Rooted Tales · XenWinx
Privacy Policy
Rooted Tales is a reading app for children, made by XenWinx ("we", "us"). This page explains what information the app collects, why, who helps us handle it, and how parents can see it or have it deleted. We have kept it as short and plain as we can.
1. Children and parents
Rooted Tales is made for children aged 4 to 12 to enjoy with a parent or guardian. Accounts are meant to be created by a parent or guardian, or by a child with a parent's permission and help. We do not ask children for their real name, home address, phone number or location, and we ask parents not to put that kind of information into usernames or profile fields.
If you believe a child has given us personal information without a parent's permission, please email hub@xenwinx.com and we will delete it.
2. What we collect
| Information | Why we need it | Required? |
|---|---|---|
| Email address | To create and sign in to the account, confirm the email, and reset a forgotten password. | Yes |
| Username | To show a name inside the app. Please use a nickname, not a real full name. | Yes |
| Password (or Google sign-in) | To protect the account. Passwords are stored in scrambled (hashed) form and we cannot read them. If you choose Google Sign-In, Google confirms your identity and shares your email address and basic profile details with us. | Yes, one of the two |
| Reading and app activity | To save reading progress, bookmarks, points, badges, daily streaks, chosen theme, avatar and settings so they follow the child to a new phone. | Yes |
| Purchase records | To remember which books and membership an account owns. Payments are handled by Google Play; we never see card or bank details. | Yes, if you buy |
| Profile photo | Only if a parent chooses to upload one. Built-in avatars are available instead, and we recommend them. | Optional |
We do not collect precise or approximate location, contacts, calendar, photos from the device gallery (other than a single picture chosen on purpose), audio or video recordings, advertising IDs or device identifiers for tracking.
3. How we use information
We use the information above only to run the app: signing in, saving and syncing progress, delivering purchases, sending account emails such as confirmation and password reset, answering support requests, and keeping the service secure. We do not use it for advertising, profiling or marketing to children, and we do not sell or rent it.
4. Who handles data for us
We use a small number of service providers. They act on our instructions and may not use the data for their own purposes.
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Hosts sign-in and the database that stores each account's profile and progress. | Email, username, password hash, profile and progress data, optional profile photo |
| Google Sign-In | Optional "Continue with Google" login. | Google shares your email address and basic profile details with the app when you choose it |
| Google Play Billing | Processes purchases and subscriptions and tells the app what has been bought. | Google handles payment details itself. The app sees only which products are owned |
| ElevenLabs | Creates the voice narration for stories. | Story or sample text and the chosen voice. No account or personal information is sent |
We may also disclose information if the law requires it, or to protect the safety of a child or of our service.
5. Security
All data moves between the app and our servers over encrypted connections (HTTPS). Database access rules ensure each signed-in account can read and change only its own record. No system is perfectly secure, but we work to protect information and will notify affected families if a breach occurs, as the law requires.
6. How long we keep data, and deleting it
We keep account information for as long as the account exists. When a parent asks us to delete the account, we delete the sign-in account and the profile, progress, purchase records and photo linked to it. Full steps are on the account deletion page. Deleted data may remain in routine encrypted backups for a short time (up to 30 days) before being overwritten.
7. Parents' choices
A parent or guardian can at any time: ask what information we hold about their child; correct it; ask us to stop collecting more; or ask us to delete the account and its data. Write to hub@xenwinx.com from the email address on the account. We reply within 30 days.
8. Device permissions
The app needs internet access to sign in, sync and load stories, may use network state to detect when you are offline, may use vibration for feedback, and uses Google Play for purchases. If a parent uploads a profile photo, Android's own picker is used and the app sees only the one picture that was chosen.
9. Changes to this policy
If we change how we handle data, we will update this page and the date above. If a change is significant, we will tell parents in the app or by email before it takes effect. If we ever add advertising, we will update this policy first and name the partner.
10. Contact us
XenWinx
Email: hub@xenwinx.com
Website: xenwinx.com