📄 Version 1.0

Privacy Policy

Last updated: 3 June 2026 · Effective immediately upon account creation

This policy complies with UU PDP Indonesia (Law No. 27/2022) and GDPR basics

🐝 Simple version for kids & parents

      We collect only what we need to make Bumbletale work. We never sell your data.
      We never show targeted ads to children. Parents can delete their child's account anytime.
      We protect children's data with extra care.
    

📋 Contents

Who we are
What data we collect
How we use your data
Special rules for children
Who we share data with
How we store and protect data
Your rights
Cookies
Changes to this policy
Contact us

1. Who we are

Bumbletale (bumbletale.com) is a children's creative writing platform based in Indonesia. We are the data controller for personal data collected through this website.

Contact: hello@bumbletale.com

2. What data we collect

When you register:

First and last name
Username (publicly visible)
Email address (not publicly visible)
Age (to apply appropriate protections)
Parent/guardian email (required for children under 13)
Password (stored as a secure hash — we cannot see your password)

When you use Bumbletale:

Stories you write and publish
Comments you leave
Stories you read (read count only — not tracked per user)
Stories you heart/like
Writers you follow
Your writing streak and achievements

Automatically collected:

IP address (for security and consent records)
Browser type (for technical compatibility)
Date and time of consent (required by law)

⚠️ What we do NOT collect
We do not collect phone numbers, home addresses, school names, photos, or any payment data (we don't charge anything yet). We never track children's browsing behaviour outside of Bumbletale.

3. How we use your data

To provide the service — creating your account, saving your stories, showing your profile
To improve safety — detecting inappropriate content and protecting children
To send important emails — account verification, parent approval, story published notifications
To comply with the law — keeping consent records as required by UU PDP Indonesia
To improve Bumbletale — understanding which features are used (anonymised, no personal data)

🚫 We will never
Sell your data to anyone · Show targeted advertising to children · Share your email with third parties for marketing · Use children's data to train AI models · Transfer data outside Indonesia without adequate protection

4. Special rules for children

🛡️ Children get extra protection
Bumbletale is designed for children aged 6–18. We apply the strictest possible data protection standards to all users, with additional measures for children under 13.

Children under 13:

A parent or guardian email is required during registration
The account is not activated until a parent approves via email
Parents can view, edit, or delete their child's account at any time by contacting us
We do not display the child's full name publicly — only their chosen username
Children's stories are moderated before publishing

All children (6–18):

Comments are moderated for safety
Inappropriate content is automatically detected and blocked
There is a report button on every story and comment
We respond to safety reports within 24 hours

This policy complies with UU PDP Indonesia (Law No. 27/2022) which requires explicit parental consent for processing personal data of children.

6. How we store and protect data

All data is stored on servers located in the region selected by our hosting provider
Passwords are hashed using bcrypt — we cannot read your password
All connections are encrypted via HTTPS/SSL
Database access is restricted and password-protected
We perform regular security checks

How long we keep your data:

Active accounts — as long as your account exists
Deleted accounts — personal data deleted within 30 days of request
Published stories — deleted immediately upon account deletion
Consent records — kept for 5 years (legal requirement)
Security logs — kept for 90 days

In the event of a data breach affecting your personal data, we will notify you within 14 days as required by UU PDP Indonesia.

7. Your rights

Under UU PDP Indonesia and GDPR, you have the following rights:

✅ Right to access — request a copy of all data we hold about you
✅ Right to correction — ask us to fix incorrect data
✅ Right to deletion — request deletion of your account and all personal data
✅ Right to withdraw consent — you can withdraw consent at any time (this will close your account)
✅ Right to data portability — request your data in a readable format
✅ Right to object — object to any processing you disagree with

To exercise any of these rights, email us at hello@bumbletale.com or use the delete account page. We will respond within 14 days.

Parents and guardians may exercise all rights on behalf of their children under 13.

8. Cookies

We use only essential cookies — no tracking or advertising cookies:

Session cookie — keeps you logged in during your visit. Deleted when you close your browser.
No analytics cookies
No advertising cookies
No third-party tracking cookies

Because we only use essential cookies, we do not require a cookie consent banner.

9. Changes to this policy

If we make significant changes to this policy, we will:

Update the version number and date at the top of this page
Send an email notification to all registered users
For children under 13 — send notification to the parent email
Ask for renewed consent if the changes are material

Current version: 1.0 · Last updated: 3 June 2026

10. Contact us

🐝 Get in touch

For privacy questions, data requests, or to report a child safety concern:

📧 hello@bumbletale.com
🌐 bumbletale.com
📍 Indonesia
⏱ We respond within 14 days (usually much faster)

For urgent child safety issues, we aim to respond within 24 hours.