Heroling
Privacy Policy
Last updated
The short version
- We ask for a child’s first name, age and pronouns — never a surname, an address, a school or a photo.
- Those three details are the only personal data any AI ever sees, and only to write the story. No image model is used at all.
- You can erase the account, the books, the cards and the files from your account page, and it really deletes them. Only the order records stay.
Who we are
Heroling, at heroling.app. We decide what happens to the information described here, which under the GDPR makes us the controller of it.
Write to [email protected] about anything on this page. It is the same address for a question, a correction and a formal request.
What we collect
Three groups, and nothing outside them.
| About | What |
|---|---|
| The child | Their first name, their age, their pronouns, the avatar options you picked, and the story we generate from them. No surname is asked for, and no photo is used or requested. |
| You | The email address you type at checkout. If you sign in with Google: your address, your name and your profile picture, as Google gives them to us. Plus your order and payment records. |
| Technical | Your IP address, used to protect the service from abuse and overuse. And, while you are signed in, a session record holding the IP and browser user-agent it was created from. |
We collect the child’s details because we cannot write a book about a child without them — that is the contract you enter. We keep order records because we have to. The rest is our legitimate interest in a service that works and is not abused.
What stays in your browser
The whole design wizard runs on your device. What you type is saved to your browser’s local storage, so a refresh does not cost you a half-built hero.
Nothing about your child leaves your device until you press “Make my book”.
Up to that point the name, the age, the pronouns and the avatar exist only in your browser. Clearing your browser data, or using Clear data on this device, removes them and nothing of it ever reached us.
Who else processes it
We use a small number of services to run Heroling. Each gets only what its job needs.
| Service | What it receives |
|---|---|
| Anthropic | The child’s first name, age and pronouns, and the theme you chose. That is the entire request — no email address, no account, no avatar, no book or order id. Claude writes the title and one line per scene and nothing else. |
| Only if you choose to sign in with it: your address, name and profile picture. | |
| Hosting & storage | Our cloud hosting and storage providers run the website and the API and store the generated files — the PDF, the preview image and the watermarked teaser. They process requests as they are served. |
| Analytics | Page views and a few impersonal labels. Our analytics are cookieless, served from this domain rather than a third-party one, and receive no personal data at all: the only properties they may ever be sent are a theme, a book format, a card kind, a design id and a product id. |
We do not sell your information, we do not share it for advertising, and no one on that list is permitted to use it for their own purposes.
How long we keep things, and how to delete them
Books and cards are kept while your account exists, because the whole point is being able to print them again later. Sessions expire after 30 days. A purchase link expires 365 days after it is issued.
Deleting your account from your account page is immediate and is a real deletion, not a hidden flag:
- Your profile and email address are erased, and your Google sign-in link is deleted outright.
- Every book and card loses the child’s name, age, pronouns, avatar and story text, and every word you wrote on a card.
- The rendered PDFs, previews and teasers are deleted from storage.
- Every session is revoked, and its IP and user-agent are cleared.
One thing is kept: your order and payment records.
We are required to retain proof of what was sold and for how much. Those records stay, but the address on them is replaced with a placeholder, so what remains is a transaction and not a person.
Your rights
You can ask for a copy of what we hold, have it corrected, have it deleted, receive it in a portable form, or object to how we use it.
- Right now, yourself: your account page has both a download of your data and the delete button described above.
- Anything else: email [email protected]. We answer within one month.
If you are in the EU or the UK and you think we have handled your information badly, you can complain to your national data protection authority. You do not have to come to us first.
Children
Heroling is for adults. A child is who a book is about, never who uses the site: there is no account for a child, no way for one to sign in, and nothing here is addressed to them.
By making a book you are confirming you are the child’s parent or guardian, or that you have their permission. We ask for the least a story needs — a first name, an age and pronouns — and never for a photograph.
Changes to this policy
If we change how any of this works, we change this page in the same breath and move the date at the top. There is no archive of previous versions; if that matters to you, save a copy.