Privacy Policy

The business responsible for the data on this site is Fernbug.com, in Tennessee, USA. Questions go to [email protected].

For your family membership we keep:

• Your email address — it is the identity the membership hangs on.
• Your plan (monthly or yearly), its price, whether it is active, when it renews or ends, and when you cancelled, if you did.
• Stripe’s identifiers for your customer record and your subscription, so we can match each payment and renewal back to your membership.
• Every payment and refund on it, and the tax worked out on it, as Stripe reports them.
• The page you were on when you joined, and any utm_ tags that were in the URL, so we know which page or email sent you.

Stripe holds the subscription itself: it charges your card at each renewal and keeps the card on file for that. We do not store your card number, expiry, CVC or billing address. The payment form on our checkout page is Stripe's own, embedded in ours; your card details go from your browser to Stripe and never pass through our servers.

Your free book needs an account, not a payment: we record which book you took, against your email. Your account row holds your email, an optional display name you can set yourself, whether you've opted in to marketing email, and when you last signed in.

The contact form keeps your name, your email address and your message. If we turn that into a support ticket — or if you open one yourself from your account — we keep the ticket's subject and category, every message on both sides of the conversation, and any files attached to it.

Ticket replies are sent to your email address by us, so a conversation you started in your account continues in your inbox.

If you sign up for the free book or the mailing list, we keep your email address, where you signed up from, which free book you were sent, and when it went out. If you unsubscribe, we keep your address with the unsubscribe recorded against it — that is how we make sure we don't email you again by accident.

These are the family features of your account, on the website and in our iPhone and iPad app. Everything here belongs to your account and is used only to make those features work.

• Children you add: the first name (or a nickname) you type, the age group you choose — including Teen (13+) — and a color for their picture. A grown-up adds them; we never ask a child for anything.
• Reading: which books each reader opened, the page they reached and whether they finished, so a book opens where they left off on any device. For a teen, which study days are done. Studies have nowhere to write answers, so we never see what anyone thinks.
• The parents’ corner shows this reading to the grown-ups on the account, and the optional Sunday email sends it to the account’s own address.
• Devices: each phone or tablet signed in to your family in our app gets a random id, with the name it reports (usually just “iPhone” or “iPad”), its platform, the app version and when it was last used, so you can see and remove devices. A child’s own phone also records which child it belongs to.
• Notifications: if you allow them in the app, we keep the push token Apple gives that device, only to send the daily study reminder and study-partner notes. Turn notifications off, or remove the device, and we stop.
• Daily study reminder: on or off, the hour and your time zone’s name (for example “America/Chicago”) — not your location.
• Study partner: if a teen or a parent chooses someone outside the family, we keep that person’s name and email address and send them one invitation. They hear nothing unless they say yes; after that they only hear that a day’s study was done, or that the teen hasn’t opened one in a few days — never what it was about. They can stop at any time.
• Your preferred Bible translation for “Read it in the Bible” links.

Coloring pictures are not uploaded: they stay in your browser or on your device.

We wanted to know which pages people read without handing our visitors to an advertising company, so we wrote our own counter. (We also use Cloudflare's cookie-free page counts, described at the end of this section.) When you load a page our counter records:

• The page path, with identifiers stripped out before it leaves your browser — /account/tickets/T-000042 is stored as /account/tickets/[number].
• The host of the site that linked you here (for example "google.com"), never the full referring URL.
• Whether you are on a phone or a larger screen. That is the whole of the device detail.
• Any utm_ tags in the URL, capped and filtered so the beacon can’t be used to store anything else.
• A session id that lives in your browser’s session storage and expires after 30 minutes of inactivity.
• A long-lived random visitor id, "fb_vid", kept in your browser’s local storage. It is a random number with nothing attached to it, and it exists only so "returning visitor" can be counted at all.
• A one-way hash of your IP address, your browser’s user agent and a secret salt that changes every day. Because the salt rotates daily, the same person hashes to a different value tomorrow — the table cannot be used to follow anyone over time.
• The country you visited from, as a two-letter code like US or GB. Our host works that out from your IP address before our code sees the request, and hands us the answer instead of the address. We do not record your region, your state, your city or your coordinates, and we do not ask your browser where you are.

Your IP address and your user agent are not stored. They go into that daily hash and are dropped. Neither is your name or email ever attached to a pageview.

We stopped at the country on purpose. A city — or a region in a small country — can narrow a rural visitor down to a handful of households, and the only thing we actually want to know is which countries are reading, so we know who we're writing for. A country is never fewer than tens of thousands of people, so it can tell us that without ever being about you.

The detailed rows are rolled up into daily totals every night and deleted once they are 90 days old. The deletion runs first, before anything else that job does, so a night when the rest of it fails is still a night when the old rows go. What survives is a single row per day: how many pageviews, how many sessions, how many visitors, how many of them had been before, the most-read pages, the most common referring sites, and a count per country. Those daily rows are kept, and there is nothing in them that points at a person.

If your browser sends a Do Not Track signal, we send nothing at all. If you block or clear site storage, the counter still works but has no visitor id to send, so you simply look like a new visitor every time. The keys we use in your browser are fb_vid, fb_sid and fb_utm; clearing them removes everything we have put in your browser besides your sign-in session.

Alongside our own counter, Cloudflare (the network the site runs behind, listed below) counts page loads and measures how quickly pages load, using its Web Analytics script. It sets no cookies and stores nothing in your browser. It sends Cloudflare the page address, the referring site, your browser type and loading timings; Cloudflare sees your IP address as it does for every request, and says it does not use it to identify or follow visitors. We see only totals. Cloudflare's script does not look for a Do Not Track signal; blocking static.cloudflareinsights.com in your browser turns it off.

We use no advertising or tracking cookies, except the ones the TikTok pixel described below sets. The only other cookies are the ones that keep you signed in, set by our authentication provider when you sign in and cleared when you sign out. Everything else — the analytics ids above — is browser storage, not cookies, and stays on your device.

On the public pages of the site we load the TikTok pixel so we can measure whether our TikTok ads bring visitors. It lets TikTok see which pages your browser visited, and it sets TikTok cookies. It never loads while your child is reading a book in the reader, or in our admin pages. We do not send TikTok your name, your email address or your card details. TikTok's use of this data is described in its own privacy policy.

Your IP address is used while a request is being handled, to stop one machine from flooding checkout, the contact form or the visitor counter. Those limits are held in a short-lived cache and expire on their own. An IP address is never written into our database.

Cloudflare, which every request passes through on its way to us, also reads it, to work out which country the request came from and to filter out attacks. What our visitor counting keeps is the country, not the address.

There are two kinds, and they behave differently.

Transactional email — sign-in links, your delivery email, invoices, replies to your support tickets. It has no open tracking and no click tracking; links in it are the real links, not rewritten ones. You can't unsubscribe from this kind, because it's how you receive what you paid for.

Marketing email — news about new books and the occasional offer. This kind is tracked: we record whether it was delivered, whether it was opened, and which links were clicked, against your email address, and links carry utm_ tags so we can see which email led to a visit or an order.

Two ways to stop marketing email, and both work immediately:

• The unsubscribe link at the bottom of every marketing email. It is signed to your address, so it needs no sign-in and it never expires — an unsubscribe link in a two-year-old email still works.
• The email preference toggle on your account page.

We're a small operation and we use a small number of services to run it:

• Supabase — our database, sign-in system and file storage. Your account, membership, payment records, tickets and reading live here.
• Stripe — payments. Your card details go to Stripe and only to Stripe. Stripe runs your subscription, holds the payment records and sends the card receipt to your email address.
• SendGrid — sends every email we send, transactional and marketing alike.
• Apple — delivers app notifications. Apple receives the device's push token and the short notification text (for example “Time for today's study”), and nothing else about you from us.
• Cloudflare — every request your browser makes to the site passes through Cloudflare's network before it reaches our own servers, where the site runs. They see your IP address, as any network in that position must, and tell us which country it resolves to. Their cookie-free Web Analytics also counts page loads and load times for us (see “How we count visitors”).
• Backblaze — holds our nightly backup copies of the database (which include account email addresses) and of the book files, so a mistake on our side can be undone. Database copies are kept for 7 days.
• Upstash — the short-lived cache behind our rate limits, which is where the IP addresses mentioned above briefly live.

We also use AI services to make the books — Anthropic, Together AI, fal.ai and ElevenLabs. They are sent story material, prompts and artwork descriptions. They are not sent your name, your email address, your order or anything else about you.

Beyond that, we share your data only when the law requires it. We do not sell it, and we do not pass it to advertisers or data brokers.

Our books are for children; our store is not. Accounts, the membership and the mailing list are for the grown-up who pays. A grown-up can add their children to the account — a first name and an age group each, as described above — and that is all we hold about a child. We never ask a child for an email address, a photograph or their location, and there is nothing in a book for a child to sign up to, comment on or share.

A child's own phone is set up by a grown-up approving a code; it opens only that child's shelf and never holds the account password. In the app, buying, account settings and anything that leaves the app sit behind a question for a grown-up. Teens (13 and over) can read the studies, set their own reminder and choose a study partner, who hears only whether a day's study was done. Please don't let a child create an account or make a purchase on your behalf.

• Detailed pageviews: 90 days, then deleted automatically. The daily totals that replace them contain no identifiers at all — the most specific thing in one is a country.
• Payment records — what was charged, refunded and taxed, and when: kept for as long as we’re required to keep business and tax records. These are the one thing we generally can’t delete on request.
• Your account, entitlements, tickets and mailing list entry: kept while you have them, and until you ask us to remove them.
• Your family’s profiles, reading, devices, reminders and study partners: kept with your account and deleted when you delete it. A removed device’s push token is deleted with it.
• Email delivery, open and click records: kept while they’re useful for seeing whether a campaign worked.

You can see your orders, your invoices and your books, and change your display name and your email preferences, from your account page, any time.

You can delete your account yourself, from your account page. It shows you exactly what will be removed and what has to stay before you confirm, and it happens immediately — nobody has to read a request first. For a copy of what we hold, or a correction to something that's wrong, ask through the contact page or email [email protected] and a person will do it by hand.

One honest caveat: deleting your account also cancels your membership and ends your access to the books, and we have to keep the payment records behind it as accounting records even after the rest is gone.

Some of these rights are written into law where you live, and some aren't. We'd rather not make you find out which. Whoever you are and wherever you are, you can see what we hold, get a copy of it, correct it, or have it deleted — the first three without asking anyone, from your account. We don't sell data, we don't profile you, and nothing here is decided about you by an algorithm.

If you're in the UK or the European Economic Area, the UK GDPR and the GDPR give you those rights as law, plus the right to object to processing, to ask us to restrict it, and to complain to your national data-protection authority — in the UK, the Information Commissioner's Office. You can complain to them without coming to us first, though we'd rather you gave us the chance to put it right. Our lawful basis is the contract between us for your membership and your free book, and consent for the mailing list, which you can withdraw from any email.

This is a small business selling storybooks, so the large US state privacy statutes set thresholds it doesn't meet. We've written the rights above to be given freely rather than because a statute forces them, and if that ever changes this page changes with it.

Your data sits behind row-level security in our database: your orders, tickets and invoices are readable by your signed-in account and by nobody else's. Invoice PDFs are kept in private storage and only ever handed out as short-lived signed links. Admin actions are logged with the person who took them. All traffic to the site is encrypted.

No system is perfect. If something ever goes wrong in a way that affects you, we'll tell you rather than hope you don't notice.

If what we do changes, this page changes with it and the date at the top moves. If a change is significant, we'll say so in an email rather than quietly editing the page.

Email [email protected], use the contact form, or open a ticket at your help desk.