Privacy Policy

Last updated: 7 October 2026

NanaTato ("NanaTato", "we", "us") is a parent-led bedtime routine and calming story app for families. We built it to ask for almost nothing. This policy explains, in plain language, exactly what we hold and what we don't.

This policy covers the three NanaTato apps on Google Play, NanaTato (Bedtime Stories), NanaTato: Playland and NanaTato: Wordle, and this website. Playland and Wordle ask a grown-up to sign in with Google once before play. That creates or opens a NanaTato collection: section 6 explains what it stores, including each finished round's score for leaderboards. Device coins, stickers, settings, Wordle guesses and statistics stay on the device. To delete an account and its data, see Delete your NanaTato account.

1. Grown-up sign-in

Registering a NanaTato Bedtime Stories install is required once per install, and it happens through Sign in with Google. The app cannot be used until a grown-up has signed in; every story plays offline after that. When a grown-up signs in, we receive exactly three things about that Google account: its email address, its Google account ID (a number that identifies the account to us and to nobody else), and Google's own confirmation that the address is verified. Google's sign-in token also carries your name and profile picture; Bedtime Stories does not keep them. We do not receive your contacts or anything else in your account, and there is no NanaTato password — we never see or create one. Alongside those, our API stores a random installation identifier, the app version, the signup date, and the date and version of the privacy notice you accepted. We use this to understand registrations and operate the service. Signing in does not synchronize favorites and does not subscribe you to a newsletter.

The sign-in runs on your device through Google Play services, and Google's own handling of it is covered by the Google Privacy Policy. Google hands the app a short-lived signed token; our API checks that signature against Google's public keys, reads the email and account ID from it, and discards the token. It is never stored or logged.

There is nothing else to register: one grown-up's Google account for this install, once. You can sign out and delete the registration in Parent settings at any time; using the app again on this device means signing in again.

We do not ask for child names, ages, birthdays, schools, photos, recordings, contacts, or locations. The sign-in is addressed to grown-ups: sign in with your own Google account, never a child's. Later controls are in Parent settings behind the grown-up check.

2. Information stored on your device

Favorites, playlists, bedtime style, and Calm Mode settings are stored on your device. After the Google sign-in the app also keeps the signed-in email there, so Parent settings can show which account is registered. These preferences are not backed up to our API. The app also stores installation credentials and a note of the last day it told us the app was opened. Nothing is collected retrospectively from before the install was registered.

That pending work survives app restarts and retries when a network connection is available. API failures do not block onboarding, navigation, or playback. Uninstalling the app or clearing its data removes local information, including any requests that have not yet been sent.

3. App activity

Once an install is registered, it sends one small signal at most once a day — “the app was opened today” — with the app version, linked to the grown-up signup through the installation identifier. There is no toggle for it in the app; it is part of the registration. We use it for two things only: the date the app was last used, and a count of the days it was opened. That tells us whether the app is being used and which versions are in use. No story titles, story identifiers, play counts, routine steps, child profiles, or advertising identifiers are included.

This signal is not anonymous: it is linked to the signup email. It says the app was opened, not who opened it or what was played. Counts describe registered installations and are not verified individual people.

There are no third-party analytics SDKs. This record is kept with the registration and deleted with it: choose “Sign out & delete registration” in Parent settings, or write to us, and the last-used date and the count of days opened go with it. If offline, that server request waits until a connection is available.

Like every request to our API, this signal also leaves one line in our API request log. That log is described in section 8. It holds no email address, Google account ID or installation identifier, and we do not link it to your registration.

4. This website

This website does not use advertising or tracking cookies. The optional collection page loads Google Identity Services to let a grown-up sign in. It uses a secure, HTTP-only sign-in cookie lasting ten minutes and a secure, HTTP-only session cookie lasting up to 30 days. These cookies are needed to authenticate your collection; browser sign-out clears them and revokes that browser session. They are not available to JavaScript and are not used for advertising. The collection page requests your points and outfits from our API. Our hosting provider (Cloudflare) processes request metadata to deliver and secure the site. Google's handling of its sign-in service is covered by its privacy policy.

Requests to our API are different. The app's requests, including the newsletter form in its Settings, and the confirmation link in a newsletter email each leave one line in the API request log described in section 8.

5. Permissions and offline operation

Stories, sounds, and lullabies are bundled with the app and play offline. Internet access is needed once for the grown-up sign-in that registers the install; after that it supports the once-a-day app-open record, deletion requests, the newsletter form, optional shared collections, friend rewards and Google Play purchases. Background work checks connectivity and retries failed API requests. Each of those requests is noted in the API request log (section 8). We do not request camera, microphone, contacts, or location permissions, and the app never reads your device's location.

6. Optional outfits, shared collections and invitations

The bedtime story library remains free, with no ads or library subscription. A grown-up can enable an optional NanaTato collection, buy cosmetic outfits with earned moon points, or purchase the same items through Google Play. Purchases and outward sharing are behind the grown-up check. Google handles payment details; NanaTato does not receive card or bank details.

Enabling a collection stores a random account identifier, authenticated session credentials, points, owned item identifiers, acquisition dates and sources, point reward/spending records and friend-code redemptions. A Bedtime collection is linked to the existing verified grown-up Google account. Playland and NanaTato: Wordle require a grown-up's Google sign-in before play. Earlier test builds could also use a guest collection or a private ten-minute link code. Direct collection sign-in verifies and discards the Google token, keeping the Google account ID to connect your collection across apps and the website; it does not store the email or create an app activity registration. Signing a guest collection in transfers its earned points and outfits to the selected account. An unused starter bonus is counted once. A retired guest identifier is kept with the collection to prevent duplicate rewards and keep old invitation links working. Device coins, story favorites and stickers stay local.

Playland and Wordle send a game identifier, rating stars and active seconds with a unique round identifier to request shared rewards, including queued offline rounds; the server stores the reward record and credited time. With each round they also send the level and the round's score, which we keep with the account for leaderboards (Wordle's score is worked out from the number of guesses and the time taken). Scores are not shown to other players yet; before leaderboards appear we will update this policy, and they will show only an automatically generated nickname, never a name, email or photo. Wordle guesses, answer words, local statistics and daily streaks stay on the device. Shared spending needs a connection. For Google Play purchases we keep the product/app identifier and purchase token privately to verify completion, acknowledge the purchase and check later refunds. Previously saved collections can be viewed offline.

Sharing uses Android's share sheet; NanaTato does not read contacts or learn whom you send the link to. A new verified grown-up account redeeming a public friend code within thirty days receives 50 moon points, and the inviter receives 50 points once. Opening the share sheet or clicking a link does not earn points. A one-way hash of the verified account identity is retained to prevent repeated friend rewards after deletion.

Use “Delete shared collection” in the grown-up closet to delete its points, inventory, purchase records, round scores, sessions and friend history. This is separate from deleting an app registration or leaving the newsletter and does not refund Google Play purchases. Signing out of Bedtime removes that local collection session, while preserving the shared collection for your other apps. Clearing data or uninstalling loses access to an unlinked guest collection. You can view your saved points and outfits on the website by signing in with the same Google account. Signing out of Wordle, Playland or the website revokes that session and preserves the collection. Direct app sessions expire after one year and require sign-in again; new browser sessions expire after 30 days. Short-lived sign-in challenges are cleaned up after expiry when the next challenge is created.

7. Children and grown-up choices

NanaTato is intended for children and grown-ups to use together. The sign-in is for grown-ups: the account that signs in must be your own, never a child's. We do not ask children to supply information and do not create child accounts. The count of days the app was opened may reflect shared family use; it contains no child details or content titles.

If a child has supplied an email address or you want records removed, contact hello@gopherlume.com.

8. Storage, newsletter, and retention

Signup, activity and optional collection records are stored in a Cloudflare D1 database through an API hosted on Cloudflare Workers. Production requests use HTTPS. Hosting and database providers process this information to operate the service. We do not sell signup information or provide it to advertising networks.

• App registrations: retained until deleted. The verified email address and the Google account ID are kept with the registration for as long as it exists; the sign-in token itself is checked and discarded, never stored. The last-used date, the count of days the app was opened, and the app version are kept with the registration for as long as it exists and are deleted with it. The API request log below is a separate, short-lived record of requests. It is not part of the registration and holds nothing that names one.
• Shared collections: retained until the collection is explicitly deleted; the one-way account hash used to prevent repeated referral rewards is retained afterward. This is separate from registration and newsletter deletion.
• Newsletter requests: if you submit the newsletter form in the app's Settings, our API stores the email address, where the request came from, the date of the request, the time we sent you a confirmation email, and the time you confirmed. A request is not a subscription: until you confirm, nothing is added to any mailing list.
• News from NanaTato and Gopherlume: the Playland and Wordle sign-in screen has an optional box, ticked to start with, which a grown-up can untick before signing in: “Email me news from NanaTato and Gopherlume: new apps, videos and other Gopherlume products and offers.” Only if it is left ticked when a grown-up signs in, we keep the Google account's email address, first name and last name, which app it came from, the exact wording agreed to, and the request and confirmation times. We then send one confirmation email; nothing is sent to that address until the link in it is tapped. Confirmed addresses, with the name, are added to the NanaTato list and to a Gopherlume list in our mail platform. Gopherlume is the company that makes NanaTato. Every newsletter has an unsubscribe link, and you can ask us to delete these details at any time. If it is unticked, the name and email in the Google sign-in token are checked and discarded, never kept.
• Newsletter delivery: the confirmation email is sent by our own mail platform (sendoramo), which delivers it through Microsoft Azure Communication Services from a nanatato.com address. It contains one link, valid for 14 days, and it is not click-tracked. It does contain a tiny invisible image (an open pixel) served by that mail platform: when your mail app loads it, the platform records that the email was opened, the time, the user-agent your mail app sent, and a one-way hash of the IP address (the address itself is not stored). We use this only to see whether confirmation emails arrive and are read. Many mail apps let you block remote images, which stops it. Only tapping that link adds your address to the newsletter list, which lives in that mail platform along with the newsletters themselves.
• Newsletter retention: the request and confirmation record in our API remains until deletion is requested. Unsubscribe links in newsletters are handled by the mail platform; unsubscribing stops newsletter delivery and does not delete a separate app registration. That platform may retain suppression information so it does not email an unsubscribed address again.
• Operational logs: app sync diagnostics exclude email addresses, credentials, and request bodies. Hosting infrastructure may process request metadata such as IP addresses to deliver and secure requests. We do not add IP addresses or location to our signup database.
• API request log: each request to our API (sign-in, the daily app-open signal, collection/point/purchase/referral requests, deletion and newsletter requests, and the confirmation link in a newsletter email) leaves one line in our own analytics system. We run that system ourselves; it is not a third-party analytics service, and it is hosted on Microsoft Azure. A line records the endpoint that was called (an installation identifier in the address is replaced by a placeholder), whether the request carried authentication credentials, the response status, how long it took, the time, and the Cloudflare data center that answered. From the connection it also records an approximate location (country, region and city, looked up from the IP address), the network operator and its type (for example a home broadband provider or a data center), the user-agent the request was sent with (for the app, this names the Android version and the device model), and a pseudonymous code that changes every day. The IP address is used for that lookup and then discarded; it is not stored. The log holds no email address, Google account ID, installation identifier, credentials, or request contents, and we do not link it to a registration. We use it only to keep the API working and secure: to see errors and slow responses, and to spot abuse. Lines are deleted after 90 days. Because a line names no one, we cannot find a particular person's lines to show or delete them on request; they expire on their own. The log is not used for advertising and is not sold or shared. It records requests an install makes, never anything about a child.

9. Your choices

• Sign out & delete registration: choose “Sign out & delete registration” in Parent settings. This signs the Google account out of NanaTato on this device and removes that installation together with its app-open record — its last-used date and its day count — and removes the registration email and Google account ID if they are not attached to another installation or newsletter request. An enabled shared collection and its verified identity remain until that collection is separately deleted. App-open reporting stops immediately; the server deletion completes when connected. Your local favorites remain. Because the sign-in is required, using the app on this device again means signing in again.
• Unsubscribe: use the link in a newsletter email to stop newsletter delivery.
• Access, correct, or delete all records: contact hello@gopherlume.com. This includes other installations, API newsletter requests, and mailing-system records associated with your address.
• Clear local data: uninstall or clear app storage. This does not by itself delete server records. Let queued deletion finish before uninstalling, or contact us.

10. Changes to this policy

If we ever change how the app works in a way that affects this policy, we will update this page and revise the "Last updated" date above. Material changes will be reflected here before they take effect.

11. Contact

Questions about privacy? Contact us at hello@gopherlume.com.

NanaTato is a parent-led bedtime routine and calming story app. It is not a medical app and does not diagnose, treat, cure, or prevent any condition.