# Privacy Policy — Autism Ascent
**Effective date:** July 2026
**Last updated:** July 2026
This Privacy Policy explains how Autism Ascent (“we,” “us,” “our,” “Autism Ascent”) collects, uses, shares, and protects information when you use autismascent.org (the “Service”) to create personalized stories for a child.
We built this Service to help parents and caregivers support autistic children. We know that using it means trusting us with information about your child, and we take that seriously. This policy is written to be read, not just posted.
—
## 1. Who this policy covers
This Service is intended for use **by adults** — parents, legal guardians, and caregivers — on behalf of a child. It is not directed at children, and we do not knowingly allow children to create accounts, make purchases, or submit their own information directly.
All information about a child that appears on this Service is entered **by the parent or guardian**, not by the child.
—
## 2. Information we collect
### 2.1 Information about the parent/account holder
– Name and email address
– Account login credentials
– Billing information (processed by our third-party payment processor — see Section 5; we do not store full card numbers)
– Communications you send us (e.g., support requests, contact form messages)
### 2.2 Information about the child, provided by the parent
We never ask for, collect, or store your child’s real name. To personalize a story, we ask for:
– A **nickname or placeholder name you choose** (e.g., “Sam,” “J,” or “Buddy”) — this is the name that appears in the story text
– Child’s **age**
– The situation or challenge selected (e.g., haircuts, doctor visits, transitions) and any optional details you type in to make the story more specific
**If you’d like the story to feel even more personal, you can simply say your child’s real name out loud in place of the nickname as you read the story together.** There is no field to type a real name into, and no real name is ever sent to us, processed by us, or stored by us — the substitution happens only in how you read the story aloud, not in our system.
We do **not** request or require:
– The child’s last name or real first name
– The child’s photo, image, or likeness
– The child’s date of birth, school, address, or any other directly identifying information
– Any information about the child’s diagnosis, medical records, or treatment history
If you choose to type additional context into a free-text field, please avoid including anything you wouldn’t want stored (e.g., identifying details or medical information) — the field is optional and only the situation type is needed for the story to work.
### 2.3 Information collected automatically
Like most websites, we automatically collect limited technical data when you visit, including:
– IP address, browser type, device type
– Pages visited and time spent
– Cookies used for site functionality, security (bot/spam protection), and — if enabled — basic analytics
We do not use this technical data to build advertising profiles of children, and we do not knowingly link browsing/analytics data to a child’s story data.
—
## 3. Why we collect this information
We use the information above only to:
– Generate the personalized story you requested
– Create and manage your account and subscription
– Process payment for paid plans
– Provide customer support
– Send you service-related communications (e.g., your story is ready, billing receipts)
– Improve the Service (e.g., understanding which situations are most requested) — using aggregated or de-identified data wherever possible
– Send optional marketing communications, but **only if you opt in**, and you can opt out at any time
We do **not** use a child’s name, age, or story details for advertising, and we do not build advertising profiles based on a child’s information.
—
## 4. Children’s privacy (COPPA and general protections)
We take extra precautions because this Service involves information related to minors:
– **All child-related information is submitted by a verified adult account holder** — not collected directly from the child, and the Service is not marketed or made available for children to use on their own.
– **Your child’s real name is never collected, transmitted, or stored, in any form.** Stories are personalized using a nickname or placeholder name you choose. If you’d like the story to feel more personal, you can simply say your child’s real name aloud in place of the nickname while reading together — this happens entirely outside our system.
– We do not require or knowingly collect photos, contact information, precise location, or persistent identifiers belonging to the child.
– We do not sell information about children, and we do not use it for targeted advertising.
– A parent can review, correct, or delete their child’s information at any time (see Section 7).
If we discover that a child has submitted personal information directly to us without a parent’s involvement, we will delete that information promptly. If you believe this has happened, contact us using the information in Section 10.
—
## 5. Who we share information with
We do not sell your information or your child’s information. We share information only with:
– **Service providers who help us operate**, such as our hosting provider, payment processor, email delivery service, and security/anti-spam tools — each of these is bound by their own privacy and security obligations and only receives the data needed to perform their function
– **Legal or safety reasons**, if required by law, subpoena, or to protect the rights, property, or safety of Autism Ascent, our users, or others
– **A successor entity**, if Autism Ascent is involved in a merger, acquisition, or sale of assets — in which case we will notify users and any applicable data protections will carry forward
We do not share child-specific data (name, age, story content) with advertisers or data brokers.
—
## 6. Data storage, security, and retention
– Data is stored on secure servers with access limited to personnel who need it to operate the Service.
– We use industry-standard safeguards (encryption in transit, access controls, monitoring for suspicious activity) to protect information from unauthorized access.
– No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.
– We retain account and child-story data for as long as your account is active, or as needed to provide the Service. If you delete your account, we will delete or de-identify associated child data within [INSERT TIMEFRAME, e.g., 30 days], except where we’re required to retain limited records for legal, billing, or fraud-prevention purposes.
—
## 7. Your rights and choices
As the parent/account holder, you can at any time:
– **Access** the information we hold about your account and your child’s stories
– **Correct** inaccurate information (e.g., update your child’s name or age)
– **Delete** a specific story, your child’s information, or your entire account
– **Export** a copy of stories you’ve created
– **Opt out** of marketing emails via the unsubscribe link in any email, or by contacting us
– **Withdraw consent** for us to hold your child’s information, which will result in deletion of associated data
To exercise any of these rights, contact us at [INSERT CONTACT EMAIL]. We will respond within [INSERT TIMEFRAME, e.g., 30 days].
Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA/CPRA) or, if applicable, the EU/UK General Data Protection Regulation (GDPR). We will honor applicable requests consistent with those laws.
—
## 8. Cookies and tracking
We use cookies for:
– **Essential functions** (keeping you logged in, remembering your place in the story-creation flow)
– **Security** (bot and spam detection)
– **Analytics**, if enabled, to understand overall site usage — this is aggregated and not used to profile individual children
You can control cookies through your browser settings. Disabling essential cookies may affect the ability to use parts of the Service.
—
## 9. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes — especially changes affecting how we handle children’s information — we will notify account holders by email and/or a prominent notice on the site before the changes take effect.
—
## 10. Contact us
If you have questions, concerns, or requests regarding this policy or your child’s information:
**Email:** [INSERT CONTACT EMAIL]
—
—
# Plain-Language Summary — “What Happens to Your Child’s Data”
*(Short version for display near the story-creation form, sign-up flow, or as a linked tooltip. Written for a worried parent skimming quickly, not a lawyer.)*
> **We never collect your child’s real name — not even briefly.**
> You choose a nickname or placeholder for the story (like “Sam” or “Buddy”). If you want it to feel more personal, just say your child’s real name out loud in place of the nickname while you read together. There’s no field to type it into, and it never touches our system.
>
> **We only ever ask for that nickname and an age — nothing else.**
> No last name. No photo. No diagnosis or medical history. Just enough to personalize the story.
>
> **You’re always in control.** You can view, edit, or delete your child’s information and stories anytime from your account, or by emailing us.
>
> **We never sell your child’s information**, and we don’t use it for advertising — to anyone, ever.
>
> **Your child never creates an account or enters information themselves.** Everything is entered by you, the parent or caregiver.
>
> **Your information is stored securely** and only accessed by the people who need it to make the Service work — not shared with data brokers or marketers.
>
> Questions? Read our full [Privacy Policy](#) or email us at [INSERT CONTACT EMAIL].
—
### ⚠️ Important note before publishing
This document is a **starting draft, not legal advice** — I’m not a lawyer, and you shouldn’t treat this as a substitute for one. Before this goes live, I’d strongly recommend a licensed attorney review it, specifically for:
1. **COPPA (Children’s Online Privacy Protection Act)** — your no-real-name design meaningfully reduces this risk since no directly identifying child data is collected, but COPPA’s application can still turn on other specifics of your flow (e.g., whether any part of the site is “directed to children,” how age is used, whether you use any third-party analytics/ad SDKs that collect persistent identifiers). Worth having counsel confirm the reduced-risk framing is accurate.
2. **State-level children’s privacy laws** — several states (e.g., California’s Age-Appropriate Design Code litigation/status, Connecticut, others) have their own requirements that can exceed COPPA and change frequently — worth a search for current status before publishing.
3. **Payment processor and subscription terms (Paid Memberships Pro)** — make sure the policy’s billing/data language matches what your actual payment processor does with data.
4. **GDPR/UK GDPR** — only relevant if you have or expect users in the EU/UK; if you’re US-only for now, you can simplify Section 7’s international language, but it’s easy to leave in for future-proofing.
I’ve left `[INSERT …]` placeholders for the details only you can fill in (dates, contact email, retention timeframe, address).