Last updated: September 2026
Who we are
ChatterJoy is a UK-based early-language app for parents and carers. We are the data controller for the information described here, and we handle it in line with the UK GDPR and the Data Protection Act 2018.
What we collect
- Account details — the parent or carer name and email address used to sign in, and an encrypted password or sign-in token.
- Child profile details — the first name, age band, gender (used only to choose a colour theme), favourite things and communication preferences you choose to add. A child photo is optional.
- Activity content — the words you save, tracing and game progress, reading progress, journal entries and voice recordings you create.
- Subscription details — your plan, trial dates and renewal dates. Card numbers are handled entirely by Stripe and never reach ChatterJoy.
- Technical information — basic error and security logs needed to keep the service working.
Why we collect it, and our lawful bases
- Contract — to create your account, run the activities, save progress and manage your Joy Plus subscription.
- Legitimate interests — to keep ChatterJoy secure and reliable, prevent misuse, and reply when you contact support.
- Consent — for optional extras such as adding a child photo, making voice recordings, or receiving occasional emails. You can withdraw consent at any time.
- Legal obligation — to keep records required for tax and accounting.
ChatterJoy does not sell personal information, does not show advertising, and does not profile children for marketing.
Children’s information
ChatterJoy is designed for adults to use alongside a child. Children cannot create accounts, make purchases or contact anyone through the app. Child details are used only to personalise activities inside your own account, are never shared with other families, and are never used for advertising. We follow the ICO’s Age Appropriate Design Code and collect the minimum needed for the activities to work.
Who processes information for us
We use a small number of trusted providers, each under a data-processing agreement: Supabase (database, sign-in and private file storage), Cloudflare (hosting and content delivery), Stripe (payments), OpenAI via the Lovable AI gateway (generating the spoken audio for words and stories), and an email provider for account emails. Some providers may process data outside the UK; where they do, transfers rely on the UK International Data Transfer Addendum or equivalent safeguards.
How it is protected
Your content is private to your account and protected by row-level security rules, so no other account can read it. Data is encrypted in transit and at rest. Voice recordings and photos live in private storage and are only reachable through short-lived links issued to your signed-in parent account.
How long we keep it
We keep your account and content for as long as your account is open. If you delete a child profile, recording or journal entry, it is removed straight away. If you close your account, we delete your personal information within 30 days, apart from payment records we must keep for six years for tax purposes.
Your rights
You have the right to access, correct, delete, restrict or object to our use of your information, and to receive a portable copy. You can edit or delete child profiles, journal entries and recordings yourself at any time in Parent Corner, and Parent Corner also offers separate options to delete only your child’s data or to close the whole account. We respond to written requests within one month.
Complaints
Please come to us first and we will try to put things right. You can also complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Contact
To ask a privacy question or make a request, use the Contact us form and select “Privacy concern”.
See also our Cookie Policy and Terms of Use.