Bedtime Stories is a sibling-aware story app for the two sisters in the household. Sibling-aware narration, a parent dashboard, push at bedtime, and a hard privacy boundary at the LLM call. Built for one family. Architected for many.
Every night, the same request. A story. Not a story from a book — a story with the two sisters in it, by name, doing something together.
The parent was already building with LLMs for a living. The children were already asking for something the parent had the tools to make. The product wrote itself into existence.
A problem in the operator's own house became a model for a broader question: what does a tender, privacy-respecting LLM consumer product actually look like when the end user is a child?
The answer is not a chatbot with a softer tone. It is a narrow product that does one thing beautifully, stores personal details on the family's own device, and never hands a child's name or likeness to a model vendor. The LLM sees pseudonyms and themes. The household sees the finished story.
Sibling-aware narration is the core mechanic. Every story addresses both sisters by name, weaves both into the plot, and alternates whose perspective leads from one chapter to the next. Neither child is ever the sidekick two nights in a row.
The parent dashboard is the control surface. Characters, themes, tone, reading level, and bedtime schedule are all editable. A review log shows what the children have heard and when. Audio narration is optional, per-story, with a locked narrator voice per family.
The PWA is offline-first. A service worker caches the evening's story so bedtime is never held hostage by a flaky connection. Push arrives at the household's configured time, and the story is already on the device when the child taps the notification.
Personalization lives in Postgres, scoped per-tenant. Names, ages, favorite characters, and reading history are stitched into a prompt on the server, pseudonymized at the boundary, and only the sanitized version crosses the wire to GPT-4o. The model returns a narrative; the server rehydrates the real names before rendering.
Characters, themes, audio profiles, and parent controls are all per-tenant from day one. The product happens to have one household in production. It could have a thousand tomorrow without a schema change.
The product is live. Stories are delivered on schedule. The two sisters are the nightly QA team, and the parent dashboard surfaces what worked and what did not. Iteration is quiet and continuous.
The deeper result is architectural. A tender consumer surface, a strict privacy boundary, a multi-tenant spine, and a cadence the household actually keeps. It is the shape most small LLM products should take, and most do not.
Offline-first PWA, per-tenant personalization in Postgres, pseudonymization at the LLM boundary, scheduled push for delivery.