Privacy Policy

Last updated: March 2026

Overview

SammyStories is a free educational platform for neurodivergent children, operated by withSammy.org, a Canadian non-profit. We are committed to protecting children's privacy and comply with the Children's Online Privacy Protection Act (COPPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

As parents of an autistic child ourselves, we built SammyStories with the same protective instincts we apply to our own family. Your child's privacy is sacred to us.

What We Do NOT Collect

  • We do not collect personal information from children under 13
  • We do not use cookies or tracking pixels
  • We do not require account creation or login
  • We do not share any data with third parties
  • We do not serve advertisements

Local Storage

SammyStories uses your browser's localStorage to save preferences and progress locally on your device. This data never leaves your device and includes:

  • Reading progress — which stories have been started or completed
  • Child profile — name, age, and communication preference (stored locally only)
  • Emotion check-ins — pre/post reading emotion data for parent review
  • Custom stories — AI-generated stories created through the story wizard
  • Accessibility preferences — font choice, contrast mode, reduced motion

All locally stored data is automatically purged after 90 days of inactivity. You can clear all data at any time through your browser settings.

AI-Generated Content

When you use the Story Wizard to create personalised stories, text is sent to our AI service for story generation. We never send a child's name or personally identifiable information to the AI. Only anonymised behavioural context (e.g., "triggers: loud noises") is used in prompts, and the child's name is substituted client-side after generation.

PIPEDA Compliance (Canada)

As a Canadian non-profit, withSammy.org complies with PIPEDA requirements for personal information protection:

  • Consent is obtained before any personal information collection
  • Information is collected only for identified purposes
  • Individuals can request access to or deletion of their information
  • Data is stored on Canadian-first Cloudflare infrastructure with Canadian data residency preference

COPPA Compliance (US)

SammyStories is designed for use by children under parental supervision. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

When parental accounts are introduced, verifiable parental consent (parent email verification + explicit consent) will be required before any child data collection.

Data Retention & Deletion

Progress data is retained while an account is active. Upon account closure, all personal data is deleted within 30 days. Since most user data is currently stored locally in your browser, you have full control:

  1. Open your browser's Developer Tools (F12)
  2. Go to Application > Local Storage
  3. Delete all keys starting with sammystories-

Community Contributions

Professionals (BCBAs, SLPs, OTs) who submit community templates provide their name and credential voluntarily. These submissions are stored in our database to attribute contributions and are reviewed by our clinical team within 5 business days. No child data is collected through community features.

Analytics

We use Cloudflare Web Analytics, a privacy-first analytics service that does not use cookies, does not track individual users, and does not collect personal information. We only see aggregate page view counts.

Incident Response

In the event of a safety incident (harmful content, data breach, or child safety concern), withSammy.org will:

  • Acknowledge within 4 hours
  • Resolve within 24 hours
  • Notify affected users if personal data was involved

Contact

For privacy questions or data deletion requests, please use our contact page.