Cookie Policy

1. The Short Version

2. What Are Cookies & Similar Technologies?

A cookie is a small text file that a website places on your device to remember information between pages or visits — for example, that you are signed in.

“Similar technologies” include local storage (a browser store we use only to remember that you have seen our intro animation) and secure device storage (in our app, your login token is held in the device’s secure keychain, not in a cookie).

3. Cookies & Storage We Use

On a normal visit

Browsing our marketing pages sets no cookies beyond what our security/CDN provider needs (see below) and a single browser local-storage value:

When you sign in

When you make a payment

Payments on our website are handled by Stripe. When you reach checkout, Stripe sets its own cookies to process the payment securely and to help detect fraud:

These are necessary to take payment securely; if you block them, payment may not work. See Stripe’s cookie policy.

When you use our chat assistant

If you use the chat assistant on our website, the messages you type are sent to Google Gemini (our chat provider, a processor located in the US) to generate a reply, and your conversation may be held in your browser’s temporary session storage for the duration of the chat. We do not use the chat to advertise to you.

Always (security & delivery)

Our site is served through Cloudflare, which sets short-lived cookies (such as __cf_bm / __cfruid) needed for bot management, security and reliable delivery. See Cloudflare’s cookie information. The exact names set by Stripe and Cloudflare are controlled by those providers and may change; they are always limited to security, fraud-prevention and delivery — never advertising.

4. What We Do NOT Do

• We do not use Google Analytics, Google Tag Manager, Facebook/Meta Pixel, or any other third-party advertising or web-analytics cookie on our website.
• We do not sell or share data with advertising networks.
• We do not build behavioural profiles of children, and we never use cookies to track children.

5. Third-Party Cookies

The only third parties that set cookies through our website are Stripe (payments) and Cloudflare (security/CDN), as listed above, and only for the strictly necessary or functional purposes described. We do not control these cookies directly; their use is governed by the providers’ own policies, linked above.

6. In the Mobile App

Our mobile app does not use browser cookies. Instead it uses on-device storage:

• Secure keychain storage — your login token is stored in the device’s secure keychain (Apple Keychain / Android Keystore) so you stay signed in. Strictly necessary.
• App storage — non-sensitive app state (preferences, recently viewed items) is cached on the device for performance. Removing the app clears it.
• Push notification token — if you enable notifications, a device token is used to deliver them. You can turn notifications off at any time.
• Product analytics (optional, opt-in) — the app can collect anonymous usage analytics to help us improve. This is off until you explicitly opt in, is never used to profile children, and never sends your email or IP address. You can change your choice any time in the app’s privacy settings.

7. How to Manage Cookies

Because we set only strictly necessary and functional cookies, there is nothing to switch off at the cookie level on our site. You can still control cookies through your browser settings (look for “Privacy” or “Cookies”); guidance is at aboutcookies.org. Note that if you block the strictly necessary cookies above, you will not be able to sign in, and payment may not work. Because we do not track you across sites, there is nothing for a “Do Not Track” signal to disable — we honour the principle by simply not tracking.

8. Legal Basis

In the UK and EU, cookies are governed by the Privacy and Electronic Communications Regulations (PECR) / the ePrivacy Directive, alongside the UK GDPR / EU GDPR.

• Strictly necessary cookies are exempt from the consent requirement.
• The payment cookies are set by Stripe only when you proceed to a checkout you have initiated, to take and secure that payment. We recognise that some regulators view fraud-prevention cookies as requiring consent; if guidance settles that way for our set-up, we will add a checkout-level consent step. We do not set these cookies on general browsing.
• We set no advertising or third-party analytics cookies. Where the law requires consent for any future non-essential cookie, we will obtain it before setting that cookie.

9. Changes to This Policy

If we introduce new cookies or change how we use them — in particular if we ever add non-essential analytics or advertising cookies — we will update this policy, change the “Last updated” date above, and, where required, ask for your consent.

10. Contact & Your Representatives

Questions about this policy, or about how we use cookies and personal data: [email protected].

Controller: The Dream Management Group FZE LLC, Office BC-890780, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates.

We have appointed Prighter as our representative for the UK and the EU. You can contact them or exercise your data-protection rights via app.prighter.com/portal/once-upon-a-me.

• EU representative (Art 27 EU GDPR): iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Vienna, Austria.
• UK representative (Art 27 UK GDPR): Prighter Ltd, 20 Mortlake Mortlake High Street, London, SW14 8JN, United Kingdom.