Privacy policy

Last updated: 31 August 2026

The short version

We collect the minimum needed to run a story app for your family: your email to sign you in, your family's recordings and reading positions to give them back to you, and anonymous play counts to know which stories work. No advertising, no data sales, no third-party trackers anywhere near your child, ever. That is our pledge, and this page is the precise version of it.

Who is responsible

The data controller is [LEGAL-NAME](org. no. [ORG-NUMBER]), [POSTAL-ADDRESS], Sweden. Questions and requests:[CONTACT-EMAIL].

What we collect, and why

Your account

Your email address, used to send one-time sign-in links and to reach you about your account. There are no passwords. Legal basis: the contract between us.

Inside the app

Reading positions ("Continue where you left off") and your family's subscription status are stored against your family account. Legal basis: the contract — they are the features working.

Family recordings

When you invite someone to record a story, we store the reader's first name (you type it) and the audio they record. Recordings are played back only to your own family account — they are never public, never shared with other families, and never used by us for anything else (including training anything). You can delete any recording in the app. Legal basis: the contract; you are responsible for the reader's agreement.

Play statistics

The app reports coarse product events — app opened, story played, story finished, how far a sitting got, a recording created, a narration file failing to play. These are keyed to a random device identifier that we deliberately do not link to your account, and we do not store your IP address with them. They tell us which stories work; they cannot tell us who you are. Legal basis: legitimate interest in understanding and improving the catalogue.

The marketing site (these pages)

These marketing pages — never the app your child uses — can load Google Analytics, and only if you say yes to the consent banner. Decline and it never loads; the app and the recording pages contain no third-party scripts at all, regardless of what you answer. Legal basis: your consent, withdrawable any time via the banner.

Payments

Subscriptions are processed by Stripe. Your card details go to Stripe, not to us; we store your subscription status and a Stripe customer reference. Stripe also determines your country for VAT. Legal basis: the contract and our legal (tax) obligations.

Who processes data for us

• Cloudflare — hosting, storage and delivery (the app, the database, the audio files).
• Resend — sends the sign-in emails.
• Stripe — payment processing and VAT determination.
• Google — analytics on the marketing pages only, only with your consent.

Each acts under a data-processing agreement and only on our instructions. We do not sell or share personal data with anyone else, full stop.

Children

The Loreling is made for children but the account belongs to an adult. Children have no accounts, no profiles, and no identifiers: the app runs no third-party scripts, builds no behavioural profiles, and the play statistics above cannot identify a child or anyone else.

Cookies and on-device storage

• lorylo_session — cookie, signs you in. Kept up to one year. Strictly necessary.
• lorylo_locale — cookie, remembers your language. One year.
• lorylo_consent — browser storage, remembers your analytics answer on the marketing pages.
• lorylo_did — browser storage, the random device identifier for the play statistics above. Not linked to your account.
• A handful of lorylo_-prefixed preference entries — favourites, layout, narration languages, the offline-download list. These stay on your device.

There are no advertising or cross-site tracking cookies.

How long we keep things

Account data for as long as your account exists. Recordings until you delete them or your account. Billing records as long as bookkeeping law requires. The device-keyed play statistics are retained for product analysis; they are not connected to your identity.

Your rights

You can ask for a copy of your data, have it corrected, ported, or deleted, and object to processing based on legitimate interest. Write to [CONTACT-EMAIL] — deleting your account removes your email, sessions, recordings, and reading positions. We answer within a month. If you are unhappy with how we handle data, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your own country's authority.

Changes

If this policy changes in a way that matters, we tell account holders by email before it takes effect. The date at the top always tells you when it last moved.