screening, translation, photo auto-classification, drawing restoration |
| Google Analytics | Usage statistics |
| Google Ads | Ad performance and sign-up conversion measurement |
Only what each task needs is sent to the AI processing service: text (letters, titles, descriptions) for safety screening and translation, and photos for upload-time artwork/photo classification and the user-initiated drawing-restoration feature. Videos are never processed by AI. In all cases we use offerings whose provider policy excludes customer data from model training.
We do not share personal data with any other third party beyond these purposes. If a processor changes, we will update this policy and give notice.
5. Retention and deletion
- Account data and content are deleted promptly when you close your account or request deletion.
- Records we are legally required to keep are retained only for the statutory period.
6. Your rights
You can request access, correction, deletion, or restriction of your personal data at any time via hello@littlestory.me.
7. Cookies
We use cookies for login sessions, language preference, and PIN unlock state. The service may also use cookies and similar technologies for usage statistics and ad conversion measurement. You can refuse cookies in your browser settings; some features may stop working.
8. Contact
Privacy officer: hello@littlestory.me
9. Effective date
This policy takes effect on 2026-03-01.