Privacy Policy

Chronicle Creations Inc. ("we," "us," or "our") values your privacy. This Privacy Policy explains how we collect, use, and protect your information when using Dreambook, an application currently available on the Apple App Store. Visit dreambook.kids for more info.

Dreambook is designed for children under parental supervision. We comply with applicable privacy and child-protection laws in each market where Dreambook is available, including COPPA in the United States (as amended in 2025), PIPEDA in Canada, the UK Data Protection Act and Age-Appropriate Design Code in the United Kingdom, the GDPR in the European Union and European Economic Area, the Privacy Act 1988 (as amended in 2024) in Australia, the Privacy Act 2020 (as amended in 2025) in New Zealand, the Personal Data Protection Act in Singapore, and the data protection laws of Japan, South Korea, Taiwan, the Philippines, Malaysia, the United Arab Emirates, Israel, South Africa, and Switzerland. Specific regional protections are detailed in Section 10 of this Policy.

This Privacy Policy applies to the Dreambook application and the data we process through it. It does not apply to third-party services or platforms that Dreambook may interact with for its operation (such as the Apple App Store), each of which is governed by its own privacy practices. Dreambook does not contain links to external third-party websites accessible by children.

1. Made for Kids Designation

Dreambook is submitted to the Apple App Store under the Made for Kids designation in the Ages 6-8 age band. Apple's Made for Kids designation requires developers to declare a single age band, and the 6-8 band represents Dreambook's primary target audience. Within the app, our story-generation system adapts content across three age bands (5 and under, 6-8, and 9 and up) allowing parents to set a profile for each child that matches their reading and comprehension level. This means younger and older siblings in the same household are supported alongside our primary 6-8 audience.

The Made for Kids designation places Dreambook under Apple's strictest privacy and safety requirements, including App Store Review Guidelines 1.3 (Kids Category) and 5.1.4 (Kids). In line with these requirements, Dreambook does not include third-party advertising, behavioral advertising of any kind, third-party analytics that transmit personal information without parental consent, or cross-app tracking. Parental gates protect access to commerce, external links, and sensitive features. Where personal information is collected from children, we obtain Verifiable Parental Consent through Kids Web Services by Epic Games. The app's experience is designed to be appropriate for our declared age band.

These commitments apply across all markets where Dreambook is available and supplement the regional regulatory frameworks described elsewhere in this Policy.

Different jurisdictions define the age at which a person is considered a child for privacy purposes at different levels. COPPA in the United States and the Singapore Personal Data Protection Act both apply heightened protections to children under 13. The California Consumer Privacy Act 2026 Regulations classify the personal information of consumers under 16 as sensitive personal information. The UK Children's Code, the GDPR, and similar frameworks apply protective measures to all minors under 18, with stronger requirements at younger ages. Dreambook applies the most protective applicable threshold to each user based on their location, with universal protections (no behavioral profiling, no third-party advertising, no cross-app tracking, parental gates for sensitive features) layered on top of jurisdiction-specific requirements.

2. Information We Collect

2.1 Information You Provide

When parents create an account, they provide an email address used for authentication and account-related communication. Parents may optionally subscribe to product updates and may unsubscribe from such communications at any time.

When an educator creates an educator account, they provide their name, the name and country of their school, their role, and a work email address. Educator accounts are described in Section 2.4.

When parents use the Custom Narrator feature, they provide voice recordings as described in Section 4.3.

2.2 Information About Children

Dreambook may collect personal information about children only with verified parental consent and only as needed to provide app functionality. For voice cloning, this is handled through the dual-path consent architecture described in Section 4.3. For other features, the system records the child's selections (such as character choices, character looks, story tones, settings, themes, and story type archetypes) to generate stories and maintain the family's library and journal entries. Where a parent has chosen to record a child's voice for the Custom Narrator feature, the resulting voice recording and synthesized narrator are also collected and processed as described in Section 4.3.

Each child profile has a name chosen by the parent or educator. A nickname works just as well as a real name. Profile names are stored to personalize the app, can be changed or deleted at any time, and are never sent to our AI story provider.

2.3 Automatically Collected Information

When the Dreambook app is in use, we automatically collect a limited set of operational and diagnostic information necessary to keep the app running, identify and fix bugs, and improve the user experience.

Operational and diagnostic data collected includes device information (device model, operating system version, app version, and language settings, used to ensure the app functions correctly across different devices and to diagnose compatibility issues); crash reports (when the app crashes or encounters an error, diagnostic information about the failure such as the error type, the screen where it occurred, and relevant technical context is sent to help us identify and fix the issue); and usage events (records of user actions within the app such as which features were used, which story categories were selected, and how long sessions lasted, used to improve the app and identify which features are working well).

All operational and diagnostic information collected from the Dreambook app is sent to Chronicle Creations' in-house operational system. We do not use any third-party analytics services such as Google Analytics, Firebase, Mixpanel, or similar tools. This is consistent with our Made for Kids designation requirements and ensures that children's app usage data is not transmitted to outside companies for analytics purposes.

Our servers record IP addresses in access logs, which we use only for security, fraud prevention, and troubleshooting. These logs are kept for no more than 90 days and are never used for advertising, profiling, or tracking. The app does not use Apple's Identifier for Advertisers (IDFA), Apple's Identifier for Vendors (IDFV), or any custom device identifier or fingerprinting technology to track users.

The Dreambook app does not use cookies. The app may use Apple-provided technical identifiers necessary for the app to function on the iOS platform; these are governed by Apple's own privacy practices.

Apple itself collects certain App Store and platform-level data (such as App Store transactions, crash logs, and aggregate app analytics) in accordance with Apple's privacy policies, which are independent of Dreambook.

2.4 Educator Accounts

Teachers and other educators may create an educator account to use Dreambook with their class. Educator accounts work as follows:

• Educator information: the educator's name, school name and country, role, and work email address, used to create and manage the account and to communicate with the educator.
• Student profiles: each student profile may use only a first name, nickname, or number. Educators must not enter students' last names or other identifying details.
• Features: custom voice recording and story sharing are not available in educator accounts. Students choose from the same predefined story options as every Dreambook user.
• Classroom stories: stories created in educator accounts are never used in our Dreambook Originals, curated collections, or marketing, as described in our Licensing Agreement.
• Payments: educator plans are purchased on dreambook.kids and paid through Stripe. Card details are handled by Stripe and never reach our servers.

A school or district that provides Dreambook across multiple classrooms does so under a separate written agreement with Chronicle Creations, which governs how that school's information is handled.

3. How We Use Information

We use the information we collect to operate, maintain, and improve Dreambook; to authenticate users and manage accounts; to generate and deliver stories based on user selections; to power features such as the Custom Narrator, the family library, and character journals; to identify and resolve bugs and operational issues; to send required transactional communications and, where parents have opted in, optional product updates; and to comply with applicable legal obligations.

We do not use personal information for behavioral advertising, cross-app tracking, profiling of children, or any commercial purpose beyond operating the Dreambook app itself.

4. Sharing and Service Providers

4.1 No Sale of Personal Data

Chronicle Creations does not sell personal data, and we do not share personal data with third parties for advertising or marketing purposes.

4.2 Service Providers and Data Processors

Dreambook relies on a small number of trusted infrastructure providers to operate the app. We disclose them by name so that parents and regulators understand exactly where data may flow.

• Amazon Web Services (AWS): Hosts our application infrastructure, including secure, encrypted storage of accounts, stories, and voice recordings. Narration, including Custom Narrator voices, is generated on our own systems running on AWS. Account emails, such as sign-up confirmations and password resets, are sent through Amazon Simple Email Service. AWS processes this data in the United States.
• Amazon Cognito (AWS): Manages parent account authentication. Cognito stores hashed account credentials and supports authentication via email and password, Sign in with Apple, and Sign in with Google. Chronicle Creations does not have access to user passwords; passwords are hashed by Cognito and never visible in plain text to us.
• OpenAI: Powers Dreambook's story writing and illustration. Story requests sent to OpenAI contain only the choices made in the app (such as character, customizations, setting, tone, story type, and art style) and the age band of the child's profile. They never include names, profile names, voices, photos, or account details. OpenAI does not use data sent through its API to train its models, and may keep requests for up to 30 days for abuse monitoring. OpenAI processes requests in the United States.
• Epic Games, Kids Web Services (KWS): Operates our Verifiable Parental Consent system for the child voice recording feature. Depending on the parent's country, KWS verifies parents through methods such as a small temporary card authorization, ID scan, facial age estimation, or, in South Korea, mobile phone or i-PIN verification. Verification data is processed on the infrastructure of Epic and its verification partners; no financial or verification data ever reaches Chronicle Creations' servers.
• Apple: Processes App Store transactions, including subscriptions and one-time purchases. Apple may also process App Store-related communications and platform-level analytics in accordance with Apple's own privacy policies.
• Mailchimp: Sends optional newsletters and product updates to parents who opt in. Parents can unsubscribe at any time. Mailchimp does not process any children's data and is not used for behavioral profiling or advertising.
• Stripe: Processes payments for educator plans purchased on dreambook.kids. Card details are handled by Stripe and never reach our servers. Stripe does not process any children's data.

Each of these providers operates under contractual data protection terms that bind them to the same privacy commitments described in this Policy. We do not share children's personal data with any other third parties.

4.3 Voice Cloning for Custom Narrators

Dreambook offers a Custom Narrator feature that allows a parent to record a voice (either their own or their child's) for use in narrating the family's stories. This feature is opt-in and requires parental verification before voice data is collected. Voice recordings are personal information, and where the recording is of a child, the recording is treated as a biometric identifier under applicable law including the Children's Online Privacy Protection Rule as amended in 2025. The synthesized narrator generated from a voice recording is also treated as biometric data and protected at the same standard.

Voice cloning is accessed by tapping "Create a New Narrator" in the Narrator section of the app. This action triggers a parental gate (a multi-step adult-level task) before any data collection begins. Once past the gate, parents are presented with a clear choice between two paths.

Selecting the parent voice path constitutes the parent's confirmation that they are the parent or guardian and that the voice being recorded is their own. Voice data collected on this path is processed under adult-data protections.

Selecting the child voice path requires Verifiable Parental Consent through Kids Web Services (KWS), operated by Epic Games. KWS handles parental verification through methods such as a small temporary card authorization, ID scan, or facial age estimation, depending on the parent's country. Verification data is processed entirely on Epic's infrastructure and does not reach Chronicle Creations' servers. Parents are also presented with an optional consent regarding the Share feature for stories narrated in their child's voice. This consent is described in Section 4.4.

All voice recordings and synthesized narrators are stored on Amazon Web Services with encryption applied. Voice recordings and synthesized narrators are retained for the active life of your account so that narrators can continue to function and, if needed, be regenerated. They are deleted within 30 days of an explicit account deletion request or upon parent request.

We do not use voice recordings or synthesized narrators to train Chronicle Creations' AI models or any third-party AI models. We do not sell voice recordings, share them with advertisers, or use them for any form of advertising or behavioral analysis. Voice data is not shared with anyone outside the immediate processing infrastructure required to operate the Custom Narrator feature.

Parents may delete a Custom Narrator at any time from within the Dreambook app. Deletion is immediate and removes the synthesized narrator from active use. Parents may also request comprehensive deletion of all voice-related data (including both the original recording and the synthesized narrator) by contacting contact@chroniclecreations.co.

4.4 Story Sharing

Dreambook includes a Share feature that allows parents to share stories with people outside the app. When a parent uses the Share feature, Dreambook generates a unique link to a web page hosted on dreambook.kids that displays the shared story.

Use of the Share feature requires a parental gate (a multi-step adult-level task) before the share function is accessible, in compliance with Apple's Made for Kids requirements. This applies to all sharing regardless of narrator type.

Shared stories include the story text, the illustrations, and the narration audio. Where Dreambook's pre-built characters appear in the story, those characters are used as illustrated. Shared stories do not include account information, parent or child names, or any identifier that would link the story back to a specific family.

Shared links are open URLs: anyone with the link can view the shared story while the link is live. Links do not expire on their own. Parents may delete a shared story at any time from within the Dreambook app, which removes the underlying content and disables the link.

Once a link is shared, recipients may forward it to others while it remains live. Deleting the story disables the link for everyone it was forwarded to, but cannot recall copies, recordings, or screenshots that recipients may already have made. Story sharing is not available in educator accounts.

Stories narrated using Dreambook's default narrator or a parent's own recorded voice can be shared without restriction. Stories narrated using a child's voice are subject to additional parental consent. When a parent records their child's voice for the Custom Narrator feature, they are presented with an optional consent to allow stories narrated in their child's voice to be shared via the Share feature. If this consent is not given, stories narrated in the child's voice cannot be shared externally: only the same stories with default or parent narration can be shared.

Shared content is hosted on Chronicle Creations' infrastructure on the same AWS systems that store other Dreambook content, with the same encryption and security protections described in Section 6.

5. User Inputs and Internal Use

5.1 How User Inputs Are Used

When using Dreambook, users make selections (character choices, story tones, settings, and themes) that shape each generated story. These selections are processed to generate the requested story output and are retained as part of your account history.

User inputs are not used to train Chronicle Creations' AI models. We do not have a training pipeline that ingests user content for model improvement. Story requests sent to OpenAI contain only story choices and an age band, never personal information, and OpenAI does not use them to train its models. User selections are retained to power the family's story library, character journals, and personalization features. Aggregate, de-identified usage patterns may be analyzed to improve Dreambook's quality, as described in Section 5.2. User inputs are not used for advertising, behavioral profiling, or any commercial purpose beyond operating the Dreambook app itself.

Specific retention periods for each category of data are detailed in our Data Retention Policy in Section 12.

Parents may request deletion of any of their child's data. The mechanisms for doing so (including in-app account deletion and email-based requests) are described in Section 9 (Parents' Rights).

5.2 Internal Use of Aggregate Data

Chronicle Creations may review aggregate, de-identified usage patterns (such as feature engagement statistics, error rates, and overall app performance) to improve Dreambook's quality. This aggregate analysis does not involve reviewing individual user inputs, story content, voice recordings, or other personally identifiable information.

Where content moderation is necessary to uphold our content safety standards, automated systems perform initial moderation in real time. If a content safety concern requires human investigation (or if technical debugging requires review of identifiable content) only the minimum information necessary is reviewed, access is logged, and parents are notified if their account is involved in a safety investigation.

6. Information Security

Chronicle Creations takes the security of children's and parents' personal information seriously and maintains technical and organizational measures appropriate to the sensitivity of the data we process.

Personal information is encrypted in transit using TLS 1.2 encryption when transmitted between the Dreambook app, our infrastructure, and our service providers. Personal information stored on our infrastructure is encrypted at rest using Amazon S3 server-side encryption with AES-256 (SSE-S3). Voice recordings and synthesized narrators, which are biometric identifiers, receive the same encryption protections in transit and at rest.

Parent account authentication is managed through Amazon Cognito, which supports email and password, Sign in with Apple, and Sign in with Google. Account credentials are hashed by Cognito and are not accessible to Chronicle Creations in plain text.

Access to personal information within Chronicle Creations is limited to personnel who require access to operate the service, and access is logged. Our service providers (listed in Section 4.2) are bound by contractual data protection commitments that require them to apply security standards consistent with the protections described in this Policy.

If we become aware of a security incident affecting personal information, we will notify affected users and applicable regulatory authorities in accordance with the requirements of each affected jurisdiction. For users in the European Union and United Kingdom, notification of a personal data breach to supervisory authorities will be made within 72 hours where the breach poses a risk to data subjects. For users in other jurisdictions, notification timeframes follow the requirements of local law.

Chronicle Creations regularly reviews and updates our security practices in response to changes in technology, regulatory requirements, and identified risks.

7. International Data Transfers

Dreambook is operated from Canada. To deliver the service in each country where it is available, personal information is transferred to and processed in the United States, where our servers and service providers are located, and in Canada, where Chronicle Creations is based. Section 4.2 lists each service provider and what it processes. Country-specific transfer information is in Section 10.

For users in the European Economic Area, the United Kingdom, and other jurisdictions with cross-border transfer requirements, transfers of personal data outside those jurisdictions are conducted under appropriate legal mechanisms, including Standard Contractual Clauses (or the UK International Data Transfer Agreement where applicable), adequacy decisions where they apply, and contractual data protection commitments with each service provider. Transfers from Australia are conducted in accordance with Australian Privacy Principle 8 (cross-border disclosure of personal information). Transfers from Singapore are conducted in accordance with Section 26 of the Personal Data Protection Act, ensuring that recipients are bound by enforceable obligations to provide a comparable standard of protection. Transfers from the other countries where Dreambook is available follow the requirements described for each country in Section 10.

Chronicle Creations contractually requires each service provider to apply data protection standards consistent with the protections described in this Policy, regardless of where the data is processed. We do not transfer personal data to jurisdictions or providers that do not maintain comparable protection standards.

8. Children's Privacy and Parental Consent

8.1 COPPA Compliance

For users in the United States, Dreambook complies with the Children's Online Privacy Protection Act (COPPA) and the COPPA Rule as amended in 2025. We do not knowingly collect personal information from children under 13 without obtaining Verifiable Parental Consent. We provide direct notice to parents about our data practices, obtain consent before collecting personal information from children, and offer parents the rights described in Section 9.

8.2 Verifiable Parental Consent

When Dreambook collects personal information from a child under 13, we obtain Verifiable Parental Consent through Kids Web Services (KWS), operated by Kids Web Services Ltd., a subsidiary of Epic Games. KWS provides parental verification through methods including a small temporary card authorization, ID scan, and facial age estimation, with local methods such as mobile phone verification in South Korea. The KWS parent verification and consent management solution is certified as COPPA-compliant by two FTC-approved COPPA Safe Harbor programs: the ESRB Privacy Certified Program and the kidSAFE Seal Program.

The KWS verification flow runs entirely on Epic's infrastructure. Verification data, including any payment card details or facial scan information, is processed by Epic and does not reach Chronicle Creations' servers. Once a parent has been verified through KWS, the verification is recorded against your account so parents do not need to re-verify for subsequent uses of the same feature.

Currently, Verifiable Parental Consent is required only for the Custom Narrator feature when a parent chooses to record a child's voice. Other features of Dreambook do not collect personal information from children under 13 in a way that triggers VPC requirements.

In addition to this Privacy Policy, parents receive Direct Notice at the moment a feature requiring Verifiable Parental Consent is initiated. The Direct Notice describes the specific data being collected, the purpose of collection, the operators receiving the data, and the parent's options to consent or decline. The Direct Notice for the Custom Narrator feature is presented through the Dreambook app and through the Kids Web Services verification flow before any voice data is collected.

9. Parents' Rights

As the parent or guardian of a child using Dreambook, you have meaningful rights over your child's data. This section summarizes those rights in one place. Specific procedures for exercising each right are described in the relevant sections of this Policy.

Right to know what data we have about your child. You may request a summary of the personal information we have collected from or about your child, including the categories of data, the purposes for which it was collected, and any third parties with whom it has been shared.

Right to access your child's data. You may request a copy of your child's personal information. We will provide this in a reasonable, commonly-used format, where technically feasible.

Right to correct inaccurate data. If any personal information we have about your child is inaccurate or incomplete, you may request that we correct it.

Right to delete your child's data. You may delete individual stories directly within the Dreambook app at any time. You may initiate complete account deletion directly within the app through the account settings, which removes all data associated with your account within 30 days. For deletion of specific journal entries, voice recordings, or other account-associated data while keeping the account active, contact us by email.

Right to withdraw consent and refuse further data collection. You may withdraw your consent for any data collection that requires consent, including the Custom Narrator feature, at any time. Withdrawing consent is as straightforward as giving it. Withdrawing consent does not affect data already lawfully processed but stops further collection from that point forward.

Right to refuse data sharing with third parties. Dreambook does not share children's personal data with third parties for advertising or marketing purposes. The limited service providers we use to operate the app are listed in Section 4.2. You may request information about any specific data sharing affecting your child.

Right to file a complaint with a regulator. If you believe your rights have been violated, you may file a complaint with the data protection authority in your jurisdiction. Contact details for major regulators are provided in the relevant regional sections of this Policy.

How to exercise these rights: Contact us at contact@chroniclecreations.co with your request. We will verify your identity as the parent of the child whose data is the subject of the request, and we will respond within 30 days. There is no charge for exercising these rights, and exercising them will not result in any reduction in the quality of service available to your family.

10. Regional Privacy Rights

10.1 Canada (PIPEDA)

For users in Canada, Dreambook complies with the Personal Information Protection and Electronic Documents Act (PIPEDA). Canadian users have rights including access to their personal information, correction of inaccurate information, and the ability to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

10.2 California (CCPA / CPRA)

For users in California, Dreambook complies with the California Consumer Privacy Act and California Privacy Rights Act, as amended, including the CCPA Regulations effective January 1, 2026. California residents have the right to know what personal information is collected, the right to access and delete their personal information, the right to correct inaccurate information, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising their privacy rights.

Under the 2026 CCPA Regulations, personal information of consumers under 16 years of age is classified as sensitive personal information and receives heightened protection. Dreambook applies these protections to all users under 16 in California.

Chronicle Creations does not sell personal information and does not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information in the manner defined by the CCPA, we do not provide a “Do Not Sell or Share My Personal Information” link: there is nothing to opt out of. For California residents under 16, sale or sharing of personal information would require affirmative opt-in consent in any case; we do not engage in such activities for any user.

California residents may exercise their privacy rights by contacting us at the email address in Section 14. We verify identity before fulfilling requests, and there is no charge for exercising these rights.

10.3 European Union and European Economic Area (GDPR)

For users in the European Union and the European Economic Area (including Norway and Iceland), Dreambook complies with the General Data Protection Regulation (GDPR). EU users have rights including the right to access, rectify, erase, restrict processing of, port, and object to processing of their personal information. Chronicle Creations Inc. is the data controller for personal information collected through Dreambook.

The legal bases for processing personal data depend on the data category and the user. For most processing necessary to operate Dreambook, the lawful basis is performance of the contract between the parent and Chronicle Creations (Article 6(1)(b)). For optional features that require explicit opt-in, including the Custom Narrator feature, the lawful basis is consent (Article 6(1)(a)). Where Dreambook processes biometric data such as voice recordings and synthesized narrators, which constitute special category personal data, the additional lawful basis under Article 9(2)(a) is the explicit consent of the parent (and, in the case of child voice recording, the verified parental consent obtained through Kids Web Services as described in Section 8.2). Legitimate interests under Article 6(1)(f) are relied on only for narrow operational purposes such as security monitoring and fraud prevention, and are not used as a basis for processing children's data in ways that affect their substantive interests. Where processing is required by law, the lawful basis is legal obligation (Article 6(1)(c)).

Chronicle Creations has determined that the scale of our processing does not require appointment of a formal Data Protection Officer under Article 37. Privacy and data protection inquiries are handled directly by Chronicle Creations through the contact information in Section 14.

EU users may lodge a complaint with their national data protection authority. A list of EU data protection authorities is available through the European Data Protection Board at edpb.europa.eu.

10.4 EU Digital Services Act: Trader Information

In compliance with the EU Digital Services Act (Regulation (EU) 2022/2065), Chronicle Creations Inc. provides the following trader information for users in the European Union and European Economic Area:

• Legal name: Chronicle Creations Inc.
• Geographic address: 73 Grayhawk Place, Courtenay, BC V9N 0G1, Canada
• Contact email: contact@chroniclecreations.co
• Trade register: Federally incorporated in Canada under the Canada Business Corporations Act: Corporation Number 1588775-5

Chronicle Creations Inc. self-certifies that we offer Dreambook in compliance with applicable EU law, including the General Data Protection Regulation (GDPR), the Digital Services Act, and applicable consumer protection laws.

EU users may also access trader information for Dreambook directly on Apple's App Store listing, where Apple displays developer information as required under the DSA.

10.5 United Kingdom (UK GDPR and Children's Code)

For users in the United Kingdom, Dreambook complies with the UK Data Protection Act 2018, UK GDPR, and the Age-Appropriate Design Code (Children's Code) enforced by the Information Commissioner's Office. We also operate in accordance with the Data (Use and Access) Act 2025, which came into force in stages between 2025 and 2026 and introduces targeted reforms to the UK data protection framework, including a new requirement for online services likely to be accessed by children to consider technical and organizational measures to best protect and support children using the services.

Our data practices prioritize the wellbeing of children using Dreambook. We collect only the data necessary for the app to function. Dreambook does not include social features, public profiles, location sharing, friend discovery, or behavioral profiling that could expose children's data. We do not use design patterns intended to encourage children to weaken their privacy settings. We do not profile children for advertising, recommendation algorithms, or behavioral analysis. App-facing content directed at children uses age-appropriate language. Parental gates and verification mechanisms, including Kids Web Services for child voice cloning, are clear and accessible. We do not use children's data in ways that could be detrimental to their wellbeing.

UK users may exercise rights under the UK Data Protection Act 2018 and UK GDPR (including access, rectification, erasure, restriction of processing, data portability, and objection) by contacting contact@chroniclecreations.co. UK users may also lodge a complaint with the Information Commissioner's Office at ico.org.uk.

10.6 Asia Pacific (Australia, New Zealand, Singapore)

Dreambook is available in Australia, New Zealand, and Singapore. Users in these jurisdictions are protected by both the global commitments described in this Policy and the following regional regulations.

In Australia, Dreambook complies with the Privacy Act 1988, as amended by the Privacy and Other Legislation Amendment Act 2024, and the Australian Privacy Principles administered by the Office of the Australian Information Commissioner. Australian users have rights including access, correction, and the ability to make a privacy complaint. Cross-border data transfers, including to AWS infrastructure that may be located outside Australia, are conducted in accordance with APP 8 requirements. Australian users may lodge a complaint with the OAIC at oaic.gov.au.

In New Zealand, Dreambook complies with the Privacy Act 2020, as amended by the Privacy Amendment Act 2025, administered by the Office of the Privacy Commissioner. The Privacy Amendment Act 2025 introduces Information Privacy Principle 3A (effective 1 May 2026) covering transparency obligations for personal information collected indirectly. New Zealand users have rights under the 13 Information Privacy Principles, including access, correction, and complaint mechanisms. For voice cloning and any other biometric processing, Dreambook also operates in accordance with the New Zealand Biometrics Processing Privacy Code, which came into force on 3 November 2025 and governs the purpose, sourcing, collection, storage, accessibility, retention, disclosure, and limitations on the use of biometric information. New Zealand users may lodge a complaint with the Privacy Commissioner at privacy.org.nz.

In Singapore, Dreambook complies with the Personal Data Protection Act and operates in accordance with the Personal Data Protection Commission's Advisory Guidelines on the PDPA for Children's Personal Data in the Digital Environment. In Singapore, the age at which a child can give meaningful consent for personal data processing is 13. For users under 13, Dreambook obtains parental consent before collecting, using, or disclosing personal data. The PDPC Advisory Guidelines additionally apply heightened protective measures to all minors under 18, which Dreambook implements through the universal commitments described in this Policy. Singapore users have rights including consent withdrawal, access, correction, and the ability to lodge complaints with the PDPC at pdpc.gov.sg.

Users in any of these markets may exercise their rights or request additional information by contacting contact@chroniclecreations.co.

10.7 Japan

For users in Japan, Dreambook complies with the Act on the Protection of Personal Information (APPI). Chronicle Creations Inc., 73 Grayhawk Place, Courtenay, BC V9N 0G1, Canada, is the business handling your personal information. Our representative is Charles David Jameson, Chief Executive Officer.

Purposes of use. We use personal information only for the purposes described in Section 3: to create and manage accounts and child profiles; to generate, store, and narrate stories; to provide plans and story packs; to verify parental consent where required; to send account and service emails; to keep Dreambook safe and secure; to provide support; and to comply with the law. We do not use personal information for advertising or profiling.

Children. A parent or guardian (or, for educator accounts, an educator) creates and manages every Dreambook account. We process a child's information only with that adult's consent.

Transfers outside Japan. With the consent you give when creating your account, your personal information is transferred to and stored in the United States, where our servers and the service providers listed in Section 4.2 are located, and Canada, where Chronicle Creations is based. The United States has no single comprehensive federal privacy law; personal information there is protected by sector-specific federal laws, including the Children's Online Privacy Protection Act (COPPA), and by state laws such as the California Consumer Privacy Act. Canada protects personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws, including British Columbia's Personal Information Protection Act. Each service provider is bound by contract to use your information only to provide its service to us and to protect it. Japan's Personal Information Protection Commission also publishes information about these countries' privacy systems.

Security measures. We have appointed a person responsible for handling personal information and limit access to team members who need it, all of whom are bound by confidentiality. Data is held in Amazon Web Services data centres, which AWS secures physically. Information is encrypted in transit and at rest, passwords are hashed, and access requires authentication (see Section 6). Before transferring information to the United States and Canada, we reviewed both countries' privacy systems, as summarized above.

Your rights. You can ask us to disclose the personal information we hold about you or your child (including in electronic form); to correct, add to, or delete it; to stop using or erase it; to stop providing it to third parties; and to disclose records of any such provision. Contact us using the details in Section 14. There is no fee.

Data breaches. If a breach occurs that the APPI requires us to report, we will notify the Personal Information Protection Commission and affected users.

10.8 South Korea

For users in South Korea, Dreambook complies with the Personal Information Protection Act (PIPA). The personal information we process, our purposes, and how long we keep it are described in Sections 2, 3, and 12. When a retention period ends or deletion is requested, we permanently delete the information from our systems.

Children under 14. We process personal information of children under 14 only with the consent of their legal representative. Every account is created and managed by a parent or guardian (or, for educator accounts, an educator), and Verifiable Parental Consent is obtained before any child voice recording.

Transfers outside Korea. To provide Dreambook under our agreement with you, personal information is transferred overseas and processed or stored as follows. Transfers take place when you use the app, by encrypted network transmission, and information is kept for the periods in Section 12.

• Amazon Web Services, Inc. (United States; aws.amazon.com/privacy): account email and encrypted credentials, profile names, story choices and stories, voice recordings if you use Custom Narrator, and operational data, for hosting, storage, authentication, account emails, and narration.
• Epic Games, Inc., Kids Web Services (United States; epicgames.com/site/privacypolicy): parent verification information, only if you set up a child narrator, for Verifiable Parental Consent. In Korea, mobile phone and i-PIN verification are carried out by Korea Credit Bureau on Epic's behalf.
• Mailchimp, Intuit Inc. (United States; mailchimp.com/legal/privacy): parent email address, only if you opt in to newsletters, for sending them.
• Stripe, Inc. (United States; stripe.com/privacy): educator name, email, and billing details, only for educator plans purchased on our website, for payment processing.
• Chronicle Creations Inc. (Canada; contact@chroniclecreations.co): the information above, to operate and support Dreambook.

You can refuse these transfers by not creating an account or by deleting your account. Because these providers are essential to running Dreambook, we cannot provide the service without them. OpenAI receives no personal information (see Section 4.2).

Your rights. You, or a legal representative on a child's behalf, may request access to, correction or deletion of, or suspension of processing of personal information, and may withdraw consent at any time. Contact us using the details in Section 14.

Privacy Officer. Charles David Jameson, Chief Executive Officer, contact@chroniclecreations.co.

Complaints. You may contact the Personal Information Protection Commission (pipc.go.kr) or the Privacy Infringement Report Center of the Korea Internet & Security Agency (privacy.kisa.or.kr, phone 118).

10.9 Taiwan

For users in Taiwan, Dreambook complies with the Personal Data Protection Act (PDPA). This Policy is our notice under the PDPA: Chronicle Creations Inc. is the collector; the purposes of collection are described in Section 3; the categories of personal data in Section 2; and the period, area, recipients, and manner of use in Sections 4, 7, and 12. Personal data is used in the United States and Canada. An email address is required to create an account, and without it we cannot provide Dreambook. Other information is optional.

Children. Children's personal data is collected only with the consent of their parent or guardian (or, for educator accounts, an educator).

Your rights. You may ask to review or obtain a copy of your personal data, to supplement or correct it, to stop its collection, processing, or use, and to delete it. Contact us using the details in Section 14. We respond within the time limits set by the PDPA.

Data breaches. If personal data is stolen, disclosed, or altered without authorization, we will notify affected users after investigating.

10.10 Philippines

For users in the Philippines, Dreambook complies with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. We process personal information with the consent of the parent or guardian (or, for educator accounts, the educator) and as necessary to provide Dreambook under our agreement with you.

Your rights. You have the right to be informed, to object, to access, to correct, to have information erased or blocked, to data portability, to damages, and to file a complaint. Contact us using the details in Section 14.

Data Protection Officer. Charles David Jameson, contact@chroniclecreations.co.

Data breaches. Where required, we will notify the National Privacy Commission and affected users within 72 hours of becoming aware of a breach.

Complaints. National Privacy Commission, privacy.gov.ph.

10.11 Malaysia

For users in Malaysia, Dreambook complies with the Personal Data Protection Act 2010, as amended in 2024. This Policy is our written notice under the Notice and Choice Principle, and a Bahasa Malaysia version of this section is provided with it. The purposes, categories, and recipients of personal data are described in Sections 2, 3, and 4. An email address is required to create an account; without it we cannot provide Dreambook. Other information is optional. Children's personal data is processed only with the consent of a parent or guardian. Personal data is transferred to the United States and Canada, to providers bound by contract to protect it.

Your rights. You may request access to and correction of your personal data, withdraw consent, ask us to stop processing that is likely to cause damage or distress, and, where available, request data portability. Contact us using the details in Section 14.

Data breaches. Where required, we will notify the Personal Data Protection Commissioner within 72 hours and affected users within 7 days.

Complaints. Personal Data Protection Commissioner, pdp.gov.my.

Baca dalam Bahasa Malaysia

10.11 Malaysia

Bagi pengguna di Malaysia, Dreambook mematuhi Akta Perlindungan Data Peribadi 2010, sebagaimana dipinda pada tahun 2024. Dasar ini ialah notis bertulis kami di bawah Prinsip Notis dan Pilihan. Tujuan, kategori dan penerima data peribadi diterangkan dalam Seksyen 2, 3 dan 4. Alamat e-mel diperlukan untuk membuka akaun; tanpanya, kami tidak dapat menyediakan Dreambook. Maklumat lain adalah pilihan. Data peribadi kanak-kanak hanya diproses dengan persetujuan ibu bapa atau penjaga. Data peribadi dipindahkan ke Amerika Syarikat dan Kanada, kepada pembekal yang terikat secara kontrak untuk melindunginya.

Hak anda. Anda boleh meminta akses kepada dan pembetulan data peribadi anda, menarik balik persetujuan, meminta kami menghentikan pemprosesan yang mungkin menyebabkan kerosakan atau distres, dan, jika tersedia, meminta kemudahalihan data. Hubungi kami menggunakan butiran dalam Seksyen 14.

Pelanggaran data. Jika dikehendaki, kami akan memaklumkan Pesuruhjaya Perlindungan Data Peribadi dalam tempoh 72 jam dan pengguna yang terjejas dalam tempoh 7 hari.

Aduan. Pesuruhjaya Perlindungan Data Peribadi, pdp.gov.my.

Sekiranya terdapat sebarang percanggahan, versi Bahasa Inggeris diguna pakai.

10.12 United Arab Emirates

For users in the United Arab Emirates, Dreambook processes personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. We process personal data with the consent of the parent or guardian (or, for educator accounts, the educator) and as necessary to perform our agreement with you. Personal data is transferred to the United States and Canada, to providers bound by contract to protect it.

Your rights. You may request information about and access to your personal data, and its correction, erasure, or restriction; object to processing; and request a copy in a portable format. Dreambook makes no decisions about you based solely on automated processing. Contact us using the details in Section 14. You may also contact the competent data protection authority in the UAE.

10.13 Israel

For users in Israel, Dreambook complies with the Protection of Privacy Law, 5741-1981, as amended, including Amendment 13, in force since August 14, 2025. You are under no legal obligation to provide personal information. However, an email address is needed to create an account, and without it we cannot provide Dreambook. Personal information is used for the purposes in Section 3 and provided to the service providers in Section 4.2. Transfers outside Israel follow the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 2001, including written undertakings from recipients to protect the information.

Your rights. You may review the personal information we hold about you and ask us to correct or delete it. Contact us using the details in Section 14. You may also contact Israel's Privacy Protection Authority.

10.14 South Africa

For users in South Africa, Dreambook complies with the Protection of Personal Information Act, 2013 (POPIA). POPIA treats everyone under 18 as a child, and we process a child's personal information only with the consent of a competent person, such as a parent or guardian. Personal information is transferred to the United States and Canada, to recipients bound by contract to provide protection comparable to POPIA.

Your rights. You may request access to your personal information, ask us to correct or delete it, object to its processing, including for direct marketing, and lodge a complaint. Contact us using the details in Section 14.

Information Officer. Charles David Jameson, contact@chroniclecreations.co.

Data breaches. We will notify the Information Regulator and affected users as soon as reasonably possible after discovering a breach.

Complaints. Information Regulator, inforegulator.org.za.

10.15 Switzerland

For users in Switzerland, Dreambook complies with the Federal Act on Data Protection (FADP). Chronicle Creations Inc. is the controller (see Section 14). Personal data is disclosed to the recipients listed in Section 4.2, in the United States and Canada. Canada is recognized by the Swiss Federal Council as providing adequate protection. For the United States, transfers rely on the Swiss-U.S. Data Privacy Framework where the recipient is certified, and otherwise on standard contractual clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC).

Your rights. You may request access to your personal data, its correction or deletion, and a copy in a portable format, and object to its processing. Contact us using the details in Section 14.

Data breaches. We will notify the FDPIC as soon as possible where a breach is likely to result in a high risk to you.

Complaints. Federal Data Protection and Information Commissioner, edoeb.admin.ch.

11. Apple App Store Privacy Information

Dreambook displays Privacy Nutrition Labels on its Apple App Store listing in accordance with Apple's requirements. These labels provide a summary of the data Dreambook collects, the purposes for which it is used, and whether the data is linked to the user's identity.

The Privacy Nutrition Labels for Dreambook accurately reflect the data practices described in this Privacy Policy. Where the labels and the Policy address the same topic, the more detailed Policy takes precedence in describing our practices.

Parents and guardians evaluating Dreambook before installation can review the Privacy Nutrition Labels directly on the App Store listing for a quick overview, and refer to this Privacy Policy for complete details.

12. Data Retention Policy

In compliance with the 2025 amendments to the Children's Online Privacy Protection Rule and similar requirements in other jurisdictions, this section sets out how long Dreambook retains each category of data, the purpose of retention, and the conditions under which data is deleted.

Voice recordings and synthesized Custom Narrator data are retained for the active life of your account so that narrators can continue to function and, if needed, be regenerated. Both are treated as biometric data with the same protection standards. They are deleted within 30 days of an explicit account deletion request or upon parent request.

Story content saved to the family's library is retained for the active life of the account so families can re-read stories at any time. Individual stories may be deleted within the app at any time. All saved stories are deleted within 30 days of an explicit account deletion request or upon parent request.

User selection inputs (character choices, tones, settings, and themes) are retained for the active life of the account to populate journal entries and personalize the family's experience. They are deleted within 30 days of an explicit account deletion request or upon parent request.

Journal entries are retained for the active life of the account to provide a story-history record per character. They are deleted within 30 days of an explicit account deletion request or upon parent request.

Account information (parent's email and account credentials) is retained for the active life of the account for authentication, account management, and required transactional communication. It is deleted within 30 days of an explicit account deletion request.

Educator account information (the educator's name, school, role, and work email) and student profile names are retained for the active life of the educator account and deleted within 30 days of an explicit account deletion request.

Server access logs, which may include IP addresses, are retained for no more than 90 days.

The active life of an account is not tied to subscription status. Parents who pause or cancel their subscription retain full access to their account data and may re-subscribe at any time without loss of content. Account data is only deleted when the parent makes an explicit account deletion request.

Aggregate, de-identified analytics (such as the percentage of users who select a particular story category or the average length of stories across all users) may be retained indefinitely as they do not constitute personal information. Individual-level event data tied to specific accounts is retained for no more than 24 months from the date of collection, after which it is deleted or fully anonymized by stripping all account identifiers.

In limited circumstances we may retain certain data beyond these timelines if required by applicable law, to resolve disputes, or to enforce our agreements. Any such retention is limited to what is strictly necessary for the legal purpose and ends as soon as the obligation is satisfied.

Parents may initiate comprehensive account deletion at any time directly within the Dreambook app through the account settings, or by contacting contact@chroniclecreations.co. Verified deletion requests are processed within 30 days.

13. Changes to This Privacy Policy

Chronicle Creations may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make changes, we will update the "Last Updated" date at the top of this Policy.

For material changes that affect how we collect, use, or share personal information (particularly any changes that affect children's data) we will notify the parent account holder by email and through an in-app notification of the change. Where the changes alter the basis on which Verifiable Parental Consent was previously obtained, we will provide parents with the opportunity to review and re-consent before continued data collection.

Non-material changes (such as typographical corrections, formatting adjustments, or clarifications that do not affect substance) may be made without advance notice.

Continued use of Dreambook after notification of a material change constitutes acceptance of the updated Policy. If a parent does not agree to a material change, they may delete the account directly within the app's account settings or by contacting contact@chroniclecreations.co.

14. Contact Us

If you have questions about this Privacy Policy, want to exercise any of the rights described, or want to make a privacy-related request, please contact us:

Chronicle Creations Inc.
73 Grayhawk Place
Courtenay, BC V9N 0G1
Canada

Email: contact@chroniclecreations.co

Privacy contact: Charles David Jameson, Chief Executive Officer. He also serves as our Privacy Officer, Data Protection Officer, and Information Officer where local law requires one.

We respond to privacy inquiries within 30 days. For requests requiring identity verification (such as deletion or access requests), we may ask for additional information to confirm you are the parent or guardian of the child whose data is the subject of the request.