Privacy Policy

Last updated: 27 October 2026. Operator: Tisbah (تصبح), Ajman, United Arab Emirates. Contact: mygrokky@mail.grokbot.com.

Tisbah makes bedtime stories for children aged 2–8. The service is for parents and legal guardians. Children do not create accounts, and the app is designed so a child never needs to type anything.

What we collect, and nothing more

• Parent account: email address, a securely hashed password (if you choose one), the date you gave consent, and your plan.
• Child details you choose to save: first name (and optional Arabic spelling), age, boy/girl (only for Arabic grammar), and picture preferences (skin tone, hair colour and style). Please do not enter a surname.
• Usage count: how many stories were created this week, to apply the free weekly limit.
• Shared stories (only if you tap Share): the text of that one story (which includes your child's first name), its pictures' theme and the date. It is shown at a long, unguessable link to anyone who has the link. No age, picture preferences, email or account details are shown. You can delete any shared link in Account, and deleting your account deletes them all.
• Referral code and extra stories: a random code in your invite and share links. If a friend's family joins from your link, we record that link between the two accounts (no names) and give both accounts extra stories; we keep the number of extra stories left. Deleting your account deletes these too.
• Weekly story list (only if you opt in): your email, language and whether you want the founding offer. We do not send emails yet; when we do, every email will have an unsubscribe link.

Visit counts

We count visits, sign-ups, stories and shares as daily totals on our own server, to see what works. We use no cookies for this, no third-party analytics, and we don't store IP addresses or link counts to you.

We do not collect photos, voice recordings, location, contacts, precise birth dates, or school details. We do not use advertising, ad trackers or third-party analytics.

Stories and audio

Stories are created on request and are not stored on our servers, unless you choose to share one by link (see above). Narration audio is created by a computer-generated voice running on our own server and deleted automatically within about 1 hour. Stories you "save for offline" are stored only on your own device and can be deleted at any time.

How we use data

Only to provide the service: to sign you in, to personalise stories, to apply plan limits and, if paid plans are offered, to manage your subscription. We never sell or rent personal data, and we never use children's data for advertising or profiling.

Parental consent

By creating an account you confirm that you are the child's parent or legal guardian, aged 18 or over, and you consent to us processing your child's first name, age and picture preferences for the purpose above. You can withdraw consent at any time by deleting the account.

Service providers

We use a small number of providers: Render runs the website, and Neon hosts the database that holds the account details listed above. If email sign-in links or the weekly story email are switched on, they are sent through Brevo, which receives only your email address and the message. If paid plans are switched on, payments are handled by Lemon Squeezy, which acts as the seller (merchant of record): it receives your name, email, billing country and payment details to take the payment, handle tax and send receipts, and tells us only that your account has a paid plan. Some of these providers store data outside the UAE (for example in the United States or the EU). These providers process data on our behalf under their terms. Payment card details go directly to the payment processor; we never see them. If AI-assisted stories are enabled, only the child's first name, age, interests and theme are sent to the AI provider, with no email or account details.

Your rights

You can view, correct, export or delete your data. Account → Delete account erases it immediately. Email us at mygrokky@mail.grokbot.com for anything else. We reply within 30 days.

Retention

Account data is kept while your account is active. Accounts with no activity for 24 months are deleted. Sign-in links expire after 20 minutes.

Security

Data is encrypted in transit (HTTPS), passwords are hashed (PBKDF2), and sessions use secure, HTTP-only cookies.

Laws we follow

We aim to follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the UAE child digital safety framework, and international standards for children's privacy such as the EU/UK GDPR (including the UK Age Appropriate Design Code) and the US COPPA rule, where they apply.

Changes

We will email you before any important change, and the date at the top of this page shows the latest version.

ملخّص بالعربية

نجمع فقط بريد وليّ الأمر واسم الطفل الأول وعمره وتفضيلات الرسوم. لا نخزّن القصص على خوادمنا إلا القصة التي تختار مشاركتها برابط، ويمكنك حذف الرابط في أي وقت. نعدّ الزيارات كأرقامٍ يومية فقط دون ملفات تعريف الارتباط. لا نبيع البيانات، ولا توجد إعلانات. يمكنك حذف حسابك وبياناتك في أيّ وقت. للتواصل: mygrokky@mail.grokbot.com