Privacy Policy

Last updated: 20 September 2026

NanaTato ("NanaTato", "we", "us") is a parent-led bedtime routine and calming story app for families. We built it to ask for almost nothing. This policy explains, in plain language, exactly what we hold and what we don't.

1. Grown-up sign-in

Registering an install with NanaTato is required once per install, and it happens through Sign in with Google. The app cannot be used until a grown-up has signed in; every story plays offline after that. When a grown-up signs in, we receive exactly three things about that Google account: its email address, its Google account ID (a number that identifies the account to us and to nobody else), and Google's own confirmation that the address is verified. We do not receive or keep your name, profile picture, contacts, or anything else in your account, and there is no NanaTato password — we never see or create one. Alongside those, our API stores a random installation identifier, the app version, the signup date, and the date and version of the privacy notice you accepted. We use this to understand registrations and operate the service. Signing in does not synchronize favorites and does not subscribe you to a newsletter.

The sign-in runs on your device through Google Play services, and Google's own handling of it is covered by the Google Privacy Policy. Google hands the app a short-lived signed token; our API checks that signature against Google's public keys, reads the email and account ID from it, and discards the token. It is never stored or logged.

There is nothing else to register: one grown-up's Google account for this install, once. You can sign out and delete the registration in Parent settings at any time; using the app again on this device means signing in again.

We do not ask for child names, ages, birthdays, schools, photos, recordings, contacts, or locations. The sign-in is addressed to grown-ups: sign in with your own Google account, never a child's. Later controls are in Parent settings behind the grown-up check.

2. Information stored on your device

Favorites, playlists, bedtime style, and Calm Mode settings are stored on your device. After the Google sign-in the app also keeps the signed-in email there, so Parent settings can show which account is registered. These preferences are not backed up to our API. The app also stores installation credentials and a note of the last day it told us the app was opened. Nothing is collected retrospectively from before the install was registered.

That pending work survives app restarts and retries when a network connection is available. API failures do not block onboarding, navigation, or playback. Uninstalling the app or clearing its data removes local information, including any requests that have not yet been sent.

3. App activity

Once an install is registered, it sends one small signal at most once a day — “the app was opened today” — with the app version, linked to the grown-up signup through the installation identifier. There is no toggle for it in the app; it is part of the registration. We use it for two things only: the date the app was last used, and a count of the days it was opened. That tells us whether the app is being used and which versions are in use. No story titles, story identifiers, play counts, routine steps, child profiles, or advertising identifiers are included.

This signal is not anonymous: it is linked to the signup email. It says the app was opened, not who opened it or what was played. Counts describe registered installations and are not verified individual people.

There are no third-party analytics SDKs. This record is kept with the registration and deleted with it: choose “Sign out & delete registration” in Parent settings, or write to us, and the last-used date and the count of days opened go with it. If offline, that server request waits until a connection is available.

4. This website

This website does not run analytics, advertising, or tracking scripts, and sets no cookies. Its pages make no network requests of their own beyond loading the page. Our hosting provider (Cloudflare) processes request metadata such as IP addresses to deliver and secure the site; we do not add visit statistics on top of that. If we ever add a visit counter, we will describe it here first.

5. Permissions and offline operation

Stories, sounds, and lullabies are bundled with the app and play offline. Internet access is needed once for the grown-up sign-in that registers the install; after that it is used only for the once-a-day app-open record, deletion requests, and the newsletter form in the app's Settings. Background work checks connectivity and retries failed API requests. We do not request camera, microphone, contacts, or location permissions.

6. Purchases

There are none. NanaTato is free: the whole library, with no subscription, no in-app purchases, and no ads. We never see, receive, or store payment details, because there is nothing to pay for.

7. Children and grown-up choices

NanaTato is intended for children and grown-ups to use together. The sign-in is for grown-ups: the account that signs in must be your own, never a child's. We do not ask children to supply information and do not create child accounts. The count of days the app was opened may reflect shared family use; it contains no child details or content titles.

If a child has supplied an email address or you want records removed, contact hello@gopherlume.com.

8. Storage, newsletter, and retention

Signup and activity records are stored in a Cloudflare D1 database through an API hosted on Cloudflare Workers. Production requests use HTTPS. Hosting and database providers process this information to operate the service. We do not sell signup information or provide it to advertising networks.

• App registrations: retained until deleted. The verified email address and the Google account ID are kept with the registration for as long as it exists; the sign-in token itself is checked and discarded, never stored. The last-used date, the count of days the app was opened, and the app version are kept with the registration for as long as it exists and are deleted with it — there is no separate event history to expire.
• Newsletter requests: if you submit the newsletter form in the app's Settings, our API stores the email address, where the request came from, the date of the request, the time we sent you a confirmation email, and the time you confirmed. A request is not a subscription: until you confirm, nothing is added to any mailing list.
• Newsletter delivery: the confirmation email is sent by our own mail platform (sendoramo), which delivers it through Microsoft Azure Communication Services from a nanatato.com address. It contains one link, valid for 14 days, and it is not click-tracked. Only tapping that link adds your address to the newsletter list, which lives in that mail platform along with the newsletters themselves.
• Newsletter retention: the request and confirmation record in our API remains until deletion is requested. Unsubscribe links in newsletters are handled by the mail platform; unsubscribing stops newsletter delivery and does not delete a separate app registration. That platform may retain suppression information so it does not email an unsubscribed address again.
• Operational logs: app sync diagnostics exclude email addresses, credentials, and request bodies. Hosting infrastructure may process request metadata such as IP addresses to deliver and secure requests; we do not add IP addresses or location to our signup database.

9. Your choices

• Sign out & delete registration: choose “Sign out & delete registration” in Parent settings. This signs the Google account out of NanaTato on this device and removes that installation together with its app-open record — its last-used date and its day count — and removes the email and Google account ID if they are not attached to another installation or newsletter request. Collection stops immediately; the server deletion completes when connected. Your local favorites remain. Because the sign-in is required, using the app on this device again means signing in again.
• Unsubscribe: use the link in a newsletter email to stop newsletter delivery.
• Access, correct, or delete all records: contact hello@gopherlume.com. This includes other installations, API newsletter requests, and mailing-system records associated with your address.
• Clear local data: uninstall or clear app storage. This does not by itself delete server records. Let queued deletion finish before uninstalling, or contact us.

10. Changes to this policy

If we ever change how the app works in a way that affects this policy, we will update this page and revise the "Last updated" date above. Material changes will be reflected here before they take effect.

11. Contact

Questions about privacy? Contact us at hello@gopherlume.com.

NanaTato is a parent-led bedtime routine and calming story app. It is not a medical app and does not diagnose, treat, cure, or prevent any condition.