Imagine Privacy Policy
Version 3 (2026-10-30) · Effective:
In thirty seconds
- Only an adult creates the account. Your child never signs up, never talks to anyone, and has no public profile.
- We keep very little about your child, always entered by you: a first name or nickname, an age range, the character they picked, up to three favorite categories, their reading language, the page they stopped on in each book, and the stars, from 1 to 5, they give a book they finished.
- While reading, the voice goes to Google or may go to Apple, depending on the browser. Speech recognition belongs to the browser. In Google Chrome, the audio is sent to Google's servers and comes back as words. In Safari, speech recognition is Apple's, and the audio may be sent to Apple's servers. Imagine never receives or stores the audio.
- We measure app usage with PostHog, with no name, no audio and no text read, using a random identifier that disappears when the page reloads. In Brazil, only if you accept "Analytics."
- We do not sell data, show ads, or build advertising profiles of anyone.
- You can correct and delete each child's profile in your drawer, and delete the whole account, with everything in it, under "delete account."
1. Who we are
Imagine is operated by Imagine Books LLC, a limited liability company organized in Delaware, United States, at 1280 Lexington Ave FRNT 2, #1261, New York, NY 10028. We decide how the data is handled: we are the "operator" under COPPA and the "controller" under Brazil's LGPD. We have no company or office in Brazil.
Contact for privacy, account and billing: support@imagine-ai.app. Data protection officer under Brazil's LGPD (encarregado): Imagine Books LLC, at the same address, in Portuguese or English.
2. Which laws apply
- If you are in the United States: the Children's Online Privacy Protection Act (COPPA) and the FTC rule that implements it (16 CFR Part 312), plus applicable state laws.
- If you are in Brazil: because we offer the service to people in Brazil, we handle your data under Brazil's General Data Protection Law (Lei 13.709/2018). We collect it directly from you, from outside Brazil, so it is stored in the United States from the start (see §8).
3. What we collect, and from whom
From you, the adult: e-mail, password (stored protected, unreadable to anyone), name, screen language, the country the account was created from (to know which market it belongs to), the plan you chose and its dates, the coupon used if any, and your purchase history. If you give stars, on your own profile, to a book you finished, we keep the last one, and it counts in the average like any reader's. If you write books in the Workshop, we keep them: text, title, pages and cast. If you write to support, we receive the message, your e-mail, your name and your plan.
If you join the waitlist, without an account: your e-mail, the language and country of the visit (from the connection address), the campaign markers of the link that brought you, if any, the date, and which version of the notice was next to the field. Nothing else: no name, no IP address, no child data.
About your child, always entered by you: first name or nickname (up to 20 characters), age range (3–5, 6–8 or 9+), the character they chose (one of our drawings, not a photo), up to three favorite categories, the language they read in, the date and version of the authorization you gave, and reading progress: which book, which page, how much of the page, whether and when it was finished. When they finish a book, they may give it 1 to 5 stars: we keep the last one they gave. The book's cover shows only the average of every reader's stars, with no name, and only from three ratings up; no other reader sees their rating, and the average never says whose it is. In Imagine's admin screens, the team sees only each book's totals, never whose rating is whose. We also keep which first-time explanations they have already seen, so they are not repeated.
What we do not keep about your child: their voice, what they said, mistakes, speed, performance scores, reading "level," photos, precise location or contacts.
From the browser and network: cookies that keep you signed in and remember your language, a country cookie (30 days), your IP address and browser type. See §7.
Credit card: card numbers are typed into a Stripe form and go straight to Stripe. Imagine never receives or stores your card number.
4. What we use it for
- To make Imagine work: make the story appear as your child reads, remember where they stopped, show books for their age range and language, know who is reading (you or which child), keep the books you write.
- To bill what you subscribed to and meet tax and accounting duties.
- For security: to stop someone from trying your password a thousand times, and to prevent abuse.
- To understand and improve the app (PostHog, §6).
- To write to you about your account: e-mail confirmation, password reset, account deletion, support replies.
- To tell you when we open: if you joined the waitlist, we e-mail you when Imagine opens, with a launch discount code. It is the only promotional message we send, and only to people who asked.
We do not use any of it for ads, to profile your child, or to train AI models. The only promotional e-mail is the waitlist one, sent to people who asked for it.
Legal basis in Brazil (LGPD): your child's data, with the specific and prominent consent of a parent or legal guardian (art. 14, §1); your account and billing data, to perform the contract you accepted (art. 7, V) and to meet legal obligations (art. 7, II); usage measurement, with your consent in the cookie notice (art. 7, I); fraud and abuse prevention, on the basis of legitimate interest (art. 7, IX); your waitlist e-mail, with the consent you gave when you signed up (art. 7, I).
5. The voice, spelled out
The reader uses the microphone only while a reading page is open, and only after you authorize it in your child's profile. Your browser's speech recognition turns the voice into words. In Google Chrome, on a computer or on Android, that is done by Google: the audio is sent to Google's servers and handled under Google's own terms and privacy policy (policies.google.com/privacy). In Safari, and in the browsers on iPhone and iPad, which use Safari's engine, that is done by Apple: the audio may be sent to Apple's servers and handled under Apple's Siri and Dictation privacy policy (apple.com/legal/privacy/data/en/ask-siri-dictation). Imagine has no contract with Google or Apple for this and does not control how long they keep the audio.
Only the transcribed words reach Imagine. They are matched against the page inside the browser and discarded; none are saved.
You can deny or turn off this site's microphone at any time in your browser's permissions; the audio stops being sent immediately. Without the microphone, the page does not react to the voice.
6. Usage measurement (PostHog)
We use PostHog, Inc., a US company, to understand how the app is used and to fix what does not work.
- What it receives: what was tapped, which page was opened and for how long; the outcome of some actions (whether sign-up, sign-in or subscribing worked or why not, whether a promo code was used, the plan chosen and the market, Brazil or the US); and, while reading, whether the microphone failed and why. Along with that go the IP address (and the approximate location derived from it), the type of browser and device and the language, which every browser reports on every connection, and a random identifier.
- What it never receives: a name, an e-mail, your child's nickname or profile identifier, audio, or the text read. The app lets out only a closed list of fields; everything else is removed before sending.
- Where the visit came from: on adult screens we may record a link's five campaign markers (
utm_source,utm_medium,utm_campaign,utm_content,utm_term) to know which promotion brought the family. When a child's profile is active, they are not sent. We never record ad network click identifiers (such asgclidorfbclid). - The identifier and what it is for: a random number that lives only in the tab's memory and disappears when the page reloads. It is used only to know that two taps came from the same visit, so we can measure and maintain how the app functions. This is how we make sure it is used for nothing else: it is not stored in the browser; it is never linked to your account, your e-mail or your child's profile (the app drops every identification event); PostHog is set not to build a person profile; and it is not used to contact anyone, for advertising, or to build a profile.
- When it measures: in the United States, it measures without asking on adult screens; on your child's screens, the authorization you give in their profile is what allows it. In Brazil, and wherever we do not know the country, it measures only if you accept "Analytics" in the cookie notice; otherwise no event is sent. You can change that choice at any time under Cookies.
- How long: PostHog keeps events for up to 1 year.
7. Cookies and browser storage
| What | Why | How long |
|---|---|---|
session cookies (im_at, im_rt, im_pkce, im_rc, im_pnd) | keep you signed in, finish sign-up and password reset | while the session lasts |
im_lang | remember the screen language | 1 year |
vitta_geo_country | remember the country, for language and market | 30 days |
vitta_cookie_consent_v1 (local storage) | remember your cookie choice | 365 days |
| Stripe cookies, on the payment screen only | payment fraud prevention | set by Stripe |
We use no advertising cookies. PostHog stores no cookie and nothing else in the browser.
8. Who we share with, and where data is kept
Only with companies that provide services Imagine needs. Each receives only what it needs:
| Who | What they receive | Why | Where |
|---|---|---|---|
| Google (Chrome speech recognition) | the reading audio, while the microphone is on | turn voice into words | Google's servers |
| Apple (Safari speech recognition) | the reading audio, while the microphone is on, when Apple sends it to its servers | turn voice into words | Apple's servers |
| Supabase | database, sign-in, books and art: everything in §3 except card data | store the data | US (N. Virginia) |
| Vercel | every request to the site (IP, browser, country), server logs | host the site | US and Vercel's global network |
| Stripe | card data (straight from its own form), plan, price, coupon and an internal account code | charge the subscription | US |
| PostHog | what §6 lists | measure usage | US |
| Resend | e-mail, name, plan and message when you write to support; the e-mail when an account is deleted; the e-mail and language of waitlist members, to send the opening notice | send e-mail | US |
| Supabase Auth | your e-mail | send e-mail confirmation and password reset | US |
| Upstash | the IP or the account code, for up to one day | limit attempts | Upstash's servers |
| Google Gemini | no data about you or your child: only text our team writes to create book art | illustrate books | US |
We never sell, rent or share data for advertising. We disclose data to authorities only when the law requires it.
9. How long we keep it
| Data | How long | Why |
|---|---|---|
| account, child profiles, progress, Workshop books | while the account exists; if the account goes 24 months with no access, we delete everything, with an e-mail warning 30 days before | the service needs it to work |
| a child's profile | until you delete it or the account | same |
| purchase history | for as long as tax and accounting law requires, with nothing that identifies you once the account is deleted | tax and accounting duties |
| a record that a deletion happened (an encrypted code, no name or e-mail) | 1 year | prove the deletion was done |
| IP used to limit attempts | up to 1 day | security |
| server logs | up to 1 day | security and bug fixing |
| usage events | up to 1 year | §6 |
| support messages | up to 24 months after the last message | answer and follow up on your request |
| waitlist e-mail | until you leave (deleted immediately through the link in the e-mail); otherwise, until 60 days after the opening e-mail; if Imagine does not open, at most 12 months after you joined | tell you we opened and send the code |
| voice audio | not kept by Imagine; at Google or Apple, under each one's terms | §5 |
10. What you can do
- See and correct each child's name, age range, character and categories in your drawer.
- Delete a child: in the drawer, with confirmation. It immediately deletes the profile, the categories, all of that child's progress and the stars they gave, which leave the books' averages, and withdraws the authorization you gave for that child. If the account has only one child, withdrawing it means deleting the account.
- Delete the whole account: under "account › delete account," with your password. It immediately deletes the account, profiles, progress, stars, preferences and the books you wrote; the subscription ends at the same moment. Your books' art files are removed shortly after by an automatic process that runs every hour. We e-mail you a confirmation. Only the purchase history, with nothing that identifies you, and the encrypted deletion record remain.
- Stop the microphone: in the browser permission, immediately.
- Change your measurement choice: under Cookies, in Brazil.
- Leave the waitlist: through the link in any waitlist e-mail, immediately, or by writing to support@imagine-ai.app, within 10 business days. Leaving deletes your e-mail.
- Request a copy of everything we hold about you or your child, or make any other request: write to support@imagine-ai.app. We answer within 15 days and first confirm the request comes from the account holder.
If you are in the United States, as a parent or guardian COPPA gives you the right to review your child's information, refuse further collection or use of it, and have it deleted. Without that information we cannot offer reading for that child. You may complain to the Federal Trade Commission (FTC).
If you are in Brazil, you also have the rights in art. 18 of the LGPD and may complain to the National Data Protection Authority (ANPD).
11. Parental authorization
Before a child's profile is created, we show what will be collected and ask you to state that you are the parent or legal guardian and to authorize it. The box is never pre-checked. We store the date and the version of the notice you accepted. Today the authorization is your statement on that screen; we do not run any other identity check. If what we collect about your child changes, we tell you by e-mail and on this page, with a new version and date; if you do not agree, you can delete their profile in your drawer at any time — or, if they are the account's only child, delete the account under "delete the account."
12. Children and age
Imagine is made for children to read with an adult, or to listen while an adult reads. The account always belongs to an adult aged 18 or older. Children do not create accounts, do not write to anyone and do not publish anything. If we learn that someone under 18 created an account, or that we collected a child's data without authorization, we delete it. The waitlist is for adults only, too. If we learn a child signed up, we delete the e-mail.
13. Security
Data always travels encrypted (HTTPS). Passwords are stored so that not even we can read them. Each account can only reach its own data, through rules enforced in the database itself. Server logs do not keep passwords, audio or text read, and e-mails appear masked. No system is perfect: if an incident may affect you, we will tell you and the authorities as the law requires.
14. Changes to this policy
Each version has a number and date at the top of this page. If a change is material, we e-mail you before it takes effect; if it changes what we collect about your child, the e-mail to the parent says what changed, and this page gets a new version and date.
15. Contact
Imagine Books LLC · 1280 Lexington Ave FRNT 2, #1261, New York, NY 10028 · Privacy and support: support@imagine-ai.app