Your privacy

Privacy Policy

Nightshelf ("the app", "we", "us") is a bedtime-story app for iOS. It is built to know as little about you as possible. There is no account, no sign-in, no analytics SDK, no third-party tracker, and no advertising. This policy explains the little that's left.

What stays on your device

• Your shelf and progress — which stories you've opened, your saved shelf, your place in each one, and supported bedtime settings (voice, speed and sleep timer). These live on your device and can sync between your own devices through Apple's private iCloud key-value storage. Ambient sound choices and their volume stay on this device. Nightshelf keeps no server copy of your synced progress.
• On-device narration — the built-in iOS voice synthesizes every word on your phone, and it never needs a connection.
• The welcome narration — from Nightshelf 1.9.3, a small record on this iPhone of how much of the welcome you've heard: how many characters have been sent to be read, when the welcome began and ended and why, and when it may try again if the narrator couldn't be reached. From 1.9.10 the welcome voice is Mira; earlier versions use Nova. The same record and allowance carry over when you update. It is kept in this iPhone's Keychain, so deleting and reinstalling Nightshelf does not play the welcome again. It is not copied to your other devices or to a new iPhone, and it is never sent to our server. Nightshelf Pro does not use it.

What leaves your device, and why

From Nightshelf 1.9.3, the books that come with Nightshelf can be read by an AI narrator without asking first, and this is on from the start: Automatic is the starting voice and AI narrators start on (unless you said no to Nightshelf's cloud features in an earlier version), so the first time you play one of those books on an iPhone, the welcome narrator starts reading English books: ElevenLabs Mira from 1.9.11, OpenAI Mira in 1.9.10, and OpenAI Nova in earlier versions. The paragraph being read and a small amount ahead go to Nightshelf's server, which asks ElevenLabs to voice them in 1.9.11; earlier app versions use OpenAI narration. Spanish, French, German, Italian and Brazilian Portuguese stories use matching voices installed on your iPhone. The exact buffering is described below. The selected provider receives the book text, voice choice, language and reading settings, with no Nightshelf device or subscription ID. ElevenLabs stores submitted text and generated audio in our provider account history. Its terms and our account arrangements govern how long that history remains; Nightshelf does not delete each history item after a reading or promise immediate deletion. Nightshelf's server sees your internet address, as any website does, and keeps a scrambled daily character count to limit use. You can turn this off in Settings → AI features. Tonight's Story and the stories you made are different: Nightshelf asks before anything you choose or type leaves your phone. In Nightshelf 1.9.2 and earlier, every cloud narration asks first as well, including the books that come with Nightshelf; once allowed, it sends the same text. The details are below, along with smaller requests that go out without asking: tapping ▶ to audition a narrator, a text-free check at launch, and a text-free check for available narrators when the English voice picker opens.

• AI narrators reading Nightshelf's books (from Nightshelf 1.9.3) — from 1.9.11, Nightshelf offers ten ElevenLabs narrators for English stories: Mira, Rowan, Alden, Clara, Ellis, Finn, Arun, Nora, Iris and Lucia. Automatic and the free welcome use ElevenLabs Mira. Spanish, French, German, Italian and Brazilian Portuguese stories use matching voices installed on your iPhone. In 1.9.10, Mira and Rowan use OpenAI, with Mira for Automatic and the welcome; earlier versions use OpenAI Nova for Automatic and the welcome. With Nightshelf Pro, the narrator you choose reads English stories. Without Pro, the welcome reads your first few minutes of Nightshelf's books once on each iPhone, when your voice is set to Automatic; then, at the end of a paragraph, your iPhone's own voice carries on, offline. The current paragraph and the next one are sent to be turned into audio. With Pro in 1.9.10, up to two more short paragraphs can be sent early to reduce waits between paragraphs. The welcome still fetches only the next paragraph ahead, and changing its narrator does not restart the welcome allowance. Welcome requests carry no device ID and no receipt; a Pro request carries the ID and receipt described below. Settings → AI features → AI narrators for Nightshelf's books turns this off, and your iPhone's voice then reads every book that comes with Nightshelf, offline. The switch syncs with your other settings through your iCloud. If you said no when Nightshelf asked about its cloud features in an earlier version, on this iPhone or on an iPhone whose backup this one was restored from, the switch starts off, and because it syncs, it is then off on your other devices too. No text of Nightshelf's books is sent for narration when you have chosen a particular iPhone voice, when AI narrators are off, or, without Pro, once the welcome minutes are done. In versions before 1.9.11, an iPhone voice could stand in automatically for an interrupted AI narrator while paragraphs ahead were still sent. In 1.9.11, an interruption pauses your chosen AI narrator. You can retry it or choose Use iPhone voice for this listening session. While that local choice stays active, no new narration requests are sent for the story. Retrying, choosing an AI narrator or starting a new session can send its words again. From 1.9.12, if your chosen AI narrator is interrupted, your iPhone's own voice reads on from the same place, and Nightshelf keeps trying your narrator: at the next paragraph, then every few paragraphs, when you come back to the app, or when a limit resets. Each try sends the paragraph about to be read, even while your iPhone's voice is reading and even if the narrator doesn't answer; once it answers, it reads on. Explicitly choosing an iPhone voice or turning AI narration off stops new narration requests. Switching to the iPhone voice cannot take back words already sent, and requests already sent may still finish. During Mira's free welcome, a brief interruption is retried at the next paragraph; a daily limit, or several interruptions in a row, end her welcome for that book, and your iPhone's voice reads on.
• Tonight's Story and stories you made — writing a custom bedtime story sends the picks you made from the lists — language, setting, tone, weather, time of night and length — plus the optional detail you typed. If a cover picture is painted for it, the story's title, tone and setting are sent so it can be drawn. Having an AI narrator read a story you made sends its paragraphs the same way as a book, and only with your permission. ElevenLabs narration of stories you made requires separate permission on this iPhone; an earlier OpenAI permission does not authorize it. Settings → AI features → ElevenLabs narration reviews or withdraws that permission without changing your OpenAI permissions. Nightshelf asks before you allow these uses. Starting with Nightshelf 1.9.6, new story writing uses OpenAI and needs an updated writing permission on this device, even if you allowed custom-story features in an earlier version. Declining or dismissing that writing request leaves any earlier permission for covers and narration unchanged; it does not allow OpenAI to write a new story. You can manage the writing permission separately in Settings → AI features. Turning off Tonight's Story & your stories there withdraws permission for writing, covers and narration of your stories. Stories you made still read aloud in your iPhone's voice. Please don't include personal details you wouldn't want sent.
• Auditioning a narrator. From 1.9.11, tapping ▶ beside an ElevenLabs narrator's name sends a fixed English sample sentence written into the app itself. Earlier versions can send their fixed sample in the selected story language. It travels the same road as everything else. We don't put it behind the permission because it cannot carry anything of yours — not the page you were reading, not a word you typed, not even which book you were in. It happens only when you tap ▶. Before Nightshelf 1.9.3 it carried the random device or subscription ID described below for every listener; from 1.9.3 it does so only with Nightshelf Pro.
• Available narrators. Opening the English voice picker in versions that support narrator discovery checks Nightshelf’s server for the available choices. This request carries no story text, narrator selection, device or subscription ID, or receipt. Our server still sees the internet address used to reach it. It does not ask a provider to create audio.

Where it goes: three stops, not two

Everything travels the same road.

• Nightshelf's own server first — storyvault-api.fly.dev, which we run and which is hosted for us by Fly.io in the United States. Your words reach us and our host before they reach anyone else.
• OpenAI — paints story covers and, starting with Nightshelf 1.9.6, writes new Tonight's Stories after the updated writing permission. For writing, it receives the choices and optional detail described above. Earlier app versions also use OpenAI narration, sending the text to be read, the narrator's name and a reading-style note, with no ID of yours. Version 1.9.11 uses ElevenLabs for cloud narration instead.
• ElevenLabs — from 1.9.11, turns English text into audio for all ten AI narrators, including Mira on Automatic and the free welcome. It receives the text, selected voice, language and audio settings, with no Nightshelf device or subscription ID. Stories you made need the separate permission described above. ElevenLabs stores submitted text and generated audio in our provider account history. Its terms and our account arrangements govern how long that history remains; Nightshelf does not delete each history item after a reading or promise immediate deletion. Audio may also be cached on your device and our server.
• Anthropic — its Claude model writes Tonight's Stories in earlier app versions, which continue to use Anthropic under their existing permission.

OpenAI, ElevenLabs and Anthropic retain text according to their own terms and applicable account arrangements. Nightshelf does not promise immediate deletion or zero retention by any provider. What we can tell you is what we do, below.

What our server keeps

• A device or subscription ID. Nightshelf has no account or sign-in and does not require your name or email. A story detail can contain identifying information. We send that text without removing identifying details, so please leave personal information out. Cloud narration, writing and cover requests also carry a random ID that stands in for your phone, subject to the exceptions below. From Nightshelf 1.9.3, requests from a listener without Nightshelf Pro — the welcome and ▶ auditions — no longer carry it. The ID isn't made from anything about you, and deleting and reinstalling Nightshelf keeps the same one. If you subscribed in the app, a phone that picks up that subscription switches to the ID saved with the purchase instead, so your devices share that one ID. These records can be linked to your device or subscription, even though they do not carry your name or email. It exists so daily limits can be counted per device or subscription rather than per network — otherwise everyone behind one router would share a single limit. Counting requires keeping it: our server stores a scrambled (SHA-256) copy of that ID alongside the date, which feature was used, and a running number. No book title, no story, and none of your words are in that row. Rows more than 35 days old are deleted when the clean-up runs — but nothing runs it on a timer. It piggybacks on other traffic reaching the same server, so a row can sit there longer than 35 days, and we would rather say that than imply a schedule we haven't built.
• A record for a subscription from an offer code. These subscriptions lack the app account token used by an in-app purchase, so our server keeps a separate record. It holds Apple's transaction IDs, the first presenting device's random ID stored as it is, and verification timestamps. A separate recent-device history keeps scrambled (SHA-256) copies of device IDs with first- and last-seen times, linked to the subscription. The history is bounded to recent devices; it is not an access limit. A device removed from that history can return with a current, valid verified receipt. The subscription's devices share one service budget. These records contain no name, email, card details or story text and are not part of the 35-day usage clean-up. Older history entries can be replaced as devices return, while the transaction record and first device's ID can remain after the subscription ends. To request release of the retained subscription record, email the address below.
• In-progress usage reservations. While a cloud request is being handled, we reserve its allowance so simultaneous requests cannot spend the same allowance twice. The reservation stores a random reservation ID, a scrambled budget key (a subscription or device ID or, for the welcome from Nightshelf 1.9.3, your IP address), the UTC date, the feature, a numeric amount and its creation time. It contains no receipt, raw device ID, prompt, story, audio or provider response. Completed or refunded reservations are deleted when settlement succeeds. Daily and monthly service ceilings use the corresponding day or month bucket. If settlement fails or a worker stops, the amount remains counted in that bucket. A later admitted request can remove remaining reservation rows whose usage-bucket date is more than 35 days before that request’s bucket date. Daily buckets use the UTC request date; monthly buckets use the first day of the month. This clean-up compares bucket dates, not how long ago the reservation was created, and there is no scheduled deletion deadline.
• Audio, for a while. Narration we have already produced is kept in a shared cache, filed under a fingerprint of the paragraph rather than under any device — so the second listener to reach the first page of a book gets it without it being made again. The cached audio can contain identifying details from the words it reads; a fingerprint filename does not make it anonymous. Audio can remain until space is needed or the server's temporary storage is replaced. There is no fixed time limit.
• Ordinary logs. Narration records which narrator read and how many characters were spoken. A Tonight's Story records the setting, tone and length — and, on some requests, the weather and time of night — plus whether you typed a detail at all, never the detail itself, and how many chapters came back. When the model returns something we cannot use, the failure line records the shape of what came back — which kinds of block, which fields were present — and none of its text. An offer-code subscription adds access-history events: adding a device to recent history can record the subscription's original Apple transaction ID and configured history limit; trimming older history records the number removed. Support release and verification refusal events can also include subscription identifiers. Normal success logs do not include the page, your typed detail, or the generated story and title. For cloud narration, story writing and cover generation, our provider-error logs now record error metadata — such as error type, status and provider request ID — instead of raw provider messages. Older logs may still contain provider errors and submitted content they echoed. This update does not erase those records or change provider retention policies.
• Your IP address. Reaching our server shows it your IP, the way visiting a website does. The guest allowance uses a scrambled (SHA-256) copy of that IP. From Nightshelf 1.9.3, the welcome is counted the same way: a daily character count kept against the scrambled IP, with no device ID. The scrambling uses no secret key, so someone with access to our database could work these rows back to the address. Like the device-ID rows above, they become eligible for deletion after 35 days, but only when the clean-up runs, and nothing runs it on a timer, so a row can stay longer. Web-server access logs can also contain the client IP address, request path and response status. The app also pings the server once at launch to check it is awake: in Nightshelf 1.9.2 and earlier when a cloud narrator would read (with Pro, after you had allowed cloud narration), and from 1.9.3, without asking, when AI narrators are on and one would read Nightshelf's books — with Nightshelf Pro, or while the welcome is still open. That ping carries no text.

Purchases

Nightshelf Pro is bought through Apple. Apple handles the transaction and gives the app a signed receipt, so it knows you're a subscriber. The app sends that receipt to our server with its cloud requests so the server can check it; the receipt carries no name, email or card details. What the server keeps from it for a subscription redeemed with an offer code is described above. You can manage the subscription anytime in Settings → your name → Subscriptions.

Premium system voices

If you download Apple's Premium or Enhanced voices from iOS Settings → Accessibility → Spoken Content (Read & Speak on newer iOS) → Voices, that download and those voices are handled by iOS, not by Nightshelf. From Nightshelf 1.9.2, whenever your iPhone's own voice is reading, Automatic uses the best voice installed and switches by itself when you download a better one, and you can choose any installed voice; these voices read on the phone, offline. Automatic is not always your iPhone's voice, though. For English stories with Nightshelf Pro, it means ElevenLabs Mira from 1.9.11, OpenAI Mira in 1.9.10 and OpenAI Nova in earlier versions (in 1.9.2, once you had allowed cloud narration; from 1.9.3, while AI narrators are on). From 1.9.11, the other five story languages use matching installed iPhone voices, including on Automatic. From 1.9.3, without Pro, Automatic uses the welcome narrator for your first few minutes once on each iPhone, as described above.

Data sharing

We do not sell data and we do not share anything with advertisers. Nothing described above is used to build a profile of you or to advertise to you.

Children's privacy

Nightshelf is made for adults who read themselves to sleep, and the App Store lists the applicable age rating in your country or region. It is not directed to children and is not part of Apple's Kids Category. The shelf is adult literary fiction — alongside the fairy tales there is a Mystery & Gothic shelf holding Dracula, Jekyll & Hyde, Poe and Lovecraft — so parents should treat it the way they would a bookshelf, not a children's app.

No account or sign-in is required, and Nightshelf does not ask for your name or email address. Its cloud features process the text they read aloud or that you choose to send, and the identifiers described above. Please do not enter personal details about a child in a story prompt. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information through Nightshelf, email support@hypersage.ai so we can investigate and delete any such information we retain.

This website

These pages at hypersage.ai/nightshelf/ are covered by the HyperSage AI Labs website privacy policy: no cookies and no identifiers, only anonymous daily totals of page views and App Store button taps. Nothing the website counts is connected to the app.

Contact

Questions about this policy? Email support@hypersage.ai.