Privacy Policy for the Fairy Tales app

Effective date: November 1, 2026. Previous version: October 26, 2026.

Fairy Tales is an interactive fairy tale app for children, developed by Maksym Hryhoriev (“we”, “us”). This policy explains what data the app and our server use, why, and for how long. It applies to the Android app (package com.fairytales.app), the iOS version once it is released, and the website fairytales.ilike.guru.

1. What we do not collect

• No sign-up and no accounts. We never ask for a name, e-mail, phone number, age or any other details about a child or parent.
• No ads, no advertising ID and no ad networks.
• No analytics, tracking, crash-reporting or other third-party SDKs that monitor behaviour.
• No payment card or bank details. Payments are handled entirely by Google Play or Apple.
• The app does not use the camera, microphone, location, contacts or files on your device.

2. Data stored on your device

Reading progress, endings found, the chosen language, voice and other settings are stored only on your device (the app’s local storage). This data is not sent to us. Uninstalling the app or clearing its data deletes it.

Downloaded narration and downloaded tales are saved on the device so they can be played offline.

3. In-app purchases

The app is free to download. The tales “The Magic Forest” and “Little Red Riding Hood” are free. Other tales are optional one-time purchases (no subscriptions). A parental check stands in front of every purchase. The purchase itself is made with the parent’s Google Play or App Store account and is processed by Google or Apple under their own privacy policies (Google, Apple). Refunds are requested from Google or Apple.

Purchase verification. To make sure a purchase is genuine before unlocking a paid tale, the app sends a request over HTTPS to our server (https://fairytales.ilike.guru/api/verify.php) with:

• the platform (Android or iOS), the app’s package name and the product ID of the tale;
• on Android, the purchase token issued by Google Play;
• on iOS, the signed transaction issued by the App Store (it contains the transaction ID, product ID, app bundle ID, purchase date and store environment, but no name, e-mail or payment details).

On Android our server passes the product ID and purchase token to the Google Play Developer API to ask Google whether the purchase is valid and not refunded. On iOS the server checks Apple’s digital signature itself, without contacting Apple. If the purchase is valid, the server returns a download link for that tale that expires after 1 hour. The link contains only an expiry time and a signature, not who you are. The app asks for a fresh link when it needs one.

What our server keeps:

• A technical log (a text file in a private folder on the server, not public). One line per check with the date and time (UTC), the result (for example “verified”, “refunded”, “invalid”), the product ID, a short one-way fingerprint of the purchase token (the first 12 characters of its SHA-256 hash, from which the token cannot be recovered), and whether it was a test purchase or a sandbox purchase. The log does not contain the purchase token itself, the IP address, device identifiers, names or e-mail addresses. The same log also records server errors and refused download links (only the tale ID and the reason). It is used only to troubleshoot purchase verification.
• A short-term cache so a repeated check does not have to ask Google again: an empty marker file named after a one-way hash of the package name, product ID and token, valid for 10 minutes. Expired markers are deleted automatically over time.

We do not keep a database, purchase history or user profiles, and we do not link purchases to a person.

4. Downloads from our website

The app connects to our server at https://fairytales.ilike.guru over HTTPS to:

• load the list of available tales (/tales/catalog.json);
• download free tales and narration packs in other languages when you choose to;
• download purchased tales using the temporary link described above;
• verify purchases (section 3).

No personal data or advertising identifiers are sent with these requests. Like any web server, our hosting provider (Hostinger) keeps standard access logs: IP address, date and time, the requested address (for paid tales this includes the temporary link’s expiry time and signature) and browser or HTTP client details. They are used to operate and secure the server, we do not use them to identify or track users, and they are kept for a limited time under Hostinger’s policies.

5. Text-to-speech

If a tale has no recorded narration, the app may read the text aloud with your device’s built-in text-to-speech engine (for example, Google Text-to-Speech). That engine is part of your device’s system, not of our app, and is governed by its provider’s terms.

6. Who receives data

We do not sell, rent or share data with anyone else, and we do not use it for advertising.

7. For parents: children’s privacy

The app is made for children and is meant to be used with a parent. We do not knowingly collect personal information from children, as defined by the U.S. Children’s Online Privacy Protection Act (COPPA) and the GDPR rules on children’s data (Article 8 GDPR, “GDPR-K”), and we do not ask children for any personal information. The app has no chat, no contact with other users, no ads and no external links for children. Purchases are possible only after a parental check and are paid from the parent’s store account.

Requests to access or delete data. Parents and guardians can write to max.grigoryev@gmail.com to ask what data we hold or to have it deleted. Because we do not know who our users are, please include the Google Play order number or App Store transaction details if your request concerns a purchase, so we can find the related log lines. Data stored on the device can be deleted at any time by clearing the app’s data or uninstalling it.

8. Your rights

Depending on where you live (for example, under the GDPR), you may have the right to access, correct or delete your data, to object to its processing and to complain to a data protection authority. To use these rights, contact us at the address below.

9. Security

All connections use HTTPS. The server’s keys, configuration, logs and paid tale files are kept in a private folder outside the public website. Download links are signed and expire after 1 hour.

10. Changes to this policy

If the app or the server changes how data is used, we will update this page and its effective date. Significant changes will also be mentioned in the app update.

11. Contact

Maksym Hryhoriev: max.grigoryev@gmail.com