All traffic is encrypted using TLS (HTTPS), and data is encrypted at rest in EU data centres.
Each universe is 100% private. Access is granted only through administrator invitations — there is no public sign-up.
We use row-level security in the database so that each family can only see its own data — not other families' data.
We do not use tracking pixels or advertising cookies. Children's profiles and content are never sold or shared.
Hosting and data processing
Our database and file storage are operated by Supabase in the EU. AI services (Gemini, ElevenLabs) may process data outside the EU — this is safeguarded by the European Commission's Standard Contractual Clauses.
Incident handling
If we discover a security breach affecting your data, we will notify you as soon as possible and no later than 72 hours after discovery, in accordance with Article 33 of the GDPR.
Responsible disclosure of vulnerabilities
Have you found a security vulnerability? Email contact@eventyrmagic.com with the subject "Security" — we will respond promptly.
See also our privacy policy and terms and conditions.