Privacy Policy

Last updated: October 2, 2026 · Applies to the Faby mobile app (iOS and Android, version 5.2.0) and fabyfun.com.

Other languages: Türkçe (full text) · Español · Français · العربية · हिन्दी · 中文 (summaries)

Contents

1. Who we are
2. Children's data and parental consent
3. What data we process
4. Transfers to AI providers
5. Advertising
6. Analytics
7. Notifications
8. Social features
9. Legal bases
10. International transfers
11. Retention
12. Security
13. Your rights
14. Account and data deletion
15. Website
16. Changes
17. Contact

1. Who we are

Faby (store ID com.ay.masalai) is a mobile app that creates personalised children's stories with artificial intelligence. Faby is provided by a developer based in Turkey. In this policy, "we" means the following data controller:

• Data controller: Yelkovan.ai (Yiğit Özdemir)
• Email: info@yelkovan.ai

Faby is used by families in Turkey, the European Union, the United States and elsewhere. This policy was therefore prepared with Turkey's Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR, including its rules on children) and the US Children's Online Privacy Protection Act (COPPA) in mind. Users in Turkey can also read the KVKK notice (in Turkish).

2. Children's data and parental consent

• Parents open and manage the account. Faby creates stories for children, but the account holder is an adult (a parent or legal guardian). Accounts are created by signing in with Google, Apple or email and password.
• Parents enter the child's details. You enter details such as the character's name, age band, gender and appearance. You do not have to use your child's real name; a nickname or an imaginary character name works too. We recommend not typing details such as home address, school name or phone number into story inputs.
• Parental gate. Purchases, settings, external links and sharing are protected by a simple adult check. The check is currently shown for some age groups and will be extended to all age groups in the next app version.
• Parental consent. The app asks for your consent before the voice cloning feature is used. From the next app version, the app will also ask the parent for consent before a child's data is sent to AI providers. You can read the consent text on the Parental Consent page. You can withdraw your consent at any time.
• Age thresholds. Data about children under 13 (in the EU, under the national threshold of 13 to 16) should only be processed with a parent's involvement and consent. By creating a Faby account you confirm that you are over 18 and that you are the child's parent or legal guardian, or act with their permission.
• Your rights under COPPA. As a parent you can review the information we hold about your child, ask us to delete it, and refuse further collection (see Your rights).
• If you believe a child has given us personal information without a parent's involvement, please contact us and we will delete it.

3. What data we process

The table below shows what data we process, why, who we share it with and how long we keep it. You can scroll the table sideways.

4. Transfers to AI providers

We use the following providers to write, illustrate and narrate stories for you. All of them are located in the United States:

• Anthropic (Claude) — writes the story text. It receives the full story input together with the child (character) profile, including the name.
• Replicate — runs the image models that create illustrations (appearance description, without the name), the Minimax text-to-speech model (story text, which may include the name) and the XTTS model for voice cloning (the adult's voice sample and the story text).
• OpenAI — an image model for some illustrations (appearance description, without the name), the one-time analysis of the photo in "dress by photo", and the analysis of drawings.

These providers process data to provide the service to us. Their own retention and use practices are governed by the terms between us and by their own policies.

Safeguards and their limits: We add child-safety instructions to AI requests and automatically sanitise image prompts. However, stories are not each reviewed by a person and automated safeguards are not perfect: AI output can occasionally be inaccurate or inappropriate. If you come across such content, please report it to info@yelkovan.ai. An in-app "Report" option will be added in the next version.

5. Advertising

• Android: The free classic-tales section shows Google AdMob ads: a banner on the reading screen and a short video ad when opening some classic tales.
• Child-directed settings: Ad requests are flagged as child-directed (COPPA), the maximum ad content rating is "G" (general audiences) and ads are not personalised. The Android advertising ID permission has been removed from the app.
• Data sent to Google: To show and measure ads, AdMob receives the IP address, device and app-set identifiers, ad interactions and diagnostics. See the Google Privacy Policy for details.
• iOS: iOS 5.3.0 and later have no ads, and Google Firebase Analytics is removed. iOS versions before 5.3.0 may show ads similar to those above in the same section; we recommend keeping the app up to date.

6. Analytics

• Our own analytics: We measure how the app is used on our own servers on Google Firebase / Google Cloud (EU region europe-west1). This involves a random device ID, in-app events, device model, operating system, app language, time zone and the country derived from the IP address using an offline database. The IP address itself is not stored; only a salted one-way hash is stored. Raw event records expire automatically after 365 days.
• This analytics is not anonymous: records are linked to your user ID and device ID.
• Crash and performance data is collected by the same first-party system; Firebase Crashlytics is not used.
• Google Firebase Analytics is used in the Android app (and in iOS versions before 5.3.0) to measure purchases as Google Ads conversions. Advertising ID collection is disabled.
• You can contact us to object to processing for analytics purposes.

7. Notifications

We send notifications through Google Firebase Cloud Messaging and store your device's notification token (FCM token) for this purpose. Notifications include messages that your story is ready and system messages, as well as promotional messages. You can turn notifications off at any time in your device settings. An in-app switch to turn off promotional notifications separately will be added in the next version.

8. Social features

• Faby offers friend codes, nicknames chosen from fixed word lists, avatars, gifting a copy of a story to a friend, emoji reactions and a read-together room.
• There is no chat or free-text messaging between users. Nicknames cannot be typed as free text.
• Your friends can see your nickname, your avatar and the stories you gift them.
• A gifted story may contain the character name the parent typed. Please keep this in mind before gifting a story.

9. Legal bases

• Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)): account, story creation, purchases, service notifications, social features.
• Consent (GDPR Art. 6(1)(a), Art. 8 and Art. 9(2)(a); KVKK Art. 5(1) and Art. 6): sending a child's data (including photos and drawings) to AI providers (the app will ask for this consent from the next version), voice cloning (the app asks before recording), promotional notifications (device notification permission).
• Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)): purchase and accounting records, requests from competent authorities.
• Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)): in-app analytics, error and performance monitoring, security, non-personalised ads in the free section and purchase conversion measurement.
• Establishing, exercising or defending legal claims (GDPR Art. 9(2)(f) where relevant; KVKK Art. 5(2)(e)): requests, reports and possible disputes.

10. International transfers

Our data is hosted mainly in Google Cloud's EU region (europe-west1); some Google services may process data in the United States or other countries. Anthropic, OpenAI, Replicate (including the Minimax text-to-speech and XTTS models) and RevenueCat are in the United States. Google AdMob and Apple's and Google's sign-in and store services operate in multiple countries.

These transfers are subject to Article 9 of the KVKK and the GDPR's rules on international transfers. For transfers we rely on appropriate safeguards such as standard contractual clauses (the EU Standard Contractual Clauses) and, where necessary, your explicit consent. These countries may not have data protection rules equivalent to those in Turkey or the EU. You can contact us to find out which safeguard a transfer relies on.

11. Retention

• Account data (account details, child profile, stories, drawings, voice samples, social data): until you delete your account.
• Guest stories: deleted automatically after 7 days.
• Dress-by-photo photo: deleted right after analysis; the analysis result is kept with the account.
• Raw analytics event records: deleted automatically after 365 days.
• Purchase records: kept by Apple, Google and RevenueCat as required for tax and accounting.
• Anonymised or aggregated statistics: may be kept longer in a form that does not identify anyone.
• Backups: deleted data may persist for a limited period in backups.

12. Security

Data is encrypted in transit (HTTPS/TLS) between the app, our servers and our service providers. The IP address is stored only as a salted one-way hash, and the photo used for "dress by photo" is deleted after analysis. No method guarantees complete security. If a data breach occurs, we will notify the competent authorities and you as required by law.

13. Your rights

Users in the EU/EEA (GDPR)

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing, and to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. You can lodge a complaint with the data protection authority in your country.

Users in Turkey (KVKK Article 11)

You have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether data is used accordingly; to know the third parties in Turkey or abroad to which data is transferred; to request rectification of incomplete or inaccurate data; to request erasure or destruction under the conditions of KVKK Article 7; to request that rectification, erasure or destruction be notified to the third parties to whom data was transferred; to object to an outcome against you resulting exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing. The application procedure is described in the KVKK notice (in Turkish). If your application is rejected or you find the answer insufficient, you can lodge a complaint with the Turkish Personal Data Protection Board.

Parents in the United States

Under COPPA you can review the information we hold about your child, ask us to delete it, and refuse further collection. Some state laws (e.g. California) may give you additional rights.

How to make a request

Send your request to info@yelkovan.ai. To verify your identity, we may ask you to write from the email address linked to your account or to tell us your friend code. We respond within 30 days at the latest.

14. Account and data deletion

In the app: On the home screen tap Profile → complete the parent check if asked → in the Account Actions section tap Delete Account and confirm.

By email: If you cannot access the app (including guest use), write to info@yelkovan.ai with the email address linked to your account or your friend code. Details: Delete Your Account.

What is deleted: your account, child profile, stories, story requests, AI request records, drawings, voice samples and voice clones, photos and analysis results, content reports, friendships and gifts, analytics profile and notification queue entries are deleted on our servers.

What is kept: purchase records held by Apple, Google and RevenueCat for tax and accounting; anonymised or aggregated statistics that do not identify anyone. Deleted data may persist for a limited period in backups. Deletion requests are completed within 30 days at the latest.

Deleting your account does not automatically cancel an App Store or Google Play subscription; please cancel it in your store account settings.

15. Website

fabyfun.com does not use analytics or advertising cookies. The site language you choose is stored in your browser's local storage (localStorage). The site loads fonts from Google Fonts and a style library from cdn.tailwindcss.com, so your browser's IP address is sent to these providers. The site's hosting provider may keep standard server logs (e.g. IP address).

16. Changes

We may update this policy when the app or the law changes. The current version is published on this page and the date at the top changes. We will announce important changes in the app or on this website. If a change requires new consent, we will ask for it separately.

17. Contact

• Data controller: Yelkovan.ai (Yiğit Özdemir)
• Email: info@yelkovan.ai

Related pages: Parental Consent · Delete Your Account · Child Safety Standards · Terms of Use · KVKK notice (Turkish)