Privacy Policy

The short version

We collect the minimum needed to make your book: your account email, the child's first name, age, gender and interests you choose to share, and the photo you upload. The photo is used for one thing only - creating your book's illustrations. We never sell personal data, we don't run third-party ad trackers, we don't use your photos to train AI models, and you can delete everything from your account page at any time.

Children's privacy

Hero of You is a service for parents and guardians (18+). It is not directed to children, and we do not knowingly let children create accounts or upload their own information. A child's first name, age and photo are provided by the adult making the book, who confirms they are the parent or guardian (or have their permission).

If you believe a child has provided us information directly, contact us at shushanran@gmail.com and we will delete it.

Your child's photo and details

Photos are uploaded by you - the parent or guardian - never collected from children directly. The photo is stored securely (Vercel Blob storage) and sent to Google's Gemini API to derive the illustrated character; the generated art is what appears in the book.

We do not use your photos or your child's details to train AI models, and we do not sell them or share them with anyone except the processors listed below, strictly to provide the service. You can delete the photo and the book from your account at any time.

What we collect

Account: email address, name (optional), a hashed password (never the password itself) or your Google account id.

Book creation: the child's first name, age, gender/pronouns, interests, occasion, dedication text, and the uploaded photo.

Orders: the shipping name and address you enter for printed books, and your order history. Card details go directly to Stripe - they never touch our servers.

Technical: basic, privacy-friendly, cookieless page analytics (Vercel) - no cross-site tracking and no advertising identifiers.

How we use your data, and our legal basis

We use your data to create and deliver your book, process payments and shipping, provide support, honor the guarantee, keep the service secure, and meet legal and accounting obligations.

Where the law (such as the EU/UK GDPR) requires a legal basis, we rely on: performing our contract with you (making and delivering the book); your consent (uploading a child's photo for illustration); and our legitimate interests (running, securing and improving the service). You can withdraw photo consent by deleting the photo.

Who processes data for us

Stripe (payments), Gelato (printing and shipping of physical books - receives the book file and shipping address), Google Gemini API (story text and illustrations - receives the photo and personalization details), Vercel (hosting, file storage, analytics), Neon (database), Resend (transactional emails such as order confirmations). Each acts on our instructions to provide the service.

International data transfers

We operate primarily in the United States, and our providers may process data in the US and other countries. Where data is transferred internationally (for example from the EU/UK), we rely on appropriate safeguards, such as our providers' standard contractual clauses, to protect it.

How we keep data safe

Data is encrypted in transit (HTTPS), passwords are stored only as salted hashes (never in plain text), sign-in uses a secure HttpOnly session cookie, and access to systems is limited. No method is perfectly secure, but we take reasonable steps to protect your information.

Emails and communications

We send transactional emails only - things like order confirmations, print approvals and shipping updates. We do not send marketing emails without your consent, and any such email would include an unsubscribe link. Support replies go to the address you write from. Questions: shushanran@gmail.com.

Cookies

One essential HttpOnly session cookie keeps you signed in. That's it - no advertising or third-party tracking cookies, which is why there is no cookie banner.

Your rights

You can access, correct, download or delete your data. "Delete my account" on the account page erases your books, pages, child profiles, uploaded photos and generated art, and scrubs your account details.

Depending on where you live (for example under the EU/UK GDPR or the CCPA in California), you may also have rights to portability, to object to or restrict certain processing, and to lodge a complaint with your data-protection authority. We do not sell personal information. To exercise any right, email shushanran@gmail.com.

Retention and deletion

Books, photos and profiles stay in your account until you delete them. Order records (amounts, shipping details) are kept as required for accounting, refunds and disputes, then removed when no longer needed.

Changes and contact

We may update this policy as the product evolves; material changes will be shown here with a new "last updated" date. Privacy questions or requests: shushanran@gmail.com.