Privacy

What stays on the phone

Your child’s profile — a nickname, an age band (0–1, 1–2, or 2–3), the languages and canvas settings you choose, and the optional photo you pick as an avatar — never leaves the device. The optional avatar is processed on the phone and is not the photograph used for naming.

What your child taps in a curated book, and the local event log, stay on the phone. The log is never sent automatically. A parent can export it by hand.

Voices you record yourself for a discovery, and any custom cover you choose, stay on the phone — unless you give that book to someone, as described below.

There are no ads, no analytics SDKs, and no crash reporters in the app.

The books

Who Lives Here includes a starter chapter inside the app. That starter works offline and does not start a download.

Other chapters and books download through Apple, not through a Morilo file server. Morilo asks Apple only for a public pack name. We do not send a child’s profile with that request, and we do not collect download analytics.

Discovery Books — photographs

Every install can keep private Discovery Books of things you photograph at home. You can always type the name yourself. Typing a name sends nothing.

If you ask Morilo for a name, and this install has a verified library purchase, a cleaned picture goes to Morilo’s own server on Cloudflare, then to OpenAI. The picture is turned the right way up, stripped of location and other file metadata, and limited to 1024 pixels on the long edge and 1 MB. We also send the languages you asked for and a request ID. The original photo, the Photos library identifier, the child’s profile, and any recording do not go.

We ask OpenAI not to keep the request as application state, and we turn off Cloudflare AI Gateway logs and cache. OpenAI’s published API policy says they do not use this kind of API content to train their models.

We have not applied for OpenAI Zero Data Retention. OpenAI may keep the request in abuse-monitoring logs for about 30 days. We do not claim zero retention.

After the name is saved on the phone, looking at that discovery does not send the picture again.

Discovery Books — names and voices

Asking Morilo to translate a name sends only the name text and the languages.

When you confirm a name so the child can hear it in Morilo’s voices, that name text goes through our server to ElevenLabs. The photograph does not go to ElevenLabs.

ElevenLabs keeps the name and the voice they generate, and may use them to improve their models. Once the voice is saved on the phone, tapping it does not go online again.

If the voice cannot be fetched, the child hears the on-device voice instead.

Giving a Discovery Book

You can give a whole Discovery Book to someone you know as a single file: its pictures, its names, its prepared voices and, if you leave the switch on, the voices you recorded. You send it yourself from the iPhone share sheet — AirDrop, Messages, Mail, or Files. It travels by the route you pick. It never passes through our servers, we never see it, and Morilo keeps no copy.

The file carries no location or other photo metadata, no child profile, no dates, and no usage records. A From line goes with it only if you type one. A book someone gives you cannot be given on again.

When a book arrives, nothing interrupts your child. Morilo shows a preview first, and the book joins your shelf only when you choose Add to shelf; Not now deletes it. If Sensitive Content Warning or Communication Safety is on in iOS Settings, Morilo checks the pictures on the phone with Apple’s system check and refuses the whole book if any picture is flagged. Voices and text are not checked. Nothing about the check leaves the phone.

Purchases

Purchases go through Apple. Morilo has no account of its own.

To prove a library purchase for naming, the app sends Apple’s signed purchase record to our server once. We store a one-way hash of Apple’s original transaction ID, the calendar month, and how many namings and voice renders that month used. We never attach an app account token. We do not link that hash to a profile, a photo, or a name. Rows for older months are deleted.

Without a library purchase, Morilo does not send purchase proof for naming. Optional feedback is separate, as described below.

This website

If you join the waitlist, we store three things: the email address you type, which page language you used, and the date and time. Nothing else — no name, no IP address, no device information, no advertising identifiers. We write once, on launch day. We never sell, rent, or share the list.

Cookies. None. This site sets no cookies and loads no third-party analytics or advertising scripts. Fonts, images, sound, and video are served from this site’s own domain. If page analytics are ever switched on, they will be Cloudflare Web Analytics: cookieless, aggregate, and never tied to a person.

Feedback you choose to send

Profile → Send feedback sends your typed note and optional topic to the Morilo team through Cloudflare Email Service. Device details are off by default; turning them on adds only app version/build, OS version and device model. Please leave out children’s personal details. No child profile, photo, recording or activity log is attached.

Feedback goes to our support mailbox, forwarded through Cloudflare to Gmail (Google). We do not keep note bodies in our application database. The mailbox keeps support mail until our team deletes it; provider retention and backups also apply. You can ask us to delete a support message at [email protected] .

To avoid duplicate emails, Cloudflare D1 keeps a submission identifier, keyed digest and delivery state for seven days, with an hourly cleanup sweep. Provider backups may retain deleted metadata separately. A connecting IP is processed transiently for a short-lived rate limiter and is not saved with the submission. The app keeps an attempted note locally, protected and excluded from backup, until acknowledgment or explicit discard. Sending an email separately after an unconfirmed attempt may produce a duplicate.

Who else sees it

Cloudflare hosts this website and Morilo’s Discovery and Feedback servers; Google hosts our support mailbox.

OpenAI sees the cleaned picture when you ask for a name, or the name text when you ask for a translation.

ElevenLabs sees the name text you confirm for a spoken voice.

Apple sees purchase and book-download requests.

Nobody else. We do not sell this, and we do not share it for advertising.

Ask us

Write to [email protected] , or use Send feedback in Profile. No account is required.

We can remove a waitlist email.

We cannot see what is on your phone. Deleting the app deletes the local collection. We cannot reach into OpenAI’s abuse-monitoring logs or ElevenLabs’ retained names the way we delete a waitlist row. Write anyway, and we will say what we can do.