Wonderleaf Privacy Policy
DRAFT — NOT YET PUBLISHED (2026-09-17). This revision is prepared for
founder review and is not the text live at
wonderleaf.app/privacy. Publishing it is a founder action;
until then the published policy remains the 2026-09-09 version.What changed (2026-09-17, draft): Wonderleaf no longer offers a free
trial, so this policy no longer describes one. What Wonderleaf collects,
why, and for how long is unchanged.What changed (2026-09-09): This policy began describing the subscription
product that is actually live: a $9.99/month or $49.99/year subscription,
sold on the web through Stripe and in the iOS app through Apple In-App
Purchase. The previous version of this page, dated 2026-07-05, described a
retired product built around accounts, custom books, and a 13+ sign-up
checkbox.
Last updated: 2026-09-09
This draft: 2026-09-17 (unpublished)
Operator: Wonderleaf, LLC (a Delaware limited liability company)
Contact: privacy@wonderleaf.app
The short version
You can browse Wonderleaf, including search, without an account. Browsing
the field, the association view, and search does not set an account session
cookie. There are no ads, no third-party advertising, and no tracking across
other companies' apps or websites.
Core and Wave wonders are free to read in full, without an account. Opening
any other wonder requires a subscription. On the web, the account
holder is a parent who signs in with an email address and magic link. On
iPhone, Apple handles the In-App Purchase. Wonderleaf keeps the account and
purchase identifiers needed to recognise access.
Wonderleaf has no comments, messaging, uploads, or user-generated content.
Nothing a reader types while browsing starts an AI model or creates a new
wonder.
1. Who the account is for
A reader may be a child. The account holder and purchaser is the child's
parent or legal guardian. We do not ask a child to create a profile or give us
a name, email address, date of birth, school, location, photo, or message.
The child's reading is not given a separate profile. Wonderleaf does not use a
child's reading for advertising, tracking, or personalisation.
If you believe a child gave Wonderleaf personal information without
the parent's permission, email privacy@wonderleaf.app and we will investigate
and delete it where required.
2. What we collect
| Data | When | Why | How long |
|---|---|---|---|
| Parent email address | The parent creates a web account or asks for a magic link | Identify the account, send the sign-in link, provide service and billing messages, and answer support or data-rights requests | Until account deletion, plus up to 90 days in operational systems, except for records we must keep for tax, billing, security, or legal reasons |
| Stripe purchase identifiers | A web subscription starts, renews, changes, is cancelled, or is refunded | Connect Stripe's customer and subscription records to the parent's Wonderleaf access | Until account deletion, except for records we must keep for tax, billing, security, or legal reasons |
| Apple purchase identifiers | An iPhone subscription starts, renews, is restored, expires, is cancelled, or is refunded | Verify the signed StoreKit transaction and keep entitlement current | Until account deletion, except for records we must keep for tax, billing, security, or legal reasons |
Account session cookie (wl_sid) |
The parent signs in with a magic link | Keep the parent signed in securely | Up to 30 days, or until sign-out, expiry, or account deletion |
Purchase identifiers may include the provider, product and plan, customer or
original transaction identifier, transaction identifier, subscription status,
purchase and expiry dates, and billing-period end. Wonderleaf does not receive
or store the full payment-card number from Stripe or Apple.
3. Browsing, search, and technical records
We do not create a reader profile, visitor ID, or reading history for a person
who is browsing without an account. Search is free and is used only to find
material that Wonderleaf already published. It does not create a new answer
and it is not sent to an AI model.
Our hosting and content-delivery providers process ordinary request data such
as IP address, timestamp, requested URL, response status, and user agent to
deliver the service, diagnose errors, and defend against abuse. Current
operational request-log retention is 30 days unless a particular record must
be kept longer for a security incident or legal obligation.
We may use a short-lived, in-memory rate-limit counter derived from an IP
address to stop one client from flooding the service. It is not written to the
application database.
We do not run advertising, advertising trackers, session recording,
heat-mapping, fingerprinting, or third-party analytics. We do not sell personal
information or use it for cross-context behavioural advertising.
4. What Stripe receives
For a web purchase, Stripe receives the parent's email address, the selected
subscription and price, checkout and transaction identifiers, and the payment
information the parent enters at Stripe Checkout. Stripe uses this information
to process the payment, renewal, cancellation, refund, applicable tax,
fraud checks, and receipts under Stripe's own terms and privacy notice.
Wonderleaf receives Stripe customer, checkout, and subscription identifiers
and subscription status updates. Wonderleaf does not receive the full card
number.
5. What Apple receives
For an iPhone purchase, Apple receives and processes the purchaser's Apple
Account, payment information, selected subscription, and purchase activity
under Apple's terms and privacy notice. Apple governs billing, refunds, and
cancellation for Apple In-App Purchases.
Apple sends Wonderleaf a signed transaction and subscription updates. Those
records include purchase identifiers, product, environment, purchase and
expiry dates, and refund or revocation status. Apple does not send Wonderleaf
the full card number or the parent's Apple Account password.
6. Other service providers
| Provider | What it does | What it handles |
|---|---|---|
| Google Cloud | Hosts the application, database, and published wonders | Parent account and purchase records, session records, published wonders, and request logs |
| Cloudflare | Delivers and protects the site at the network edge | Request metadata such as IP address, URL, and user agent |
| Resend | Delivers magic links and service email | Parent email address and message delivery details |
| Stripe | Runs web checkout and subscription billing, including any applicable tax | The data described in Section 4 |
| Apple | Distributes the iPhone app and runs In-App Purchase | The data described in Section 5 |
No provider uses a reader's data to train an AI model on Wonderleaf's behalf.
7. Children's privacy
Wonderleaf is a family-friendly library, and a child may be the person reading
it. The child is not the account holder. The parent or legal guardian holds
the account and controls the purchase.
Free browsing, including search, asks the reader for no account details. The
paid flow asks for a parent email on the web or uses the purchaser's Apple
In-App Purchase on iPhone. We do not knowingly collect personal information
directly from a child through either flow.
Wonderleaf has no third-party advertising, behavioural advertising, tracking,
social features, or user-generated content.
The final product flow and this section must be reviewed for COPPA,
state children's-privacy laws, the UK Children's Code, and applicable EEA
rules before worldwide launch.
8. Your rights and choices
The parent account holder can ask to access, correct, or delete personal
information by emailing privacy@wonderleaf.app from the account email.
A signed-in parent can also choose Delete my account in Wonderleaf
Settings. That control uses the existing authenticated DELETE /api/me route,
deletes the account and active sessions, and removes or anonymises associated
personal data subject to records Wonderleaf must retain.
Depending on where you live, you may also have rights to restrict or
object to processing, receive a portable copy, withdraw consent where consent
is the basis, and complain to a data-protection authority.
We will verify and answer a rights request within the time required
by applicable law, without charging or discriminating where the law forbids
that.
9. EEA and UK information
Where the GDPR or UK GDPR applies, Wonderleaf, LLC is the controller
for the account, entitlement, and service data described in this policy.
We rely on contract to create the parent account and provide paid
access, legitimate interests to secure and operate the service, and legal
obligation for tax, billing, safety, and regulatory records.
Wonderleaf stores its application data in the United States, so data
from the EEA or UK may be transferred to and processed in the United States
using the safeguards applicable to each provider and transfer.
Wonderleaf has not yet designated a formal GDPR Article 27 EU
representative. Until one is designated, EU residents may contact
Wonderleaf's data protection contact at privacy@wonderleaf.app, and a
representative will be named here once appointed.
Wonderleaf has not yet designated a formal UK GDPR representative. Until one
is designated, UK residents may contact Wonderleaf's data protection contact
at privacy@wonderleaf.app, and a representative will be named here once
appointed.
10. California
We do not sell or share personal information and do not use it for
cross-context behavioural advertising. Some browsers send a Do Not Track or
Global Privacy Control signal. Because Wonderleaf does not track across sites,
there is no cross-site tracking for those signals to switch off.
California residents may make any access, correction, deletion, or
other request available under California law through the methods in Section
8.
11. Security
- Traffic uses HTTPS.
- Magic links are single-use and expire after 15 minutes.
- Wonderleaf stores no passwords.
- The
wl_sidcookie is an opaque identifier checked on the server. - Stripe and Apple handle payment credentials; Wonderleaf stores purchase
identifiers instead of full card numbers. - Provider-managed encryption protects the database and stored files at rest.
If a qualifying data breach occurs, Wonderleaf will notify affected
people and regulators as applicable law requires.
12. Changes
If we materially change this policy, we will post the updated version here
with a new last-updated date and explain the change.
We will give any additional notice or ask for any consent that
applicable law requires.
13. Contact
Privacy questions and data requests: privacy@wonderleaf.app
General support: hi@wonderleaf.app
Copyright / DMCA: dmca@wonderleaf.app
Wonderleaf, LLC
1111B S Governors Ave Suite 55801
Dover, DE 19904
United States