Masal Adası

Privacy Policy

Last updated: 2 November 2026

1. Who we are

Masal Adası (Story Island) is a mobile app by Karakaş Digital. It helps parents create, listen to and keep personalized stories for their children. Controller: Karakaş Digital, Mustafa Kemal Mah. 2118 Cad. Maidan İş Merkezi 4 C Blok No:140, 06510 Çankaya/Ankara, Türkiye. Contact: info@karakas.digital, +90 850 241 92 50.

2. Who uses the app

Setup, entering a child's name, purchases and account features are meant for parents and legal guardians. Purchase screens and links that leave the app are protected by a parent question. Children may listen to the stories. No account is created for a child.

3. What data we process

  • Child profile (on your device): the name and age range a parent enters. Up to four profiles. We don't ask for photos, dates of birth or voice recordings.
  • Story requests: when a story is created, the child's name, age range, chosen characters, theme, story type, length, language and narrator are sent to our server.
  • Created stories: text, audio and cover are stored on your device. The child's name may appear in the text.
  • Sign in with Apple (optional): the unique account identifier provided by Apple and a refresh token, stored encrypted so that Sign in with Apple can be revoked when the account is deleted. We don't request your email or name. If you turn on cloud backup, your stories (text, audio, cover, child's name, profile identifier), favorites and listening history are saved to your account.
  • Purchases: transaction information provided by Apple and your Story Gold balance. We never see your payment details; Apple processes payments.
  • Technical data: as with any internet connection, your IP address reaches our server. To prevent abuse, a one-way hash of the IP address is kept. The app's authenticity is verified with Apple App Attest: the public part of a key created on the device, a one-way hash of the installation ID and the number of stories are kept on the server to protect the free story and limits; the child's name is not sent to Apple. Server logs may also contain IP addresses; they are kept for a limited time according to the server configuration.
  • Anonymous usage counts (only with parental consent, off by default): Only if a parent allows it in the Parent Corner, the app sends our server totals only, for example how many stories were created today and in which language. No names, ages, story texts, device identifiers or user identifiers are sent. Records are kept as daily totals. Permission can be withdrawn at any time. In the previous version of the app this was on by default; with this version it has been switched off for everyone and is left to the parent to turn on.
  • The request reaches our server with your IP address; to prevent abuse, a one-way hash of the IP and hourly and daily request counts are kept; there is currently no automatic deletion of this hash, and because it can't be matched to a person it can't be deleted individually. On the device we only store flags that make sure the first launch and each purchase are counted once.

4. Service providers

We work with the following providers to create stories. Data is sent only to produce the story.

  • OpenAI (story text). Sent: the child's name, age range, characters, theme, type and story plan.
  • ElevenLabs (narration, ElevenLabs Inc.). The full generated story text (including the child's name), short excerpts of neighbouring paragraphs for smooth intonation, the chosen voice and voice settings. The request is sent from our server; your device identifier, IP address, Apple account and age are not sent to ElevenLabs. By default, ElevenLabs keeps text and audio generated through its API in the account history; retention and deletion are governed by ElevenLabs’ terms.
  • Apple (Sign in with Apple, in-app purchases).
  • Our server hosting provider (hosting our servers).

How these providers store data is governed by their own terms. Data may be transferred abroad through these providers, including to the United States. Transfers to AI providers are based on the explicit permission a parent gives before a story is created.

Before a story is created, a parent is asked for explicit permission to share the child’s name and story details with OpenAI and ElevenLabs. Permission can be withdrawn in the Parent Corner; after that no new requests are sent and stories on the device are not deleted. The app contains no third-party measurement tool. The app shows no ads. We use no advertising SDKs. We don't track users across apps or websites. We don't sell data.

5. How long we keep data

  • Stories and profiles on your device stay there until you delete them or remove the app.
  • A temporary story cache on our server (text and audio) is kept for up to 6 hours, so that a repeated request isn't generated twice.
  • Cloud backup is kept until you delete your account in the Parent Corner.
  • When an account is deleted, stories, audio, covers, favorites, history and unused Story Gold are deleted. So the same purchase can't add gold again, we keep: purchase transaction IDs, the product and gold amount, a one-way hash of the Apple account identifier, gold counters and an account token linked to this record.
  • Anonymous daily totals contain no personal data; there is currently no automatic deletion.
  • App Attest records (public key, installation hash, time the free story was used, number of stories) aren't linked to an account; there is currently no automatic deletion, and because they can't be matched to a person they can't be deleted individually.

6. Your rights

Under applicable data protection law, including the GDPR where it applies, you have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. Data on your device can be deleted in the app. The cloud account can be deleted in the Parent Corner. Permission can be withdrawn in the Parent Corner; withdrawal does not affect the lawfulness of processing before it. Requests: info@karakas.digital. You may also complain to your data protection authority.

7. Children's privacy

Please enter only what a story needs; a first name or nickname is enough. To have your child's data deleted, write to info@karakas.digital.

8. Security

Data is transmitted over encrypted connections (HTTPS). Gold balance and session data are kept in the device Keychain. No method is completely secure.

9. Changes

If this policy changes, we'll publish the current version on this page.

10. Purposes and legal bases

  • Creating a story and transferring data to OpenAI and ElevenLabs: a parent's explicit consent.
  • Cloud backup, the account and purchases: entering into and performing a contract.
  • Security, preventing abuse and App Attest: legitimate interest.
  • Optional anonymous counts: a parent's explicit consent.
  • Legal retention and answering requests: legal obligation.

Data is collected by automated means through the app and the server.