What personalized-book services say happens to your child’s photograph

Every cell is either a quotation from that service’s own privacy policy or the words "Not stated". Not stated means the document does not address the question. It is a statement about the document and nothing more: the company may well have a clear internal answer, and a parent reading the policy simply cannot find it.

All ten policies were fetched on 24 August 2026, and every phrase quoted here was checked against the raw page text rather than against a summary of it. Each policy is linked at the bottom of the page, and the date each document gives for itself is in the last column, so you can see how current the wording is. Company names are used only to identify whose policy is quoted; nothing here implies any affiliation or endorsement either way.

One disclosure, up front: we make one of the products in the table. Our row answers the same questions in the same terms. Judge the row against its link, not against the fact that we wrote the page.

Not "how long do you keep it". The one we would ask first is: while you do have it, can anybody else reach it? A photograph of a child sitting for two hours at a web address anybody can guess is more exposed than the same photograph sitting for two months where nothing can reach it but the server drawing from it. Retention is a duration. Reachability is the risk, and they are not the same axis.

Of the ten policies we read, none states how an uploaded photograph is stored - whether the address is guessable, whether a link expires, or whether the file is reachable by anybody who has the URL. One, Little Hero Book, refers to access controls in general terms. This appears to be the normal state of the market rather than an omission by any one company, and it is the single question we would put in an email before uploading anything anywhere.

Our own answer, because a page that asks the question should answer it: the photograph is stored at an address that cannot be guessed or derived from your book link or your child’s name, it is read only by our own servers while the portrait is being drawn, and it is never displayed on any page of the site. It is deleted as soon as you approve how the character looks, and an upload that is abandoned is deleted within seven days.

The tightest published commitment is Leo Books: "We do not store your uploaded photos beyond the time needed to generate your book... deleted promptly after generation." Magical Hekaya is close - photos are "not retained beyond the generation process unless saved as part of a completed book". The longest published figure is TaleTorch, whose policy states "All data is deleted after 1 year".

In between: Childbook.ai states "a maximum of 14 days after your subscription has come to an end"; Little Hero Book, "a maximum of 10 weeks from the date of creation, after which they are automatically and permanently deleted"; ToonyStory removes uploads "within 30 days" of account deletion, with backup copies persisting "up to 90 days".

Two documents give no figure. Custom Heroes does not state a retention period for photographs. Hero Story Books states that its "target is to remove uploaded photos... within a limited period after an order is completed or canceled" and that "the specific retention/destruction schedule is being finalized with counsel".

A shorter number is not automatically better, which is the one thing worth knowing before you compare the column. A file held for twenty minutes at an address anybody can reach is more exposed than one held for two months where nothing can reach it. Duration and reachability multiply, and only the first is published.

Six of the ten state plainly that uploads are not used to train models. ToonyStory: "We never use your photos, characters, or generated images to train AI models." Little Hero Book: "We and our AI partners do not use your photos or input data to train AI models." Custom Heroes: "We do not use your photos or stories to train AI models." Hero Story Books: "we do not use uploaded photos to train AI models", alongside statements that it does not clone voices or build face-recognition templates. Lullaby states that images "are processed but not stored by these services for training purposes".

Childbook.ai does not use the word training and states a purpose limitation instead: "We will not use the photos for any other purpose than to generate illustrations."

Three documents - TaleTorch, StoryStars and Magical Hekaya - do not address training in the versions we read.

One states the commitment conditionally. Leo Books: "We do not use your uploaded photos or your child’s personal information to train our proprietary models in a way that would make them publicly reproducible, unless you explicitly opt in." We quote it in full rather than summarise it, because the qualifiers are the part a reader will want to weigh for themselves.

Ours: uploaded photographs are never used to train any model, and they are never sold or shared for advertising. The illustration is drawn through a paid commercial API tier whose terms state that prompts and uploaded files are not used to improve the provider’s products and are not read by human reviewers - which is why we pay for that tier rather than using a free one. The full arrangement is written out on our own photo page.

One photograph, used for one thing: drawing the character who stars in your book. It is deleted as soon as you approve how that character looks - which for most people is minutes after uploading - and an upload that is never used is deleted within seven days. It is held at an address that cannot be guessed, read only by our servers, and never shown on a page.

It is never sold, never shared for advertising, and never used to train a model. You can delete your books, your photographs and your account yourself from your account page at any time, which removes the images for good rather than hiding them.

What we will not claim is that uploading a photograph anywhere carries no risk at all. What we can do is write down exactly what happens to it, keep the wording current, and hold ourselves to the same questions we are asking everybody else on this page.

Open the privacy policy and search the page for "photo". If the word does not appear anywhere, the document is not addressing the thing you are worried about. Then search for "train", and for "retain" or "delete".

Read the date at the top. A policy that has not been updated since before photo-personalized books existed has not been asked your question.

Then look for what is missing rather than what is written. Almost no policy in this market says how the uploaded file is stored or who can reach it, so if that matters to you - and we think it is the thing that matters most - the answer has to come from asking them directly. A company that answers that question in writing is telling you something useful whatever the answer is.