Last updated: August 22, 2026
FireflyNook is run by ROYAL SALE LLC (30 N Gould St # 49736, Sheridan, WY 82801, USA). We built this service for families, so we hold ourselves to a simple rule: collect as little as possible, show as little as possible, and let parents delete everything at any time. This page explains exactly what we collect and why, in plain language.
Children’s privacy comes first
- Children are never our users. Accounts can only be created by adults. We never knowingly collect information directly from a child, and nothing on our site asks a child to enter anything.
- Parents enter and own all child information. A child profile (first name, age or birth year, optional gender and story interests) is created by the parent, used only to pick suitable stories and personalize rewards, and can be edited or deleted by the parent at any time.
- We show as little as possible. The only place any child information can appear publicly is our certificate verification page — and only the child’s first name, only to someone who has the certificate’s unguessable number or QR code.
- No ads to your child, no selling. FireflyNook shows no advertising to you or to your child inside the service, and we never sell or rent personal information — an adult’s or a child’s. We never use any child’s information for advertising, ever. We do advertise FireflyNook itself on Facebook and Instagram; that involves only the adult account holder’s visit to our public pages, described under Cookies and Who we share with.
What we collect
- Your account: email address, name, and a password (stored only as a secure hash — we cannot see it).
- Child profiles you create: first name, age or birth year, optional gender and interests.
- Listening activity: which stories were played and completed, to power daily delivery, badges, and certificates.
- Purchases: your orders, plan, and payment references. Payments are made by bank transfer or by card through our payment processor, Whop — either way we never receive or store card numbers.
- Messages: what you send us through the contact form.
- Technical basics: standard security logs (such as login events and IP addresses) kept to protect accounts, and the minimum cookies needed to run the site.
Cookies
We use functional cookies: one that keeps you signed in, and a short-lived one (12 hours) that remembers which of your children is listening so their progress is credited correctly. We also use one advertising cookie — the Meta (Facebook) pixel — on our public pages. It tells us whether a visit or a free-trial signup came from one of our ads, so we know which ads are worth paying for. It never runs inside a child’s listening session, and it never receives any child’s information. A notice on your first visit tells you it is there.
Emails we send
We send account emails (verification, receipts, refund notes), the daily story delivery you signed up for, and occasional service notices. Daily story emails can be switched off any time — from the unsubscribe link in the email or the switch in Account Settings (both control the same setting, so you can always turn it back on). We only send marketing newsletters to people who opted in, and every one has an unsubscribe link.
Who we share with
Only the service providers needed to run FireflyNook: our website hosting company, our email delivery provider, our bank for processing transfers, our payment processor Whop (who receives your name, email address, and payment details when you pay by card), and Meta Platforms, Inc. — when you visit our public pages or arrive from one of our ads, Meta receives page-visit, signup and purchase events so we can tell which ads work, and, where you have typed it into a form, an irreversibly scrambled (“hashed”) copy of your email address, which lets Meta match the visit without ever seeing your actual address. Meta never receives your password, your card number, or any information about your children. We may also show follow-up ads to people who have visited our site. They may all process data only to provide their service to us. That’s the whole list. Beyond these providers we disclose information only if the law genuinely requires it, or to protect the safety of our users. We never sell your data and we never share it with data brokers.
Where your data lives and how it’s protected
Data is stored on our hosting provider’s servers and protected with HTTPS everywhere, hashed passwords, rate-limited logins, and security logging. Like every online service, we cannot promise that any method of storage or transmission is 100% secure — no honest company can — but we work to keep risks low, we store far less data than most services to begin with, and if a security incident ever affects your information we will notify you promptly, as the law requires. If you are outside the United States, you consent to your data being processed in the US, where our company and servers operate.
Your rights and deleting everything
You can view and edit your details and child profiles in Account Settings. Deleting your account there permanently erases your profile, your children’s profiles, listening history, badges, certificates, tokens, and notifications — not a soft hide, an actual wipe. We keep basic order records only as long as tax and accounting law requires. For the same reason we also keep security event logs (such as sign-in attempts) and proof that a purchased file was delivered — but when you delete your account these are stripped of anything identifying you, including your IP address, so they can no longer be traced back to you. If you have written to us through the contact form, that correspondence is kept as a record of what was asked and answered, and is detached from your deleted account. You may also ask us at any time — through the contact form — to access, correct, export, or delete your information, whatever your country; we honor the spirit of GDPR-style rights for everyone, and we never charge for it or treat you differently for asking.
Changes and contact
If we change this policy in any meaningful way, we’ll update the date above and announce it on the site or by email before it takes effect. Questions about privacy — including anything about your child’s information — reach us through the contact form and a human will answer.