Privacy at Peabody

Who is responsible

Peabody is run by Aaron, an individual in Colorado, USA. [Legal entity name, postal address and a contact address for privacy questions to be added before launch.]

Who makes the account

A family account. A parent or guardian creates the family account and adds each child. Those children never give an email address. By creating the account and adding a child, the grown-up agrees to Peabody collecting that child’s information as this page describes.

A kid’s own account. A kid can also make their own account from I’m a kid, with a first name and 4 secret numbers they pick. There is no email, no grown-up and no payment. Peabody keeps less for these kids, and their stories stay just theirs: see Kids on their own below.

What Peabody keeps

About grown-ups

• Email address, password (stored only as a one-way hash) and, if set, a parent PIN (also hashed).
• Which devices were marked as trusted family devices (a random token, stored only as a hash).
• Settings, such as each child’s scariness level and whether their name may appear in their stories.
• Optionally, how you heard about Peabody.

About each child

• First name, avatar, a generated pen name, a 4-digit sign-in code (drawn by Peabody, or picked by a kid who made their own account), and a color theme.
• Their reading level, and how they’re doing in math, skill by skill. The reading level comes from a short reading game, a starting point a grown-up picks, or the grade a kid tells Peabody, and Peabody checks it against their own reading. Never their age or birthday.
• Their school, only if a grown-up picks one.
• Their stories, and the ideas they gave for them (for a kid on their own, the ideas only until the story is checked).
• For some of their stories, a quality review: what the story teaches, which parts came from their ideas, and notes on how to make the next story better. Only their grown-ups see it; it’s how Peabody checks and improves its own writing, never a grade for the child. It is never done for a kid on their own.
• How they read: word-check answers, questions answered, time spent on each page, words they tapped to hear, who they read to, and their guesses at how a story ends.
• Thumbs, reactions and share-link opens on their stories, from readers outside the family.
• Which other kids follow them and which they follow (story buddies, by pen name), and any private label a parent gives a buddy.

About visitors without an account

• Guest stories. A kid can make up to three stories without an account. Peabody asks for nothing personal. A guest cookie counts the stories, and a one-way hash of the network address is kept for about two days, only to stop abuse. The ideas are used to write the story and not kept afterwards. The stories themselves are kept so they can be read and shared, and move to the child’s shelf if a grown-up signs up in the same browser, or the kid makes their own account there. A kid on their own keeps those stories private, and any links to them are turned off.
• Shared stories. Opening a shared link is counted, and a reaction face is counted once per browser; neither records who you are.
• The front page. Opening its sample story is counted per day, with nothing about who opened it.
• Peabody’s library stories. Anyone can read Peabody’s own library stories without an account, and they may appear in search engines. How many times each one is opened and finished is counted per day, with no cookie and nothing about who read it; a scrambled form of the network address is used only to slow floods of requests, and is gone within two days.

What Peabody never does

• Ask for a child’s age, birthday, last name, photo, address, email or phone. (A kid may tell Peabody their grade, or say they’re not sure; it only sets where their books start.)
• Use a microphone or record anyone’s voice.
• Show ads, sell data, or share it for anyone else’s marketing.
• Show a child’s real name outside their own family, including inside a story.
• Send anything about a child to a school.
• Let kids message anyone, or chat with an AI.

What other people can see

• Inside the family, parents see everything about their children, and siblings can see each other’s stories and activity.
• The library. Unless a grown-up marks a story private, it joins Peabody’s library, where kids from other families, including kids who made their own account, can read the whole story. They see its title, reading level, labels and the author’s pen name, never a real name. Names of the family’s children are replaced in the story text for other readers. Stories children write are not shown to visitors without an account, and are kept out of search engines. Stories by kids on their own never join the library.
• Share links. A story shared by link can be read by anyone who has the link, without an account, until the link is turned off. Share pages are kept out of search engines. A visitor can type a name for the story’s hero to see there; that swap happens only in their own browser and is never sent to Peabody. Kids on their own can’t make share links.
• Story buddies. A child can follow another kid’s pen name (found in the library, or swapped in real life as a buddy code) and be followed back. A parent sees every follower and can remove any, turn following off, or give a buddy a private label only their own family sees. When two kids swapped buddy codes, each one’s grown-ups see which of their own child’s stories the other read, by pen name. Kids on their own can follow other kids, but other kids can’t follow them.

Kids on their own

A kid can make their own Peabody account, with no grown-up. For these kids, Peabody keeps as little as it can, and what they make stays theirs:

• They sign in with a first name and 4 secret numbers they pick. No email, no grown-up and no payment.
• Their stories are just theirs: never in the library, and no share links.
• Their first name is never sent to the AI. If they type it into their story ideas, it is taken out first.
• Their ideas are used to write the story and check it is safe, then deleted. A story the safety check blocks is not kept.
• Other kids can’t follow them. When they follow a kid from a family, that family only ever sees a made-up pen name and face, never a real name.
• Stories are gentle to start, and can be at most spooky (from 1st grade up), never scarier.
• If they tell Peabody their grade, it only sets where their books start. They can change it, or never say.
• They can tell Peabody about a story that upset them. It is hidden for them, and a person at Peabody reads the report.
• They stay signed in for 8 hours at most on a browser.
• They can delete their account themselves, on My page, with their secret numbers. An account that is never used is removed after 14 days, and one with no sign-in and no reading for 180 days is removed.

News, names and switches

What kids from other families can see about your child, and what your child sees about them. [These lines are new and are marked for legal review.]

• Peabody tells your child once a day, in words, when kids from other families read their stories and which faces they tapped. It never shows numbers of readers below “5+”. Nothing new arrives at bedtime or overnight.
• The first kid from another family to finish a story is named to the author by pen name, once. If your child is the first kid from another family to finish a story, that story’s author sees your child’s pen name, once. Either family can switch this off, and it is off until you have seen our notice. It is off by default for PreK and K readers.
• A buddy who follows your child is named only if they swapped buddy codes. Anyone else is “a new reader”, and we tell you when one arrives.
• On your Stories page, you see which of your child’s buddies read each story, by pen name, if they swapped buddy codes. If your child swapped buddy codes with a kid from another family, that kid’s grown-ups see which of their child’s stories your child read, by pen name. This follows the switch that names your child to other kids: off until you have seen our notice, and off by default for PreK and K readers.
• Readers can tap “More please!”; your child sees “a few kids want to know what happens next”, never how many or who.
• Authors can send one thank-you face to everyone who read a story.
• Peabody is a cartoon with hand-written lines, including one joke a day. There is no AI chat.
• We keep a note of each day your child opened Peabody (the date only, with no time of day after a week) for 60 days, the day’s news for 30 days, and “More please” taps for 45 days, to show the news and to count, in totals only, whether Peabody is working. We never measure minutes. Other children’s pen names are never stored in your child’s news; they are looked up when the news is shown.
• Every one of these has a switch on your child’s settings page, and one switch keeps everything inside your family.
• Kids can also make their own account, with no grown-up. A kid on their own is never named to kids from other families and can’t be followed, and their stories stay out of the library. If one follows your child, you see only their made-up pen name and face.

Who else touches the data

Only the services that run Peabody, each for that job alone:

• Anthropic writes, safety-checks and reviews the stories. It is sent the child’s first name (only if the grown-up allows it in stories, and never for a kid on their own), their reading level and the words they’re practicing, the scariness setting, their ideas, and the earlier books in a series. Never an age, school or last name. [Confirm Anthropic’s data-use and retention terms for Peabody’s account.]
• Supabase stores the data (accounts, stories, reading history).
• Vercel hosts the site and counts page visits without cookies. Before a visit is counted, every identifier is taken out of the address, and nothing is sent when the browser asks for Global Privacy Control.
• Resend sends the emails Peabody sends a family: password resets, invitations, a PIN locked after too many wrong tries, a child’s scariness ceiling changing, a kid’s story shared to a grown-up, and, only if a family opts in, an occasional gentle reminder.

Cookies

Only the cookies Peabody needs to work: the sign-in session, a trusted-device cookie on a family’s own device, one that remembers a kid has signed in on this browser (so the front page opens the kids’ door), the guest-story cookie, and, for someone reading a shared story with no account, a cookie that only stops the same browser tapping a reaction twice or being counted as two opens. No advertising or tracking cookies.

How long things are kept

• Account, child and reading data: for as long as the family account exists.
• Hashed network addresses for guest stories: about two days.
• Rate-limit counters (to slow down password and secret-number guessing, and too many new kid accounts at once): short-lived; they only count recent attempts.
• Deleting: a parent deletes a child, or the whole account, any time from the grown-ups’ privacy screen. It happens right away (that child’s sign-in, every story they made, and all their reading) and it can’t be undone. For a family that came from Peabody’s first version, their old account traces and Supabase’s own sign-in log entries for them are removed too.
• A kid’s own account, and everything in it: until the kid deletes it on My page. One that is never used is removed after 14 days, and one with no sign-in and no reading for 180 days is removed.

Your choices

• Mark any story private, so it stays out of the library.
• Turn off a share link at any time.
• Set each child’s scariness level, their pen name, whether their name appears in their stories, and whether they can follow or be followed.
• Download any child’s data, or delete a child or your whole account, any time, from the grown-ups’ privacy screen.
• Ask about anything this page doesn’t cover, at the contact address above.

Changes

If this page changes in a way that matters, families will hear about it by email before it takes effect. [How kids on their own, who give no email, hear about a change: to be settled.]

See also the terms of use.