Moonfox

Privacy Policy

Last updated 4 October 2026 (household identifier, App Attest; 3 October: speech on the iPhone only, crash reports, family recordings, story reports; earlier: sleep sounds, bedtime report, big days, night waking, reading for the family, printed books, crash reports, anonymous counts, AI training)

Moonfox makes a new bedtime story each night. A parent or guardian sets it up and controls it, and a child listens, looks and answers the story. This policy explains exactly what Moonfox keeps on your iPhone, what leaves it, who receives it and why, and how to delete it.

No account

Moonfox has no sign-up, login or password, and never asks for your email address, phone number, contacts or location. The first time it runs, the app creates a random identifier and keeps it in the device keychain. It isn't derived from your hardware or advertising identifier. Our server uses it to apply story limits, check whether you have a subscription, and stop abuse.

So that a subscription and your family's stories work on every iPhone in the family, the app also creates a second random identifier for the household and keeps it in your own iCloud key-value storage. Our server stores it next to your child's story world and any family-reading link, and RevenueCat uses it to recognise the subscription. To stop people from creating unlimited free stories, the app uses Apple's App Attest: our server keeps the public key Apple certifies for this copy of the app, with a counter, under the random identifier for a year. Neither identifier says anything about you or your child.

What you enter, and where it stays

A parent enters a child profile:

• an optional first name or nickname;
• an age, which the app turns into an age group (3–5, 6–8 or 9–12);
• interests, such as “foxes” or “space”;
• how the hero looks (hair, skin tone, eye colour, pyjama colour, and optionally glasses, freckles, hearing aids or a wheelchair);
• the chosen story friends;
• story preferences, and optionally a favourite toy and colour;
• optionally, the bedtime routine steps and bedtime;
• optionally, a birthday as a month and a day (never a year). It stays on your iPhone (and, when iCloud sync is on, in your own private iCloud): it moves the age group up on the birthday, and in the birthday week that night's story becomes a gentle celebration. Only the age the child is turning is sent with that story.

The profile, the story library and every picture and voice clip are stored on your iPhone. Deleting the app, or using Delete everything in Parent settings, removes them from the device.

What is sent to make a story

Writing, illustrating and narrating a story needs AI models, which run on servers. When Moonfox makes a story, it sends the following to our server, which forwards it to wiro.ai:

• the child's name, only so the narrator can say it (never in private mode). The models that write the story, check it and draw the pictures never see the name: our server replaces it with a placeholder first;
• the age group, interests, hero appearance and friends;
• story preferences, and the season and map stop the story belongs to;
• the random identifier described above.

wiro.ai runs the models that do the work: models made by OpenAI write the story, run the safety checks and draw the pictures, and a model made by Google records the narration.

• Private mode: the name is never sent, and the narrator says “little dreamer” instead.
• Something from today (optional): if you add one sentence about the child's day, it is sent with that night's story. It goes through a safety check first and is dropped if the check flags it.
• Bedtime Quest (optional): the routine steps you choose (for example “pyjamas, teeth”) are sent once, to write and record the friend's lines.

• Stories together (optional): when a brother or sister joins a child's story, the same details are sent for each child who is a hero in it (their name unless private mode is on, age group and drawn-hero choices).
• Language: the story language you choose (English, Spanish, German, French or Brazilian Portuguese) is sent so the story is written and read in it.

We never use your information to train AI models, and we don't sell it or share it for that purpose. We have asked wiro.ai to confirm in writing that neither it nor the companies whose models it runs train on what Moonfox sends; until they have, we can't promise that for them, and this page will say so once they do. We do not send photos of your child, their voice, contact details or location to make a story.

Photos of a toy, pet or drawing (optional)

If you choose to turn a favourite toy, a pet or a drawing into a story friend, that one photo is sent through our server to wiro.ai. A safety check refuses any photo with a person in it, and an accepted photo is redrawn as an illustration. Our server passes the photo through without storing it; only the finished illustration is kept. The photo stays wherever you took it from.

The child's voice

When the child answers the story (“the glowing flowers!”), the words are recognised by Apple's speech recognition on the iPhone only. On devices or languages where that isn't possible, the child taps their choice instead. The written words of what your child said are kept only on your iPhone, so you can read them in Parent settings; they are never uploaded. The microphone is only on while its light is lit. No recording of the child's voice is sent to us or to any AI provider, and none is kept. Live spoken conversation with the story is switched off. If we ever offer it, it will stay off until the provider confirms zero-data-retention terms, and this policy will change first.

Family goodnights (optional)

If you invite a relative, Moonfox creates a private link with a label you choose (for example “Grandma”). The voice messages they record on that page are stored on our server so your app can download them. Invite links expire 60 days after they are made. Recordings are deleted when you remove that person in Parent settings, even after the link has expired, and an expired link's recordings are also deleted automatically. Please only invite people who are happy for their recordings to be played to your child.

Reporting a story

If you report a story from the app, we receive the story's identifier, the scene, the reason you chose and any note you type, so that we can review it and improve the safety rules. The report is stored anonymously, without any identifier for your iPhone, and kept for a year.

Where information is kept, and for how long

Purchases

Subscriptions are sold by Apple. We use RevenueCat to confirm them: it receives the random identifier and Apple's purchase receipts, and is configured not to collect device or advertising identifiers. We never see your payment details. See RevenueCat's privacy policy.

Notifications

The optional bedtime reminder and the trial reminder are scheduled on your iPhone by the app itself.

"A new story is ready" (optional): so you don't have to keep the app open while a story is painted, the app sends our server two push tokens with that story's request: the device token Apple issues for notifications, and the token of the Lock Screen Live Activity. They are random identifiers issued by Apple, not your phone number or Apple Account. Our server uses them only to send, through Apple Push Notification service, the story's progress and one notification with its title. Neither the notification nor the Lock Screen Live Activity ever shows your child's name: the title is withheld whenever it would name anyone, and the Live Activity's “For …” line uses the private-mode wording when private mode is on. The tokens are kept with that story's job and deleted automatically within 14 days. You can switch both off in Parent settings → Notifications.

iCloud sync (optional)

When iCloud sync is on (Parent settings → iCloud), the children's profiles, their worlds and finished stories are kept in your own private iCloud database through Apple's CloudKit, so every iPhone signed in to the same Apple Account shares them. The story data is stored in CloudKit's encrypted fields. This data goes to Apple under Apple's privacy policy; Moonfox's servers never receive it and we cannot see it. Pictures and narration are not copied to iCloud; the other device downloads them again from our storage. Turning sync off stops it; Delete everything also removes the data from iCloud.

Keepsakes, the friend's message, moving covers and widgets

Each story can leave a small keepsake (a picture of one magical object) and a short message from a story friend about tonight's adventure. Both are written, painted and recorded with the story, from the same information as the story, and kept on your iPhone. With Moonfox Premium, tonight's cover can gently move: the app sends the cover picture it already has (nothing about the child) to our server, which asks wiro.ai for a five-second animation and stores it with the story's other pictures. The Home Screen and Lock Screen widgets show tonight's story title, its friend and the first name (left out in private mode); that information stays on the device. A keepsake book is made on your iPhone as a PDF and goes only where you share it.

Sleep sounds, bedtime report, big days and night waking

Sleep sounds after the story are made on your iPhone. The bedtime report in Parent settings (when bedtime started and ended, and night wake-ups) is kept only on your iPhone and is never uploaded. For a big day you pick from a short list (the dentist, starting school…); only the kind of day and "tomorrow" or "soon" are sent with that night's story request, never the date. For night waking, the friend's fixed comforting lines are recorded once by the same voice service as the stories, with your child's first name (left out in private mode), and then played from your iPhone. Read it myself listens to your child reading with Apple's speech recognition on the device only; nothing is recorded or sent.

Reading a story aloud for the family (optional)

You can create a private link that lets someone you choose read one story aloud from their own phone. The page shows that story's pictures and words; your child's name is added by their browser from the link itself and is never sent to our server. Their recordings are stored like family goodnights, go only to you, and you can delete them at any time.

Printed books (optional)

If you order a printed keepsake book, the pages are uploaded to our storage under an unguessable order number, you pay on Stripe's secure page (Stripe collects your card, address, phone number and email), and our printing partner Lulu receives the address, phone number and email to print and post the book. Moonfox's server keeps only the order number, its status and tracking links. Moonfox never sees your card.

How many families reach each step

To know whether Moonfox helps, the app tells our server once when a few steps first happen on an iPhone (setup finished, first story heard, a second and a seventh night, the Premium page seen, a picture shared, a family link made). We only keep a count per week of installation — never who, never which device, and nothing about your child. No analytics company is involved.

Crash reports

When Moonfox crashes or freezes, iOS can prepare a technical report. Moonfox sends a short version of it to our own server (what went wrong and where in the app's code, the app version and the iOS major version — never the iPhone model) so we can fix it. It is stored under the app's random identifier. It never contains a story, a name or anything your child said, it is kept for 90 days, and you can turn it off in Parent settings.

What we never do

• No advertising, and no advertising identifier (IDFA): Moonfox never asks to track you.
• No third-party analytics, crash-reporting or tracking SDKs.
• No selling or sharing of personal information, and no profiling.

Children

Moonfox is operated by a parent or guardian for their child. We collect only what's needed to personalise a story, and settings, links and purchases sit behind a grown-ups-only check. If you believe we hold information about a child that should be removed, or you want the server copies of your stories and recordings deleted, email menan@titanix.dev from Parent settings → Support. Include the support code shown there so we can find the right files, and we will delete them.

Your rights

You can see, change or delete the profile at any time in Parent settings. Private mode leaves the name out, and you can turn off the microphone, the Bedtime Quest, the reminder and family goodnights. You can also ask us to access or delete the server copies described above. Depending on where you live (for example the EU, UK or California) you may have further rights, and we will honour them.

Changes

If this policy changes, we will update it here and mention it in the app before the change affects you.

Contact

menan@titanix.dev