TaleOak Privacy Policy

Effective date: 31/10/2026
Last updated: 31/10/2026

Operator: Thanat Theerabootwongkul trading as TaleOak
ABN: 16 232 595 236
Business name: TaleOak (a business name is not a separate company)
Contact: founder@taleoak.com
Website: https://www.taleoak.com

This policy explains what personal information TaleOak collects and why. It says where we keep it, who can see it, and how to get a copy, fix it or have it deleted. It covers everyone TaleOak deals with: people who sign up, people who are invited, and people in stories who have no account, such as Mum and Dad.

1. Who we are

TaleOak is a private stories app for families. Once a week, you draw a question card, ask Mum or Dad in person or on a call, and save what they tell you. Stories stay in your private family house.

The person responsible for your personal information is Thanat Theerabootwongkul trading as TaleOak (ABN 16 232 595 236), a sole trader in Australia. The business name "TaleOak" is not a separate company. For any privacy question, including access, correction, deletion or complaints, email founder@taleoak.com.

2. Who this policy is for

3. What we collect

We only collect what TaleOak uses to run the stories app.

You don't have to give us everything. But we can't make an account without your name, email address and date of birth, and we can't send an invite without the email address of the person you invite.

3.1 Your account

• Your name (given name, family name, preferred name and nickname, if you add them) and email address
• Your date of birth. We use it to check you are 15 or over before we make your own account. If you are under 15, we use it to ask a parent or guardian to confirm before an account is created (sections 11 and 15). Everyone with a seat in your houses can also see your full date of birth (section 8).
• Gender and a profile photo, if you choose to add them
• Your login details. If you use email and password, we store your password scrambled (hashed), not as plain text. If you use Continue with Google or Continue with X, that service gives us your name, email address, profile picture and an account ID. We store login tokens from those services encrypted.
• Whether your email address is confirmed
• Which version of these Terms and this Privacy Policy you agreed to, and when
• Sign-in records. When you sign in, we keep your IP address and browser details (the user-agent string) so we can keep your account secure.

3.2 What you add to a family house

• Stories and chapters (title, story text and up to 3 photos per chapter)
• Voice clips you record, and how long they are
• Your answers to Draw a tale cards, and Keeps
• Photos, including a house photo and profile photos
• The family tree: seats, roles (such as partner, sibling, kids/house) and who invited whom
• Invite details, including the email address of the person you invite
• Talk messages and photos shared in Talk
• Visit plans and notes, including who is going
• Appointment plans: title, place, time, notes, who is going, any lift arranged, and how it went. A cancelled appointment stays on record (marked cancelled) until you ask us to delete it.

3.3 Mum's page and Dad's page

• Name, nickname, gender, date of birth, hometown, a short bio and a portrait, if you add them
• If someone uses Keep their place for Mum or Dad, the date they add. Everyone with a seat in that house can see it. That parent no longer appears in Draw.
• Likes and dislikes, including those that grow from Keeps

Please don't upload hospital files, test results, Medicare numbers or clinical notes. TaleOak is not built for them.

3.4 Technical information

• Device and browser type, pages visited, and approximate location worked out from your IP address
• Server logs that help us keep TaleOak secure and fix faults
• Visit counts and page speed, through Vercel Web Analytics and Speed Insights. These run on every page, including signed-in pages. They collect the page address, the referring page, approximate location, operating system, browser and device type (section 13).
• When the app loads (outside the blog), your browser gets fonts from Google Fonts. This means Google receives your IP address and browser details (section 13).

3.5 When you contact us

• Your name, email address and message when you email founder@taleoak.com or use the help form. The help form also includes your account ID so we can find your account.

4. How we collect it

Most information comes straight from you. For example, when you sign up, fill in your profile, save a story, add to Mum's or Dad's page, or chat in Talk. Some comes from other people. A family member may plant you on the tree, invite you by email, or write a story that mentions you. If you sign in with Google or X, we get some details from them. Technical information is collected automatically when you use the site.

5. Mum, Dad, and anyone in a story without an account

Mum and Dad usually don't have a login. They still have the same privacy rights as everyone else.

• Ask first. The adult who plants Mum or Dad, or who saves a story, voice clip, photo or note about anyone, must have a fair reason. Where that person can decide, the adult must also have that person's okay before saving it.
• Let them know. If you add someone who has no account, tell them TaleOak holds information about them, and that they can contact founder@taleoak.com to see it, fix it or have it deleted.
• If Mum or Dad can't decide for themselves, only a family member who already helps them day to day may add what the family should know, and only inside that house.
• Their stories, not ours. TaleOak does not own those stories. The person written about can ask founder@taleoak.com for access, correction or deletion, even with no account. We will check the request is genuine and act where we can.
• Copies other seats hold. Deleting one person's account does not always remove content that other seats in the house still hold. If a family asks, we will help them sort out what stays in the house and what gets deleted.

6. Health information

TaleOak doesn't ask for health information. Please leave health details out of stories, Talk and Mum's and Dad's pages. If someone adds them anyway, the law treats them as sensitive, and we protect them like everything else. You can remove them at any time by editing or deleting what you saved.

Mum's and Dad's pages are not a clinical or health record and not medical advice. Only invite people who should see what is there.

7. Why we use it

We use personal information to:

1. Create and run your account, your seats and your family houses
2. Show house content only to people with a seat in that house
3. Pick your weekly question card and show your Today, Stories, Tree, Talk and Visits screens
4. Send emails you would expect: welcome and confirm-email, password reset, family invites you ask us to send, and replies to help requests
5. Show in-app notices, and device alerts if you turn them on
6. Keep TaleOak secure, fix faults and stop misuse
7. Understand how TaleOak is used, in counts and trends that don't identify you
8. Meet our legal duties and answer lawful requests
9. Answer privacy and help requests, including from people in stories without an account

We keep the time you last opened each Talk thread so we can show what's new.

We do not sell personal information. We do not use family stories, voice clips, photos, Talk or Mum's and Dad's pages for advertising. Family content is not used to train AI models, ours or anyone else's. We don't turn voice clips into text, sell them, use them to train AI, or use voices to identify anyone. We don't send marketing emails.

8. Who can see it

• People with a seat in your house. Stories, photos, voice clips, Keeps, draws, Talk, visits, appointment plans and Mum's and Dad's pages (including the date added if someone uses Keep their place for Mum or Dad) are shared with the seats in that house. So is each member's name, photo and full date of birth. People can't see houses they weren't invited to.
• Talk. Seats in that house can see Talk chats, including kids/house seats. In-law seats can read Talk but not write in it. If Mum or Dad has their own seat, our servers keep Talk closed to them, photos included.
• Share. If you use Share, your device makes an image of a Keep and you choose where it goes (for example, a message or social media). The image is not uploaded to TaleOak. Once it leaves your device, we can't control or delete it.
• Our service providers (section 9), only so they can run their part of TaleOak for us.
• When the law requires it, or to protect someone's safety.
• A buyer of the business, if TaleOak is sold or reorganised, with notice where we reasonably can.

We don't make family content public. Nothing in a house appears on the website, in search results or in the blog.

We don't read your stories or Talk chats, or listen to voice clips, except when you ask us for help, to look into misuse or a security problem, or when the law requires it.

9. Service providers and where data is held

These companies run parts of TaleOak for us. They may only use the data to provide their service to us.

Voice clips sit in that private Vercel Blob store in Sydney, Australia (syd1). Neon and Vercel Blob are in Australia. Resend, and parts of Vercel, are not. We do not claim Australia-only hosting. Facebook sign-in is not offered.

10. Overseas disclosure

Some personal information is sent to or held by providers outside Australia, most likely in the United States (Resend, Vercel, Google, X). When this happens, we take reasonable steps to make sure the provider protects the information in line with the Australian Privacy Principles. We stay accountable for how they handle it. Overseas laws may differ from Australian law. Email founder@taleoak.com for the current list.

11. Computers making decisions

TaleOak does not use computer programs to make decisions that have a legal effect on you or that significantly affect your rights or interests.

Some things are done automatically, and we want to be open about them:

• Age check at sign-up. This is the only decision a computer makes on its own. It uses one kind of personal information, your date of birth, to decide whether an account can be created in the usual way. If you are 15 or older, the account can be created. If you are under 15, the account is not created until a parent or guardian confirms. If you think this is wrong, email founder@taleoak.com and a person will look at it.
• Weekly question card. A program picks the card you draw from our question deck. It uses your house, the house time zone (to know when the week turns over), the cards your house has already drawn, and which of Mum and Dad are in Draw. If someone uses Keep their place for Mum or Dad and adds a date, that parent is left out of Draw. It does not use age, health or profile details.
• Loves and Dislikes. Kept Loves and Dislikes answers are copied onto Mum's or Dad's page as written. Nothing is guessed.

12. Keeping it safe

• Everything sent between your device and TaleOak is encrypted (HTTPS).
• Account and house data stored in Neon is encrypted at rest with AES-256, which is the encryption Neon documents for data stored on its disks. This covers stored house and account data in Neon only. It does not cover data held by other providers.
• Photos are only shown to people signed in with a seat in that house.
• Passwords are hashed, and sign-in tokens from Google or X are stored encrypted.
• Access to systems that hold personal information is limited.

No system is perfectly secure. Keep your login private, and tell us at founder@taleoak.com straight away if you think someone has used your account.

Data breaches. If we become aware of a data breach that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC), where Australian law requires it.

13. Cookies and storage on your device

We don't use advertising cookies or ad trackers. You can block cookies in your browser, but you won't be able to sign in.

When you sign out, we clear your sign-in and the copy of your house from that device. Recent in-app notices, alert settings, and visit and appointment reminders (including appointment titles) stay in that browser after sign-out. On a shared device, clear the browser's site data for taleoak.com after signing out.

If you turn on device alerts, your phone or computer may show notices on its screen, including the title of an appointment and Mum's or Dad's birthday.

14. Emails

We only send emails you would expect: welcome and confirm-email, password reset, family invites you ask us to send, and replies to your messages. They are not marketing. We don't sell or share email lists, and we never use invite emails for marketing.

15. Children

People 15 or older can create a TaleOak account in the usual way.

If someone under 15 wants to join, we only create or unlock their account after a parent or guardian confirms and agrees. We collect that person's information for the family house only with that consent. We send the confirm to the parent or guardian's email — not to a child's own inbox for sign-up.

A parent or guardian may add a kids or house seat they control.

If we learn we hold a child's information without the right consent, email founder@taleoak.com and we will delete it.

16. How long we keep it

• While you use TaleOak, we keep your account and what you add.
• Deleting something. The app doesn't yet have a delete button for stories, photos, Talk messages, visits, appointments or your account. To have any of these deleted, email founder@taleoak.com. A cancelled appointment stays on record until you ask.
• When we delete it, it is removed from our database straight away. Our database keeps backup history for a short time, so it is gone from that history within a day.
• When you ask us to delete your account, we delete your account details and what only you hold. Content you shared into a house may stay with the other seats. If a family asks, we will help them sort out what stays in the house and what gets deleted.
• Copies. There is no download or export of a whole house. To get a copy of your personal information, email founder@taleoak.com (section 17).
• Emails and logs held by our providers are kept for their set periods and then removed.
• We may keep a small record of requests and of your agreement to these terms, where the law or a dispute makes that necessary.
• Voice clips are kept until they are deleted. A clip that didn't finish uploading is removed within 24 hours.

17. Your rights: access, correction, deletion and complaints

You can:

• Change your profile and edit much of what you added in the app
• Say no to an invite
• Ask us at founder@taleoak.com to delete anything, to leave a house, for a copy of your personal information, or for a correction

People in stories without an account have the same rights and use the same email. We will check the request is genuine before we act, and we will reply within a reasonable time. If we refuse, we will tell you why in writing and how to complain.

Complaints. If you think we have mishandled your personal information, email founder@taleoak.com and tell us what happened. We will let you know we have your complaint within 7 days, look into it, and give you our answer in writing within 30 days. If you are not happy with our answer, or we haven't answered within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.

18. Outside organisations

TaleOak is a family product. It is not a clinic, not a school records system, and not a clinical or health record. We will not let any outside organisation, such as a health or support provider, onto TaleOak or into a family house until there is a written data-processing agreement, a named subprocessor list, and a stated storage location. No such agreement exists today.

19. Voice clips

You can save one voice clip with each chapter, up to 5 minutes long. Before you record, you must have the okay of everyone who will be heard in it.

• Where it's kept. Clips are kept in a private store run by Vercel (on Amazon Web Services) in Sydney, Australia. They are never public, and there is no link that can be shared.
• Who can hear it. Everyone with a seat in that house can play it, including Mum or Dad if they have a seat. No one outside the house can.
• Deleting a clip. The person who recorded a clip can delete it from the chapter at any time. The file is removed straight away. The chapter's title, story and photos stay. A device that just played it may keep a copy for up to an hour. Mum or Dad, or anyone heard in a clip, can ask founder@taleoak.com to remove it, even without an account.
• Closing an account or a house. If you ask us to close your account, clips you saved in a house stay with that house unless you or the family ask us to delete them. If a family asks us to delete their house, we delete every clip in it. Email founder@taleoak.com.
• What we don't do. We don't turn clips into text, send them to any AI service, sell them, use them to train AI, use voices to identify anyone, or track who plays them.

20. Changes to this policy

We may update this policy. We will change the dates at the top. For important changes, we will tell you in the app or by email before they apply, and ask you to agree again the next time you open TaleOak.

21. Contact

Contact: founder@taleoak.com

Thanat Theerabootwongkul trading as TaleOak · ABN 16 232 595 236 · https://www.taleoak.com