Toto the Rabbit
Privacy Policy
Effective September 25, 2026
Toto the Rabbit is an early validation for personalized children’s bedtime audio stories. This policy explains who operates the service, what we collect, why we use it, and the choices available to families.
Who we are
Toto the Rabbit operates this website and the early-access service. In this policy, “Toto,” “we,” and “us” mean the Toto the Rabbit project. You can contact the operator at hello@tototherabbit.com.
What we collect
When a parent or caregiver signs up, we collect their email address, a child’s first name, and any optional first-story details they choose to provide, such as a favorite toy, activity, or place. Older records may include sibling details from when those fields were offered; we no longer collect them. For security and reliable operation, our hosting provider may process IP address, approximate location, browser and device information, request logs, and pages requested. We also store a consent version, timestamp, region, and selected optional categories in the visitor’s browser.
How we use information
We use your information to send the stories or updates you asked for, to personalize stories during this validation, to reply to parent messages, and to improve Toto. We do not sell your personal information. We do not use children’s data to target ads.
Personalized song playlists
If you order a song playlist, we collect your email address, your child’s first name, and the optional details you choose to add after paying: what your child calls you, a sibling’s or relative’s name, a favorite toy and a favorite place. We send these to ElevenLabs, which creates the songs and the spoken introduction, and we store the finished audio privately (Vercel Blob) so you can listen through a private link we email to you. Payment is handled by Paddle, our merchant of record; we never receive your card details. We use these details only to make and deliver your playlist, to reply to you, and to handle refunds. We do not sell them and do not use them to target ads.
Analytics and advertising measurement
We use an analytics service to understand how the website is used, such as which pages are viewed, how far a page is scrolled, whether a sample story is played and whether a form is submitted. We use advertising partners to learn how people hear about Toto, for example when someone who saw one of our ads visits the site or starts a trial; this can include the page visited, browser and device information, and the partners’ cookie identifiers. We never send analytics or advertising partners information about children, names, email addresses, story details or form contents.
Choices and UK/EU legal bases
For visitors in the UK, EEA, and Switzerland, analytics and advertising measurement operate only with consent. Consent can be given separately for Analytics and Advertising and can be withdrawn at any time through Privacy choices. We rely on contractual necessity or legitimate interests, as applicable, for strictly necessary processing used to provide requested features, authentication, checkout, fraud prevention, security, and consent storage. Elsewhere, optional tracking may operate by default where permitted, subject to browser-level opt-out signals and the opt-out described below.
Global Privacy Control and opting out
We honor Global Privacy Control automatically before optional advertising events are sent. Visitors outside the UK/EU region can opt out without an account or identity check. Withdrawing consent or opting out stops future optional events and clears first-party analytics and advertising identifiers where technically possible. Use the Privacy choices control on any page to make or change a choice. Our privacy mechanism is also the way to exercise an applicable “do not sell or share” choice; we do not sell personal information for money.
Children’s privacy
Toto is for parents and caregivers. We do not knowingly collect personal information directly from children under 13. Story details about a child should be submitted by a parent or guardian.
Email and choices
You can unsubscribe from emails using the link in any message. Depending on where you live, you may request access to, correction of, or deletion of personal information, object to or restrict processing, or request a portable copy. Email hello@tototherabbit.com to make a request. We may need limited information to locate a record and protect it from unauthorized access.
Storage and partners
This is an early validation and some stories may be prepared manually. We use Vercel to host the website, Neon to store signup details, and trusted email delivery providers. We also use analytics and advertising partners for the optional purposes described above. These providers may process information in the United States or other countries outside your own. Where required, transfers rely on appropriate safeguards such as adequacy decisions or contractual protections.
Retention
A UK/EU consent choice is remembered for up to six months, unless tracking purposes or providers materially change sooner. Signup and story details are kept only for the early-access relationship, fulfillment, and a reasonable period for support, security, and legal obligations, then deleted or anonymized. Technical security logs and optional analytics or advertising data are retained according to operational need and the relevant provider account settings and are deleted or aggregated when no longer needed for the stated purpose.
The Toto iPhone app: who it is for
The Toto app is for parents and caregivers, who set up a child’s story profile and listen together with their child. Children do not have accounts and should not use the app on their own.
The Toto iPhone app: what we collect
Your email address, used to sign you in and to send service emails about your stories. You can sign in with an email code (handled by Auth0) or with Sign in with Apple; if you choose Apple’s “Hide My Email”, we receive a private relay address from Apple instead. For each child profile you create: a first name, an age range, and any optional details you choose to add (pronouns, a favorite thing, a favorite place). If you subscribe before creating your account, those details stay only on your phone until the account is created. We also keep your choice about AI story creation and when you made it; your subscription status from Apple (through RevenueCat), such as whether it is active, in a trial, or ended, and when (we never receive your payment details); your device’s time zone, so new stories arrive at a consistent local time; listening progress for each story; and any feedback or problem reports you choose to send about a story. We do not sell personal information. Analytics and advertising in the app are described in the next section.
The Toto iPhone app: analytics and advertising
To improve the app, we collect information about how it is used, such as which screens are opened, whether a trial is started and whether stories are played. This uses a random identifier created on your phone, not your name, email address or account. To learn how people hear about Toto, we share limited information with our advertising partners, such as when the app is installed or opened and when a trial or subscription starts. If you allow tracking when your iPhone asks, this can include your device’s advertising identifier. We never share your child’s name, details or stories with analytics or advertising partners. If you are in the UK, the EEA or Switzerland, the app asks for your permission first. Anyone can turn analytics and advertising off at any time in the app under Account → Privacy, and change Apple’s tracking permission in iPhone Settings → Privacy & Security → Tracking.
The Toto iPhone app: how stories are made
With your permission, Toto sends your child’s first name, age range, and any optional details to OpenAI to write and review the story. OpenAI is instructed not to store these requests. Toto then sends the story text, which may include your child’s first name, to ElevenLabs to narrate it. ElevenLabs keeps a record of each narration until Toto deletes it; Toto deletes these records when an account is deleted. You can withdraw permission at any time in the app under Account → AI story creation; no new story information is sent after that, and stories already made stay in your library.
The Toto iPhone app: where data is kept
Profiles and stories are stored encrypted in our database (Neon, hosted in AWS US East 1, N. Virginia, United States). Story audio is stored privately (Vercel Blob) and is only streamed to your signed-in app for a short time while you listen; it is not downloaded for offline use. Other service providers: Vercel (hosting), Auth0 (sign-in), Resend (sign-in and service emails), RevenueCat and Apple (subscriptions), and analytics and advertising partners. Some of them process data in the United States. Service emails, such as “your story is ready”, may include your child’s first name.
The Toto iPhone app: deleting your account
In the app, go to Account → Delete account. Access closes immediately and the device signs out. We then delete your account, child profiles, stories, audio, sign-in record, subscription record at RevenueCat, and the narration records at ElevenLabs within 7 business days, and email you when it is done. Analytics and advertising information is not tied to your account and is kept only as long as our partners’ retention settings allow. We keep only an anonymous record that a deletion request was completed, for 2 years. Copies in our database backups are removed automatically within 30 days. Deleting your Toto account does not cancel your Apple subscription; cancel it in your iPhone Settings → your name → Subscriptions.
Contact
Questions about privacy: hello@tototherabbit.com
Changes
If we update this policy, we will post the new version on this page and change the effective date above.