Authentication and account access
- Email + password (passwords hashed by our auth provider) or Google sign-in.
- Sessions are scoped per device and can be signed out from the dashboard.
- Account roles are stored server-side and enforced with row-level security.
Data handling
- All traffic is encrypted in transit with TLS.
- Application data is stored in our managed Postgres database with encryption at rest provided by the hosting platform.
- Row-level security policies scope each request to the authenticated user.
- Service credentials are stored in a managed secrets vault, never in source code.
- We do not sell personal information.
Subprocessors
- Supabase — application database, authentication, hosting.
- Stripe — payments and subscription billing.
- DeepSeek — AI model that generates story text from a structured prompt containing only the child’s first name and age.
- Google — optional OAuth sign-in.
- Lovable Cloud — application hosting and email delivery infrastructure.
Content moderation
- Story generation runs through a structured prompt that constrains tone, length, and themes by age band.
- The prompt explicitly excludes sexual content, graphic violence, hateful content, and adult themes.
- Generated stories are stored in your library so you can review any story before reading aloud.
- Parents can report a story by emailing us; reports are reviewed and used to refine prompt safeguards.
Email and unsubscribe
- Transactional and nightly emails are sent from our verified sender domain (nightnighthero.com) with SPF, DKIM, and DMARC alignment.
- Every email includes a one-click unsubscribe link compliant with RFC 8058.
- Unsubscribed addresses are added to a suppression list and excluded from future sends.
Reliability
Nightly stories are scheduled by a background job at 6 PM in the parent’s local time zone. Failed sends are retried automatically; persistent failures are recorded and surfaced for investigation.
Vulnerability reporting
If you believe you have found a security vulnerability, please email lancedmcginnis@gmail.com with the words “Security report” in the subject line and a description we can reproduce. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond. We do not take legal action against good-faith researchers who follow this policy.
Incident contact
Suspected security incident, account takeover, or data concern: lancedmcginnis@gmail.com.
Compliance
Night, Night Hero is a small consumer service and does not currently hold third-party certifications such as SOC 2 or ISO 27001. We are committed to the privacy and safety practices described on this page and in our Privacy Policy.