BEDTIME HEROES — LEGAL

Privacy Policy

Last updated: 15 November 2026 · Effective: 20 October 2026

Bedtime Heroes is a mobile app of animated, narrated bedtime stories for children aged about 3 to 8, published by Navaye, a sole proprietorship based in Gwalior, Madhya Pradesh, India ("Navaye", "we", "us", "our"). A grown-up can turn one photo of a child into a cartoon "hero" who stars in the stories. This policy explains what personal data the app and its pages on this website handle, why, who receives it, where it is stored, how long it is kept, and the rights you have over it.

Because the app is made for children, this policy is written for the parent or guardian who sets it up. It is written to comply with India’s Digital Personal Data Protection Act, 2023 ("DPDPA") and the Information Technology Act, 2000 and, where they apply, the EU and UK General Data Protection Regulation ("GDPR"), the UK Age Appropriate Design Code, the US Children’s Online Privacy Protection Act ("COPPA") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). It forms part of, and is governed by, the Bedtime Heroes Terms of Service. If you do not agree with this policy, do not use the app.

IN SHORT

No ads, no third-party analytics or crash reporting, no advertising ID, no location and no tracking across other apps or websites. We never sell personal data.
To keep the app working and make it better, the app sends our own server simple usage events, such as which screens were opened, which stories were played and for how long, and whether a hero drawing worked. They never include the hero’s name, the photo, the drawing, an email address or anything typed, are not shared with anyone, are never used for advertising, and are deleted after 180 days or with the account.
There is no sign-up. On first launch the app makes an anonymous account on our server, and remembers the phone by a scrambled (keyed-hash) form of its Android ID or, on iPhone, of a random ID the app keeps in the iOS Keychain, so reinstalling gives the same account back.
Making a hero is for grown-ups only, behind a parental gate and a consent screen. The photo is sent once to our server, which passes it to Anthropic’s Claude AI to describe the child as a cartoon. We never store or log the photo; Anthropic deletes API data within 30 days, with narrow exceptions.
What we keep is the cartoon drawing (hair, skin tone, clothes and so on, as colours and shapes) and the hero’s name, linked to the account, so the hero can come back after a reinstall. The age you can pick for a hero stays on the phone.
Email is optional. A grown-up can add one to keep heroes and Premium when changing phones and to use them on a second phone. Signing in moves the heroes and Premium made on the phone while signed out into the email account. It is used only to sign in, with a 6-digit code.
Premium is a Google Play or App Store subscription processed for us by RevenueCat. We never see card or bank details.
On iPhone, if the app was installed from an Apple Ads advert on the App Store, Apple tells us which campaign and search term it came from, so we can see which adverts work. No advertising ID is read and nothing about your child is involved.
On Android, from the November 2026 update, the app records once which Google Play link it was installed from (the campaign tags in that link, and whether it came from a Google ad), so we can see which adverts and links bring families. No advertising ID is read and nothing about your child is involved.
Uninstalling or deleting the app does not delete what our server holds. To delete it, use Delete all data in the app (grown-ups’ area → Privacy & data; on Android, from the next app update) or email [email protected]: see navaye.com/bedtime-heroes/delete-account.

This box is a plain-language guide only. The numbered sections below are the terms that actually apply.

1.Scope of this policy

This policy applies to the Bedtime Heroes app on Android and iOS (iPhone) and to its pages on this website, including the account-deletion page.

It does not apply to Google Play, the Apple App Store, the camera app or photo picker on your phone, or any other service you reach from the app. Those services are run by their own providers under their own privacy policies.

Where a short summary inside the app, such as the Privacy & data page in the grown-ups’ area, differs from this policy, this policy is the complete and accurate statement. In particular, hero drawings and hero names are kept on our server as well as on the phone, as described below; some app versions say otherwise in places, and the next app update corrects them.

2.Who is responsible for your data

Navaye decides what personal data the app handles and why. Under the DPDPA Navaye is the Data Fiduciary, under the GDPR Navaye is the controller, and under COPPA Navaye is the operator, for everything described in this policy.

Our service providers (Supabase, Anthropic, RevenueCat and Resend, see "Who we share data with") process data only on our instructions. Google and Apple act as independent controllers for their stores and payment systems.

Operator contact details: Navaye (sole proprietorship), Gwalior, Madhya Pradesh, India, email [email protected].

3.Personal data we handle

We handle only what the app needs to work. The categories below are complete as of the date of this policy.

Anonymous account. On first launch the app silently signs in to our backend with an anonymous session and is given a random account ID. There is no sign-up screen and no password. The session is an anonymous user record held by our backend provider, with the access and refresh tokens the phone uses to prove it is you; your plan, your heroes and their drawing history belong to the account.
Phone record. So that reinstalling the app (or, on Android, clearing its data) gives the phone its own account back (and does not reset the free plan), the app sends an identifier for the phone to our server each time it opens or comes back to the screen. On Android this is the phone’s Android ID, a number Android gives each app on each phone; it survives reinstalling and changes only after a factory reset. On iPhone it is a random ID the app makes on its first run (taken from the random identifier iOS gives our apps on that iPhone, or newly generated) and keeps in the iOS Keychain for that iPhone only: it does not move to another iPhone, it survives deleting and reinstalling the app, and it goes when the iPhone is erased. Our server immediately turns the identifier into a keyed hash (HMAC-SHA256 with a secret key only our server holds) and stores only that hash, never the identifier itself, in a table or a log. With the hash we keep the platform (Android or iOS), which account the phone is on and which account is its own, the anonymous user and session that last registered it, and when the phone was first registered, last seen, signed in to its current account, and signed out by another phone, and how many free hero drawings were made on it under accounts that have since been deleted (see "How long we keep it").
Hero name. The name a grown-up types for a hero (up to 40 characters). It is stored with the hero on our server and shown on the hero’s title cards in the app. It does not need to be the child’s real or full name.
Hero drawing. The cartoon character our server draws from the photo: a set of drawing parts and settings that record the hero’s skin tone, hair colour and style, eye colour, eyebrows, freckles, glasses, facial hair, clothes, shoes, accessories and a gentle hint of build, plus one short neutral sentence describing hair and clothes (for example "Short brown hair, round glasses, a red checked shirt"). It is stored in our private file storage and database, linked to the account. Because it is drawn from the child’s appearance, we treat it as the child’s personal data. See "The photo and the hero".
Drawing log. One record for each time a hero is drawn or redrawn: the account, the phone record, the hero, the time, the outcome (drawn, declined, failed), the AI model used, the number of tokens and the cost, and a short technical note when something went wrong. It never contains the photo.
Email address (optional). If a grown-up adds an email in the grown-ups’ Account page, we store it with the account and with the sign-in record our backend provider keeps for that email, and use it only to send a 6-digit sign-in code. With an email the account can be used on up to two phones; signing in on a third signs the oldest one out. When a phone signs in to an email account, what the phone made while signed out (its heroes, their drawing log, and any Premium bought on it) moves into the email account, and the phone is given a new, empty account of its own for whenever it signs out. The app says: "We only use it to sign you in. No newsletters."
Plan. Whether the account has Premium: the subscription period (yearly or monthly), the product, the store, when it ends, whether it will renew, whether it is in its free trial, whether there is a billing problem, whether it was a store test purchase, and the time of the last hero-drawing attempt (used to limit attempts to one a minute). We do not store order numbers or any payment details.
Feedback. Now and then (at most three times a year, and only once a hero has been made and two stories watched), the app asks on its home screen "Do you like Bedtime Heroes?". A yes offers to rate the app on Google Play or the App Store. Otherwise the grown-up can tick what could be better (for example the stories, the hero, the price or the sound) and add a short note of up to 500 characters. If you send it, we store the ticked boxes and the note with the account, the platform, the app version and the time. Please do not put personal details in the note.
App usage. From app version 0.1.4 (iPhone) and the matching Android update, the app records simple events about how it is used and sends them to our own server in small batches (unsent events wait on the phone until it is online). The events are: the app opening (with the plan, free or Premium, and how many heroes the family has), going to the background and coming back, and how long it was open; which screen was opened, and the one before it; a story starting and ending, with its language, whether the default or a made hero starred, how far it played and for how long, and whether it finished or was closed; the player’s own controls (pause, captions, the bedtime dimmer, listen-only, the story language); a hero drawing starting, working or failing, with the error code; the Premium plans screen being shown, and the product and outcome of a purchase or restore; story and language downloads, with their size and how long they took; the answers to the rating question and, for feedback, how many boxes were ticked and whether a note was written (never the note itself); and changes to the app’s language. Each event carries a random ID the app makes for this installation, a session ID, a counter, the account ID, the time, the platform, the app version, whether it is a test build, the phone model and operating system version, and the phone’s language and region settings. Events never contain the hero’s name, the photo or the drawing, an email address, a feedback note or anything else typed, the phone’s identifier or its hash, a location, or any advertising or hardware identifier, and we store no IP address or country with them. We use them only in our own analysis, mostly as totals, to see which stories are watched and finished, where the app goes wrong, and how long it is used (see "How long we keep it"). On Android, from the November 2026 update, one more event is sent once per installation: which Google Play link the app was installed from. Google Play’s install referrer service tells the app the campaign tags in that link (its source, medium, campaign, content and term), whether it came from a Google ad click (only yes or no, never the click’s ID), and when the link was opened and the install began; installs found in the store itself show as Google Play. No advertising ID is read, and nothing is sent to Google or to any ad network.
Technical data. Whenever the app talks to our servers, they and our providers receive your IP address and basic request information, such as the app’s user agent. Our backend provider records these with sign-in sessions and in its security logs. Our server functions log one line per request with the anonymous user, account and phone record IDs, the action, the story or app version asked for and the outcome; never a token, an email address, the phone’s identifier or its hash, the photo, or a feedback note.
Support correspondence. If you email us, your email address, your message and anything you send with it.

Kept only on the phone. The hero’s age, if you pick one when naming the hero (it is optional and is never sent to us); the list of heroes with their names and the date each was made; the installed hero drawings (also held on our server, as above); the watch history (which stories have their gold star and which episode is up next); your Bedtime and Downloads settings; downloaded stories; the random installation ID and any usage events not yet sent (see "App usage"); cached copies of the plan, store prices, story menu and its pictures; when you last chose "Not now" on an update message; on Android, when the feedback question was shown and whether it was answered; and the sign-in session, in the app’s private storage. Nothing here leaves the phone except as described above. Delete all data in the app, or deleting the app (on Android, uninstalling it or clearing its storage), removes it. On iPhone, the random phone ID stays in the Keychain, as described above.

4.The photo and the hero

This is the most sensitive thing the app does, so here is exactly what happens.

Taking or choosing the photo. Only a grown-up can start this, behind the parental gate and the consent screen (see "Children’s privacy"). On Android, "Take a photo" opens the phone’s own camera app; the shot is written to a temporary file in the app’s private storage and deleted as soon as it has been read. "Choose a photo" opens Android’s system photo picker, which shares only the one picture chosen. The Android app does not ask for camera or storage permission. Some camera apps keep their own copy in your gallery; that copy is yours and we never touch it. On iPhone, "Take a photo" opens the iPhone’s camera inside the app, which asks for camera permission the first time; the shot goes straight to the app and is not saved to your photo library. "Choose a photo" opens the iOS system photo picker, which shares only the one picture chosen; the app does not ask for access to your photo library. On both, the app cannot see the rest of your photos.
On the phone. The app turns the picture upright, makes it smaller, and re-encodes it as a JPEG, which drops its metadata, including any location. It keeps it in memory only, to show it for checking on the naming screen and to send it once.
On our server. The photo is sent over an encrypted connection to our make-hero server function. The function holds it only in memory, for that one request. It is never written to our database, our file storage or our logs.
Anthropic. The function sends the photo, with our fixed drawing instructions, to the Claude API of Anthropic PBC, our processor, and asks for a description of the person as a cartoon character. Anthropic receives the photo and those instructions only: never the hero’s name, an email address or any account or phone ID. Anthropic’s privacy centre states that API inputs and outputs are deleted from its backend within 30 days, except where they are flagged for a breach of its Usage Policy (inputs and outputs then kept for up to 2 years and safety classification scores for up to 7 years) or where the law requires longer retention. Anthropic’s commercial terms do not allow it to train its models on our customers’ content.
What we keep. From Claude’s description our server builds the hero drawing (see "Personal data we handle") and stores it, with the name, linked to the account. On the phone, the photo is dropped from memory as soon as our server has answered, whether the hero was drawn or not. The app shows "Photo deleted" when the hero is ready.
No face recognition. We do not create a faceprint or any other biometric identifier, we do not use the photo or the drawing to identify anyone, and we do not compare faces. Our instructions tell the AI not to guess a person’s age, ethnicity, religion, body or personality. The drawing does record a skin tone and hair colour, so we treat it with the same care as the photo.
Declined photos. If the photo shows no person, more than one person, or is unsuitable, the AI or its safety checks may decline it. Nothing is drawn or kept, the photo is dropped the same way, and the log records only that it was declined.

You can choose not to make a hero at all. Every story plays with the app’s own default hero, and the app says "starring you" instead of a name.

5.What we do not collect

No advertising, ever: the app contains no ad software, and no advertising ID is read.
No third-party analytics, crash-reporting or tracking software, and no profile of you or your child across other apps or websites. The app’s own usage events (see "App usage" above) go only to our server, are not shared, are not used for advertising, targeting or profiling, and are not used to make decisions about any child.
No location. The app does not ask for location access, and the photo’s location metadata is removed on the phone before it is sent.
No contacts, no microphone, no files, and no access to your photo library beyond the one photo chosen in the system picker.
No date of birth, address, phone number or government identity number. The only name we hold is the hero name you type, and the only contact detail is the email address you choose to add.
No card numbers, UPI IDs, bank details or any payment credential. Payment happens entirely inside Google Play (or the App Store).

The app asks Android only for internet access, network status, vibration, Google Play billing and Google Play’s install referrer service (which says which store link the app was installed from). On iPhone, the only permission it asks for is the camera, the first time you choose "Take a photo". We do not sell or rent personal data, we do not "share" it for cross-context behavioural advertising, and we do not use it to train machine-learning models.

6.Why we handle it, and on what basis

Under the DPDPA we process personal data on the basis of consent, given by the parent or guardian, or where the Act permits a legitimate use. Under the GDPR the legal bases are as stated below.

To run the app and keep your account: the anonymous account, the phone record, the plan and the story downloads. GDPR basis: performance of our contract with you (the Terms).
To make and keep a hero: the photo (in memory only), the drawing, the name and the drawing log. Basis: the parent’s or guardian’s consent, given on the "Before we start" screen.
To keep one free allowance per phone: the hashed phone record, so reinstalling does not give a new free hero, and the limit of one drawing attempt a minute. Basis: our legitimate interests in preventing abuse of the free plan and of our paid AI service, which we have weighed against your interests; under the DPDPA, a legitimate use for preventing fraud.
To sign in with email, if you add one: to send the code, to move heroes and Premium to another phone, and to bring what a phone made while signed out into the email account. Basis: your consent, given by adding the email; under the GDPR, performance of contract at your request.
To sell Premium and keep it working: to know whether the account has Premium, to show the right plan and to handle renewals, trials, cancellations and refunds. Basis: performance of contract, and legal obligation for the records accounting and tax law require.
To keep the service secure: security logs and request logs. Basis: our legitimate interests in a secure service.
To keep the app working and improve it: the app usage events, studied mostly as totals (for example, how many stories are finished, which screens cause trouble, how long the app is used). Basis: our legitimate interests in a reliable app that families enjoy, which we have weighed against your and your child’s interests: the events hold nothing about the child’s appearance or name, are not shared, are kept for 180 days, and are never used for advertising, targeting or profiling; under the DPDPA, a legitimate use necessary to provide the service you asked for. Under COPPA, the random installation ID is used only to support the internal operations of the app.
To improve the app: the feedback answers you choose to send. Basis: your consent, given by sending them.
To learn which adverts work: on iPhone, the Apple Ads attribution described under "Premium subscriptions"; on Android, the Google Play install link recorded with the app usage events (see "App usage"). Basis: our legitimate interests in spending our advertising budget well, which we have weighed against your interests; it identifies no one and involves nothing about your child.
To answer you: support, data requests and grievances. Basis: legitimate interests, and legal obligation where a law requires us to respond.
To meet legal obligations: to respond to lawful requests and keep records a law requires.

We make no automated decision that has legal or similarly significant effects on you or your child, and we do no profiling. The AI decides only how to draw the hero, and whether a photo can be drawn at all.

8.Children’s privacy

Bedtime Heroes is made for young children, and we have designed it so that children do not give us personal data themselves.

The kids’ area collects nothing from the child. Children pick a hero and a story, watch, and earn gold stars. There is no chat, no messaging, no public profile and no sharing in the kids’ area. The only typing there is in the app’s occasional feedback question, which is addressed to the grown-up (see "Feedback" under "Personal data we handle"), and the only links out of the app are the exceptions in the next point.
Grown-up actions sit behind a parental gate. Making a hero, buying or restoring Premium, the email account, settings, downloads, the Privacy Policy and every link out of the app are behind a "Grown-ups only" screen that asks for a three-digit number written in words (for example "seven, two, nine"), new each time. Three wrong tries lock it for 30 seconds. The gate is designed to keep young children out; it does not check anyone’s identity or age. The exceptions are the message offering an app update, which opens the app’s page on Google Play or the App Store directly, and, on Android, the "Rate it" button that can follow the feedback question, which opens the app’s Google Play page.
Then a consent screen. A hero can only be made after the grown-up confirms on the "Before we start" screen that they are the child’s parent or guardian and agrees to this policy and to the photo being processed by our AI drawing service (see "Consent, and how to withdraw it").
What we collect about a child, and only through that grown-up flow: the photo (held in memory for one request, never stored), the hero drawing and the hero name. The age, if chosen, stays on the phone. We use them only to draw the hero and show it in the stories on your phones. We disclose them to no one except our processors: Anthropic, to draw the hero, and Supabase, to store it. We never make them public.
No more than necessary. No child has to give anything to use the app: every story plays without a hero. We never ask for more than a photo and a name to make one.

Parents’ and guardians’ rights. You may at any time ask us to show you the personal data we hold about your child (we will send you the hero names and drawings and the details we hold about the account), to delete it, and to refuse any further collection or use of it. Email [email protected] (see "Proving it is you" under "Your rights"). We will not ask a child for anything in return for these rights.

United States (COPPA). The app’s usage events carry a random installation ID, which we use only to support the internal operations of the app (keeping it working, fixing faults and improving it), never for advertising, profiling or contacting anyone. We collect a child’s photo and name only from a parent or guardian, through the parental gate and the consent screen described above, after the notice on that screen and in this policy. Our processors use the data only to provide the service to us. We keep it only as long as described in "How long we keep it" and delete it on request.

EU and UK (GDPR Article 8 and the Age Appropriate Design Code). Where we rely on consent for a child’s data, we ask for it from the person with parental responsibility, not the child. The app is private by default: there are no ads, no profiling, no location, no nudges to share more, no public features, and nothing is shared beyond the processors named here.

India (DPDPA section 9). Anyone under 18 is a child under the DPDPA. We process a child’s data only with the consent of a parent or lawful guardian, as described above, and we do no tracking, no behavioural monitoring and no targeted advertising directed at children; the app contains none of these. The app’s usage events (see "App usage") describe how the app is used, are studied mostly as totals to keep it working and improve it, and are never used to monitor, profile or target any child. The same protections apply to a person with a disability who has a lawful guardian.

Grown-up settings, purchases and the email account are meant for adults. If you believe a child has made a hero, added an email or given us personal data without a parent’s or guardian’s consent, email [email protected] and we will delete it.

9.Premium subscriptions

Premium is a subscription sold through Google Play on Android and the Apple App Store on iPhone. The store takes your payment under its own terms and privacy policy, and we never see your card, UPI or bank details.

We use RevenueCat to process subscriptions. The app starts RevenueCat’s software once the phone has registered, with your random account ID as RevenueCat’s customer ID; it is never started anonymously. RevenueCat receives that ID, technical information its software collects from the app (such as device model, operating system, app version, and store country and currency), and the store’s purchase details when you subscribe. If you add an email, our server also sets it on your RevenueCat customer record, so we can find your subscription when you contact us. Google’s real-time notifications and Apple’s App Store server notifications tell RevenueCat about renewals, trial conversions, cancellations and refunds, and RevenueCat tells our server, which updates your plan.

Advert attribution (iPhone). We may advertise the app on the App Store with Apple Ads. To learn whether an install came from one of those adverts, RevenueCat’s software asks Apple’s AdServices framework for a short-lived attribution token and RevenueCat sends it to Apple, which answers whether the install came from an Apple Ads campaign and, if so, which campaign, ad group and search keyword. RevenueCat keeps that answer on your customer record, and we see it only as totals, to tell which adverts lead to subscriptions. This needs no tracking permission: no advertising ID is read, nothing is shared with advertisers or ad networks, and it is not used to show you or your child ads. Apple may also tell an ad network, without identifying you, that an install came from one of its adverts (Apple’s SKAdNetwork); the app itself sends nothing to ad networks.

Cancelling is done in the store: in Google Play on Android, or on iPhone in Settings → Apple Account → Subscriptions (the app’s Plan page has a "Manage in Google Play" or "Manage in App Store" button). Deleting your data does not cancel a subscription.

11.Where your data is stored and processed

Our database and file storage are hosted by Supabase on cloud servers in Tokyo, Japan. Our server functions run on Supabase’s network and may handle a request, including the photo in memory, in a data centre near you. Anthropic, RevenueCat and Resend are based in the United States and process data there, and Google and Apple operate globally. Your personal data is therefore stored and processed outside India and, if you live in the EU or UK, outside your country.

The DPDPA permits such transfers except to countries the Central Government restricts by notification; we do not transfer personal data to any restricted territory. For people in the EU and UK, Japan is covered by an adequacy decision, and transfers to our other providers rely on their data processing terms, including the European Commission’s Standard Contractual Clauses and the UK equivalent, or another lawful transfer mechanism. You can ask us for details of these safeguards.

If we move our hosting to another region, we will update this section.

12.How we protect it

We take reasonable security safeguards, including:

Encryption of all data in transit (TLS), and encryption at rest by our hosting provider.
The photo is never written to disk on our side, and never logged.
The phone’s identifier (its Android ID, or the random ID the iPhone app keeps) is stored only as a keyed hash, never in readable form.
Row-level security in the database: a session can read only its own account’s rows and its own account’s hero drawings, and it cannot write to any table or file directly. Hero drawings are in a private file store and are handed to the app only through links that expire after 10 minutes.
Every change goes through server functions that check the session, the account and the plan. Subscription notifications from RevenueCat are authenticated before they are read.
Our server functions log outcomes and IDs only, never tokens, email addresses, the phone’s identifier, the photo or a feedback note.
The sign-in session is kept in the app’s private storage on the phone.

No system is perfectly secure. Anyone with your unlocked phone can use the app as you, and anyone who controls the email address on an account can sign in to it.

13.If there is a data breach

If a personal data breach occurs, we will notify the Data Protection Board of India and affected users in the form and within the time the DPDPA and rules made under it require, and, where the GDPR applies, the competent supervisory authority within 72 hours where required. Notice to you will describe, as far as we know it, what happened, its likely consequences, what we have done and what you can do to protect yourself.

Because most accounts have no contact details, notice may be given in the app or on this website, and by email where an account has one.

14.How long we keep it

The photo: not kept by us at all. It exists only in the phone’s memory until our server answers, and in our server’s memory for the one request. At Anthropic, API inputs and outputs are deleted within 30 days, with the exceptions described in "The photo and the hero".
The account, its heroes (drawings and names), the drawing log and the plan: for as long as the account exists, so heroes and Premium come back after a reinstall or on a second phone. We delete them when you use Delete all data (or, for one hero, Delete [name]’s hero) in the app, or when you ask us (see navaye.com/bedtime-heroes/delete-account). We do not yet delete inactive accounts automatically.
Phone records: kept when an account is deleted, but with nothing about that account. Each phone that was on it is moved to a new, empty account, and its record keeps only the keyed hash, the platform, when it was first and last seen, and a count of the free hero drawings already made on it, so that deleting an account never gives a phone a second free hero. We do not yet delete phone records automatically.
The email address: until you ask us to remove it or the account is deleted.
Feedback answers: kept to help us improve the app. If the account is deleted, they stay without any link to it.
App usage events: 180 days from when they happened, then deleted automatically every day. Delete all data in the app deletes the account’s events at once, including those its phones sent before the account was registered, and gives the phone a new random installation ID; unsent events on the phone are deleted with it.
RevenueCat customer records: deleted at our request when the account is deleted. RevenueCat may keep records of transactions it processed as its own policies and the law require.
Financial records: the sales reports Google Play, the App Store and RevenueCat give us, which list subscription orders but not your name or email address, are kept for as long as accounting and tax law requires, currently up to eight financial years in India.
Logs and backups: request and security logs, and our hosting provider’s encrypted backups, are kept for a limited period and then overwritten in the normal rotation. Backups are never used to restore an account that was deliberately deleted.
Support correspondence: up to 24 months from the last message.
On the phone: until you delete it. Delete all data in the app, or deleting the app (on Android, uninstalling it or clearing its storage), removes everything it saved there, except that on iPhone the random phone ID stays in the Keychain. Deleting the app does not delete what our server holds: if the app is installed again on the same phone, it gets the same account back.

Where we must keep something to meet a legal obligation, or to establish, exercise or defend a legal claim, we keep only that, and only for as long as the obligation or claim lasts.

15.Your rights

Everyone. Under the DPDPA you have the right to:

Access: a summary of the personal data we hold about you or your child, how it is processed, and who it has been shared with.
Correction and completion of inaccurate or incomplete data, for example a hero’s name.
Erasure of personal data, unless a law requires us to keep it.
Grievance redressal: a readily available way to complain to us, and escalation to the Data Protection Board of India if you are not satisfied.
Nomination of another person to exercise these rights for you in the event of your death or incapacity.

Parents and guardians have the further rights set out in "Children’s privacy".

EU and UK users. Under the GDPR you also have the right to restrict processing, to data portability (a copy of the data you gave us in a machine-readable format), to object to processing based on our legitimate interests, and to withdraw consent at any time. You may complain to the data protection supervisory authority where you live or work (in the UK, the Information Commissioner’s Office).

California residents. Under the CCPA you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share your personal information, including that of children under 16, and we use sensitive personal information only to provide the service you asked for. The categories we collect are those listed in "Personal data we handle", from the sources and for the purposes described above. You may use an authorised agent.

How to exercise them. Email [email protected]. We answer within one month, or tell you within that month why we need longer. You can also delete a hero, or everything, yourself in the app, on the grown-ups’ Privacy & data page.

Proving it is you. We hold no name or contact details for most accounts, so we must link your request to an account before acting on it. If the account has an email address, write from that address. If it has none, you can add one in the app (grown-ups’ area → Account) and then write from it, or quote the Google Play order number or App Store order ID of a Premium subscription. The details are at navaye.com/bedtime-heroes/delete-account. We verify every request against our records before acting on it, and may decline requests that are manifestly unfounded, excessive or repetitive, telling you why.

Your duties. The DPDPA also requires you not to impersonate anyone when providing data, not to suppress material information, and not to file false or frivolous complaints.

16.Grievance redressal

We have appointed a Grievance Officer as required by the DPDPA and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Grievance Officer
Navaye (sole proprietorship)
Gwalior, Madhya Pradesh, India
Email: [email protected]

Write to that address with what happened, what you want done, and anything that ties you to your account (see "Proving it is you"). We will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt, or tell you why we need longer.

If you are not satisfied with our response, you may complain to the Data Protection Board of India established under the DPDPA, to your local supervisory authority if the GDPR applies to you or, in the United States, to the Federal Trade Commission.

17.This website

The Navaye website sets no advertising or tracking cookies and runs no third-party analytics. Pages are served as static files. Fonts are loaded from Fontshare and Google Fonts, which receive your IP address and browser user agent as a normal consequence of serving those files.

The account-deletion page for Bedtime Heroes contains no form; deletion is done in the app, or requested by email.

Standard server request logs (IP address, timestamp, requested URL, user agent) may be kept by our hosting provider for a short period for security and troubleshooting.

18.Changes to this policy

We may update this policy as the app changes or the law does. The "last updated" date at the top always reflects the current version.

For changes that materially reduce your rights or materially expand what we collect, in particular about children, we will give notice in the app at least 14 days before they take effect and, where the law requires consent for the change, we will ask the parent or guardian for it rather than assume it.

For minor clarifications, correction of errors, and changes required by law with immediate effect, the updated policy applies as soon as it is posted. Continuing to use the app after a change takes effect means you accept the updated policy.

19.Contact

For any privacy question, data request or grievance:

Navaye (sole proprietorship)
Gwalior, Madhya Pradesh, India
Email: [email protected]

Please put "Bedtime Heroes" in the subject line.