Privacy policy

Last updated 20 September 2026

What we collect about your family, why, and how to get it back or deleted. It follows the Australian Privacy Principles. Questions to hello@quilljar.com.

What we collect

• From the parent: an email address to sign in, the family name you choose, a parent PIN (stored hashed), and, when you order a book, the delivery address and phone number the printer needs.
• About each child: a first name or pen name and an avatar. No email, date of birth, photo or school.
• The work: the stories, characters, notes, drawings and generated illustrations your family makes in the studio, and the earlier drafts we keep so a chapter can be restored.
• Payments: handled by Stripe. We never see card numbers; we keep a record of what was paid for.
• Technical: ordinary server logs with request ids and timings, kept briefly for reliability. No advertising trackers, no analytics cookies, no social widgets.

Where it lives

Your family's data is stored in Australia: the database and file storage are in Sydney, and the app runs in Sydney. Backups stay in the same region.

AI providers

• Coaching and illustration send story text and approved character references to an AI provider through a gateway configured for zero data retention: the provider processes the request and keeps nothing.
• Before anything is sent, we check it for email addresses, phone numbers, street addresses, links, and any names the parent has listed as protected. If we find one, the request is blocked and the child is told what to change.
• A child's own uploaded drawings are never sent to an image model. They go in the book, nowhere else.
• These features are off until a parent turns them on, which they do by reading and agreeing to a statement of what is sent and to whom. We keep that agreement (who, when, which wording) and a log of every AI request the family makes, with the coach's reply, so the parent can see what their child was told.

Who else sees it

• The printer (Lulu Press) receives the finished book files and the delivery details when you order a printed copy, and nothing otherwise. The files are removed from the printer's reach once the order has shipped.
• Stripe handles payments and receives your email and the order amount.
• Our hosting providers (Vercel and Supabase) store and serve the service under their own security commitments.
• We do not sell or share data with anyone else, and there is no advertising.

Children

Children use Quilljar through a parent's account. There are no public profiles, no messaging and no way for a child to contact or be contacted by anyone through the app. We collect the minimum about a child needed to label their work.

Your rights

• Export: a parent can download everything the family has made, at any time, from the Family tab: every book as data and as a reading PDF, every picture, the orders and the AI log.
• Delete: a parent can delete the whole family from the Family tab, confirming with the email they signed in with. Nobody can sign in from that moment; everything is removed seven days later, apart from the payment records we must keep for tax. Within those seven days, reply to our email and we restore it.
• Correct or ask: email hello@quilljar.com. If you are not satisfied with our answer you can contact the Office of the Australian Information Commissioner.

Keeping it safe

Sign-in is by a one-time code sent to the parent's email; there are no passwords to leak. Sessions and the parent PIN are signed and hashed. Data travels over HTTPS and is stored encrypted at rest. If we ever had a breach affecting your family, we would tell you promptly and explain what happened.

Changes

If this policy changes in a way that matters, we will email the account holder before it takes effect.