Privacy Policy

This policy describes what information StoryInk collects when you use the service, how we use it, who we share it with, and what choices you have. We have tried to write it in plain English. If anything is unclear, email help@storyink.com.

1. What we collect

• Account info. Your email address and password. Authentication is handled by Supabase Auth — passwords are hashed by Supabase before storage; we never see, log, or store the plaintext.
• Character info. Names, photos, traits, quirks, and any other details you enter when creating a character (a person or a pet).
• Story content. The one-line ideas you write, the generated stories, the AI Assistant prompts you send, and any per-story system prompts you save.
• Order info. If you buy a hardcover, we collect the shipping address you enter at checkout and record the Stripe session and order status. We never see or store your card number — Stripe processes the payment and we receive only a charge identifier and metadata you provided.
• Usage telemetry. Basic information about page visits and errors, used to keep the service running and to debug problems. We do not maintain advertising profiles.

2. How we use it

• To generate the stories you ask for. Your prompt text and pet reference photos are sent to Google Gemini at generation time so the model can produce the story and illustrations.
• To process and ship hardcover orders.
• To respond when you contact help@storyink.com or use the in-app support chat.
• To debug and improve the service, including diagnosing errors and tuning the AI prompts we send to Gemini.
• To send transactional email (order confirmations, fulfillment updates). We do not send marketing email without a separate opt-in.

3. Third parties we share data with

We share data only with the providers we need to run the service. Each operates under its own privacy policy.

• Supabase — hosts our database (Postgres), authentication, and file storage (your uploaded photos and generated illustrations live here).
• Google Gemini — receives your prompt text and reference photos at generation time and returns the story text and illustrations. We use the paid Gemini API tier.
• Stripe — processes payments. Stripe receives your card details directly (we never see them); we only receive a session identifier, a charge identifier, and the shipping address you provided at checkout.
• Resend — delivers transactional email (order confirmations, shipping updates) on our behalf.
• Crisp— powers the live-chat support widget. The chat loads only after you accept optional cookies or click a "Start a live chat" button; Crisp then receives your messages, and — if you are signed in — your email address and basic account facts (credit balance, story count, latest order status) so we can help without asking for them.
• Sentry — receives error reports if we have a Sentry DSN configured. Reports may include the page URL, error message, and stack trace; we try not to attach personal content but exceptional cases may include fragments of error context.
• PostHog — product analytics. Receives usage events (pages viewed, steps completed) only after you accept optional cookies, and receives operational events described in section 4 regardless, because those are necessary to run the service.
• Google — advertising measurement, only if you accept optional cookies. Google receives the fact that you visited and which pages, so we can tell which of our ads work. See section 4.

We do not sell personal information. We share data with the advertising networks named above only where you have accepted optional cookies, and only for measuring and targeting our own ads — never for anyone else’s.

4. Cookies and similar technology

We use a small number of strictly necessary cookies, which are set regardless of your banner choice:

• Supabase auth cookies — keep you signed in across page loads. Without these, the service does not work.
• Cookie consent preference — stores your choice on the cookie banner so we do not show it on every visit.

If you press Accept on the cookie banner, we additionally set optional cookies for analytics and advertising:

• Analytics — PostHog, to understand which parts of the site people use.
• Advertising — the Google Ads tag, which lets us measure whether one of our ads led to a visit. We do not send your email address, hashed or otherwise, to any advertising network.

None of these load until you accept. If you press Reject, or simply ignore the banner, no analytics or advertising cookie is set and nothing is sent to Google. You can change your mind at any time using the Cookie settings link in the footer; withdrawing consent stops any further sharing, though it cannot retract data already sent.

Separately from optional analytics cookies, we record operational events needed to run the service — order status, payment confirmation, system failures, and service-delivery events such as story generation, AI-assisted editing, and PDF delivery. These are tied to your account, are not used for advertising, and are retained as part of your order history.

5. Your rights and choices

• Access and export. The Account page includes a self-serve export of your data — pets, stories, and order history — so you can download a copy at any time.
• Correction. You can edit pets, stories, and individual pages directly inside the app.
• Deletion. You can delete your account from the Account page. Deletion cascades through your characters, stories, and generated content. For tax and audit reasons we retain anonymized order records (no name, no email, no shipping address) tied to the original Stripe charge.
• Withdraw consent. You can stop using the service at any time. Deleting your account is the most complete way to withdraw consent.
• Depending on where you live (EU/UK, California, and other jurisdictions with similar laws) you may have additional statutory rights — to object to certain processing, to restrict processing, to receive your data in a portable format, and to lodge a complaint with a regulator. Email help@storyink.com and we will respond within thirty days.

6. Retention

• Pets, stories, and generated content are kept as long as your account exists. They are removed when you delete a pet, a story, or your whole account.
• Order records are retained for tax and audit purposes. When you delete your account, your name, email, and shipping address are removed from the order record; the order id, amount, and Stripe charge id remain for accounting.
• Operational logs (error traces, request logs) are kept for short retention windows by the providers above and are not exposed back to us beyond what we need to diagnose problems.

7. International data transfers

StoryInk is operated from the United States. Our infrastructure runs on Supabase, Stripe, Google Gemini, and Resend, which may process data in the US and other jurisdictions. If you are using the service from outside the US, you are agreeing to your data being processed in those locations. We rely on the contractual protections each provider offers (standard contractual clauses where applicable) for transfers out of the EU/UK.

8. Children

StoryInk is intended for adults who create stories for and about themselves, their families, and their pets. You must be at least thirteen years old to hold an account. The stories themselves are designed to be enjoyed by children of any age, with adult supervision; the account that creates and pays for them is held by an adult or older teen.

9. Security

We use industry-standard practices: transport encryption (HTTPS) on all traffic, row-level security in our database so users can only see their own data, server-only secrets kept out of the browser bundle, and limited access controls on infrastructure. No system is perfectly secure. If you suspect a breach affecting your account, email help@storyink.com.

10. Governing law

This policy and any dispute about how we handle your personal information are governed by the laws of the State of Washington, without regard to its conflict-of-laws principles. Any such dispute will be brought in the state or federal courts located in King County, Washington, and you consent to the personal jurisdiction of those courts — except where the data-protection or consumer-protection law of your home jurisdiction gives you the right to sue or complain locally.

11. Changes to this policy

We may update this policy as the product evolves. Material changes will be announced inside the app. The “Last updated” date at the top of this page is bumped whenever the text materially changes.

12. Contact

Questions, requests, or complaints: help@storyink.com.