Little faces. Thoughtful care.

What we collect. Your parent account email is managed by Firebase Authentication. We keep your consent version and time, the three checked reference photos and thumbnails, the artwork and editable storybook text, job status, private PDFs, and optional sharing-link settings. We store no facial-recognition templates or similarity scores.

How photos are processed. Our server decodes and re-encodes photos, normalizes orientation, and strips embedded EXIF/GPS metadata. Google Cloud Vision performs synchronous face-count and safety checks. We discard facial landmarks and keep no recognition database. We do not automatically establish that different photos show the same child; the uploading adult confirms that.

External AI processing. OpenAI Images receives the three reference photos and, for later scenes, the character illustration you approve. API content is not used to train OpenAI models by default. This deployment uses standard API retention, not Zero Data Retention. OpenAI may retain photos, prompts and generated content in abuse-monitoring logs for up to 30 days, or longer when legally required or reasonably necessary for safety. Deleting a book does not delete these provider logs. OpenAI advises against processing personal data from children under 13 without Zero Data Retention. Image inputs flagged for potential child sexual abuse material may still be retained for manual safety review, even with that setting. Google Cloud separately performs photo checks. Processing may occur internationally. Provider safety records cannot be deleted through Little Futures. We do not promise zero provider retention.

Original-photo retention. Reference photos and thumbnails become inaccessible after 23½ hours and are scheduled for physical removal every five minutes, with a one-day storage lifecycle rule as a backup. Finalizing a book deletes references sooner. If a cleanup operation fails, it is retried and reported as an operational failure. Regeneration after reference deletion requires uploading three new photos.

Generated-content retention. Books, generated artwork and PDFs expire after 30 days by default, or earlier if the deployment uses a shorter retention period. They become inaccessible immediately at expiry. Scheduled cleanup removes the stored files. Storage versioning and soft deletion are disabled for the sensitive bucket in the reviewed live configuration. Infrastructure security metadata and provider safety exceptions may have separate retention; deletion is not a promise of instant erasure from every vendor system.

Your controls. You can edit story text, retry illustrations while references exist, finalize a book, delete a project, or delete your Little Futures account and all its content. Deletion immediately blocks access and cancels queued work. An external AI request already in progress may still finish; its result is discarded after cancellation or deletion. Minimal deletion markers remain to prevent unfinished jobs from recreating content.

Private sharing. Books are private by default. Only your explicit action creates a revocable, high-entropy sharing link. Links expire after seven days or at the book’s deletion date, whichever is earlier. You may add a passcode. Links share only approved storybook pages, never the reference photos. Anyone with an unprotected link can view those pages. Revoking a link cannot recall screenshots or downloaded copies.

Security and use. Private files are stored in Google Cloud Storage and accessed through authenticated server routes. Structured records are stored in Firestore; generation work uses Cloud Tasks. Google Cloud encrypts traffic and stored data. We include no advertising, image-content analytics, session replay, or model training, and no routine administrator photo-browsing feature. Hosting, authentication and security services still process operational metadata.

Relevance of AI. AI likeness is approximate. Review the character preview and final pages before approving or sharing them. Resolution is measured from the actual files; low-resolution art is not presented as print-ready.