Wonder Door Privacy Policy
Wonder Door has not launched yet. This policy describes how the Wonder Door app will handle information when it becomes available; we're publishing it early so families can read it before signing up. Our website, wonderdoor.app, is an informational page that collects no personal information — no accounts, no forms, no cookies, no analytics, and no trackers.
Effective date: this policy takes effect when the Wonder Door app launches. Last updated: July 26, 2026.
Wonder Door ("we," "us") is operated by Horizoncrest LLC. This policy explains what information we collect, why we collect it, and the controls you have over it. It is written for the adults who use Wonder Door; children never interact with us directly.
Wonder Door is a storytelling app that a parent or grandparent plays together with a child. We built it privacy-first: the adult holds the only account, the child is never a user, and we collect the minimum needed to make your child the hero of their stories.
The short version
- Only adults create accounts. Children cannot sign up, log in, or be contacted.
- We collect what you type into your child's profile (first name, age, appearance) solely to personalize story illustrations. If you choose, a photo can suggest those appearance choices for you — it is analyzed once and never stored.
- No ads. No selling data. No tracking. No analytics on the child's screen.
- You can export the personal information we store, or permanently delete everything, from Settings at any time.
Information we collect
From you (the account holder):
- Sign-in details. When you sign in with Apple or Facebook, we receive your name (if you share it), your email address (which may be a private relay address), and a unique account identifier from that provider. We never see your password.
- Feedback you choose to give. After a story, you can rate it and leave an optional comment on your own device (never the child's screen). Feedback is stored in our own systems only and used solely to improve the adventures.
- Subscription status. Our payments partner (RevenueCat) and Apple tell us whether your subscription is active. Payment is handled entirely by Apple — we never receive your card or billing details.
About your child (entered by you):
- First name, age, structured appearance choices (from fixed menus), and optional notes/pronouns.
- An optional photo, only if you choose to use one. To make setup faster, you can pick a photo of your child and we will suggest the appearance menu choices from it. The photo is checked by automated safety moderation first, must show exactly one face, is analyzed in memory, and is never stored — it is discarded as soon as the suggestions are made. You can always skip the photo and pick every choice by hand.
- We deliberately do not collect: last name, date of birth, location, contacts, or anything else beyond what is listed here.
Generated for your family:
- Illustrated images of your child's story character — including the hero portrait that you review and approve before any story images are made — and the story illustrations built from it, plus records of the adventures your family has played (so your storybook remembers).
From your (the adult's) use of the app: basic records of how the app is used on your device — steps completed during setup, subscription screens viewed, purchases, stories started and finished, and technical errors — kept in our own systems only, to fix problems and improve the product. None of this is collected from the child's screen, and we use no third-party analytics services.
What we don't collect: location, contacts, browsing history, device fingerprints, or advertising identifiers. Photos are optional, analyzed once, and never stored. The child-facing screen contains no analytics or advertising code at all.
How we use information
- To create and secure your account
- To personalize adventures — your child's profile is used to generate the story illustrations in which they appear
- To operate your subscription
- To keep children safe: profile text and any photo you choose to use are checked by automated moderation before they are used, and every generated image is checked by automated moderation before it is shown
We do not use your family's information for advertising, behavioral profiling, engagement optimization, A/B testing on children, or sale to anyone, ever.
Children's privacy (COPPA)
Wonder Door is designed for families with children under 13, and we treat the Children's Online Privacy Protection Act as a design requirement:
- The parent or legal guardian is the only account holder. Children have no accounts, logins, email, or passwords.
- Consent. Before creating a child profile you affirm you are the child's parent or legal guardian and consent to our collection of the profile information. We keep a record of the consent version, its exact text, and the time you gave it as an audit record.
- Your rights. You can review the personal information we store (Settings → Export my data; generated images are viewable in the app), delete your child's profile and every associated image (Settings → Delete profile), or delete the entire account (Settings → Delete account). Deletion is permanent. You may also refuse to permit any further collection or use of your child's information at any time by deleting the profile.
- Technical identifiers during play. Like any online service, the play screen on your child's device communicates with our servers, which involves technical identifiers such as an IP address and a session token. We use these solely to run the service — signing requests, delivering your family's stories, and keeping the service secure — never for profiling, advertising, or tracking. This is the "support for internal operations" use recognized by the COPPA Rule.
- Minimization. We collect the least information that still lets your child star in the story, and none of it is shared for advertising or marketing.
Questions about children's privacy: privacy@wonderdoor.app.
Service providers
We use a small number of processors, under contract, acting only on our instructions:
| Provider | What they process | Why |
|---|---|---|
| Supabase | All stored account and profile data | Database, authentication, storage |
| RevenueCat | Account identifier, purchase state | Subscription management |
| Google (Gemini API) | Structured appearance descriptors, and previously generated character images used as style references so your child looks consistent across scenes (never your child's name or your free-text notes). If you choose to use a setup photo, Google analyzes it once to suggest appearance choices; the photo is then discarded, never stored. We use Google's paid API tier, which does not use customer content to train Google's models | Story image generation; one-time photo analysis |
| OpenAI | Profile free-text fields | Safety moderation of text |
| OpenAI | Generated images, and any setup photo before it is analyzed | Safety moderation of images and photos |
We engage these providers only to process data on our behalf, and we configure our accounts and agreements with them so your family's data is not used for their own purposes — not for advertising, and not to train their AI models. If you sign in with Facebook, Meta acts as your sign-in provider under its own privacy policy; we receive only your name, email, and an account identifier from them, and we send them nothing about your child.
Storage, security, and retention
- Generated images live in private storage, accessible only through your signed-in account via private links that expire after a short period.
- Data is encrypted in transit and at rest; sign-in tokens are stored in the device's Keychain (Apple's encrypted credential storage).
- If you cancel your subscription, adventures already generated for your family remain yours to play.
Our retention policy. We never retain children's personal information indefinitely. For each kind of information we hold, this is why we keep it and when it is deleted:
| Information | Why we keep it | When it is deleted |
|---|---|---|
| Child profile (first name, age, appearance choices, notes) | To personalize the stories and illustrations your family plays | The moment you delete the profile or account; a nightly job removes any remnants within 24 hours |
| Optional setup photo | Analyzed once to suggest appearance choices | Not stored — discarded immediately after analysis |
| Generated story images | So your child's adventures and storybook remain playable | Same as the profile: deleted with the profile or account, remnants removed within 24 hours |
| Adventure history (which quests were played, endings earned) | So your family's storybook remembers | Deleted with the profile or account |
| Parental consent records (version, text, timestamp) | Legal audit record of your consent | Retained for three years after your account is deleted, as our audit record of your consent, then deleted |
| Account and subscription records (adult's email, identifiers, purchase state) | To operate your account and subscription | Deleted with the account |
When you delete a profile or account, deletion is prompt and permanent — typically immediate, with the nightly job clearing any remnants from our storage systems within 24 hours, and a verification check confirming the deletion completed. Our service providers may retain data briefly under their own retention windows described in their policies.
What we will never do
No third-party advertising. No sale or rental of personal information. No tracking across other apps or websites. No social features that expose your child. No live AI text generation shown to children — every story is a fixed, pre-written script, reviewed by people before it ships.
Changes to this policy
If we make material changes we will present the updated policy in the app and record the version you accept. The version history of our consent text is retained for audit.
Contact
Wonder Door
Operated by Horizoncrest LLC
Email: privacy@wonderdoor.app
Before the Wonder Door app launches and any personal information is collected, we will add a mailing address and phone number to this policy and to the in-app parental notice.
If you have deleted the app and can no longer reach Settings, email us at privacy@wonderdoor.app from the address on your account and we will delete your account and data for you.