Privacy policy
In force from 12 September 2026. Last amended: 17 September 2026.
1. Data controller
- Name: Maczkó János, sole trader (egyéni vállalkozó)
- Registered address: 3529 Miskolc, Csabai kapu 24., 1. emelet 2. ajtó, Hungary
- Tax number: 76645431-1-25
- E-mail: hello@talesacross.com
Processing is governed by the General Data Protection Regulation of the European Union (GDPR, 2016/679/EU) and by Hungarian law.
2. What data we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Server logs (IP address, browser, requested page, timestamp) | Running the site securely and without interruption, filtering out abuse | Legitimate interest (GDPR Art. 6(1)(f)) | At most 30 days |
| E-mail address | Sending the newsletter, if you subscribed | Consent (GDPR Art. 6(1)(a)) | Until you unsubscribe |
| Traffic data (Google Analytics 4: cookie identifiers, pages viewed, approximate location, device and browser) | Understanding which stories are read, and improving the site | Consent (GDPR Art. 6(1)(a)) | According to the Google Analytics retention setting (at most 14 months) |
| Aggregated traffic data (Cloudflare Web Analytics: views, referring page, country, device type — without cookies or any individual identifier) | Understanding which pages are read — without building a personal profile | Legitimate interest (GDPR Art. 6(1)(f)) — the measurement does not identify anyone | Aggregated; not stored at an individual level |
| Advertising identifiers | Displaying and measuring advertisements | Consent | According to the provider's own policy |
Using the site requires no registration, and we do not ask for your name, address, telephone number or payment details. There is no commenting feature.
3. Cookies
Cookies are small text files stored by your browser. They fall into three groups:
- Necessary cookies: to remember your consent decision. Without them the site could not honour your choice.
- Statistical cookies (Google Analytics 4): traffic measurement — which pages are read, for how long, from which device and browser. For visitors from the European Economic Area, the United Kingdom and Switzerland these cookies become active only after you consent: the measurement code starts in a Consent Mode state of “denied” and writes no cookie until then. In other countries — where no law requires a consent prompt — measurement runs with cookies under the default setting; you can stop that at any time in your browser's cookie settings.
- Advertising cookies: these may be set by Google AdSense and its partners.
On the pages of the children's collections (First Words, Ten, Bedtime) we carry out no cookie-based individual tracking: the Google Analytics measurement code does not run on those pages at all, because valid consent cannot be given there.
Cloudflare Web Analytics does run across the whole site, but it uses no cookies and creates no persistent identifier for you: it produces only aggregated, anonymous figures (views, approximate country, device type). It does not build a personal profile and does not combine the data with other sources. Because it neither stores nor reads anything on your device, this measurement may also run on the children's pages without consent.
You can change or withdraw your consent at any time in the consent management panel shown on the site, or by deleting cookies in your browser settings. (The consent management panel is shown to visitors from the European Economic Area, the United Kingdom and Switzerland.)
4. Advertising (Google AdSense)
Running the site is supported by revenue from the Google AdSense programme. Advertisements are served by third-party advertising vendors, including Google. These vendors may use cookies and similar technologies to serve advertisements based on your previous visits to this and other websites.
- You can turn off personalised advertising at any time in Google Ads Settings.
- For information about third-party vendors' use of cookies — and to opt out of personalised advertising — see www.aboutads.info.
- Google's own data processing is described in Google's privacy notice.
- For visitors from the European Economic Area, the United Kingdom and Switzerland, consent is collected through a consent management platform (CMP) certified by Google, before any advertising cookies are loaded.
- On the pages of the children's collections we display no advertising at all, and the advertising system's code is not loaded there either.
5. Read-aloud (text-to-speech)
Story and chapter pages offer a free read-aloud button. Where a recording exists, it is a pre-recorded narration generated with an artificial (AI) voice, served from our own server. The player fetches the audio file for the piece you listen to; that is an ordinary web request, so our server sees the visitor's IP address and basic browser data, exactly as it does for any page request. We set no cookie for it and build no profile from it.
- The recording was generated from the article's own text with the open-source Kokoro speech model. The voice is synthetic: it is not a recording of a real person, and no real person's voice was cloned.
- Seeking inside a recording uses HTTP range requests, so only the parts you actually play are transferred.
If no recording is available, or the recording does not match the current text, the page falls back to reading in your browser. First your browser's built-in speech voice does the reading: the text and the voice stay on your device, no data reaches us, and the service sets no cookie.
If your device has no voice for the language of the text, the browser would decide on our behalf and might even read in another language. In that case a client-side speech engine (Piper) downloads the necessary voice model, which speaks in the language of the text. That download starts only when you press the Read aloud button, happens once (about 60 MB), and the model stays in your browser's own storage.
- The fallback voice model and the related components are downloaded from the public content delivery services jsDelivr, HuggingFace and cdnjs. As usual, those requests contain the visitor's IP address and basic browser data; we set no cookie and read none.
- The spoken audio of the fallback is generated on your device and does not reach us.
- You can remove a downloaded fallback model at any time in your browser settings (by clearing site data).
6. Data processors
We use the following service providers to operate the site:
- Cloudflare, Inc. — hosting and content delivery (CDN), plus cookie-free, aggregated traffic measurement (Cloudflare Web Analytics)
- Google Ireland Limited / Google LLC — advertising (AdSense), consent management (CMP) and traffic measurement (Google Analytics 4)
- Newsletter provider — sending the newsletter (the provider's name will be updated here when the newsletter goes live)
Some providers may transfer data outside the European Economic Area. Such transfers take place under the safeguards required by the GDPR (standard contractual clauses, adequacy decisions).
7. Children
The site also publishes fairy tales and stories for young readers, but we do not collect personal data from children: there is no registration, no commenting and no sign-in. Under the age of 16 you may subscribe to the newsletter only with the consent of a parent or guardian. On the pages of the children's collections we display no advertising.
If we learn that we hold data from a subscriber under 16 without parental consent, we delete it without delay.
8. Your rights
Under the GDPR you may at any time request:
- information about what data we hold about you (Art. 15)
- rectification if we hold inaccurate data (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability in a machine-readable format (Art. 20)
- objection to processing based on legitimate interest (Art. 21)
You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., naih.hu) or with the supervisory authority in your place of residence.
9. Data security
The site is available over HTTPS, on an encrypted connection. Only the operator has access to personal data. We follow the principle of data minimisation: we collect only what is strictly necessary for the given purpose.
10. Changes to this policy
We amend this policy when necessary; the version in force is always available on this page, with its effective date. If a change is material, we will draw attention to it separately on the site.
11. Contact
For data protection questions or requests, write to hello@talesacross.com. We reply to enquiries within 30 days at the latest.