Story Maker ("we", "us", "our") operates the website at story-maker.io and the Story Maker application, which creates personalised AI-generated stories for children. Story Maker is an independent service.
For privacy enquiries, contact us at support@story-maker.io.
You must be at least 18 years old to create a Story Maker account. By creating an account you confirm that you are an adult. If we become aware that an account has been created by a minor, we will close it and delete associated data.
Account holders may create child profiles within their account. A child profile contains:
This information is stored under the adult account holder's account. Children do not interact directly with our service or provide data to us.
The Children's Online Privacy Protection Act (COPPA) applies to the online collection of personal information from children under 13 in the United States. Because Story Maker collects information only from adult account holders — not from children — COPPA's verifiable parental consent requirements do not apply to our collection practices. Parents who wish to review, modify, or delete child profile data may do so at any time from within their account or by contacting us.
Under the UK and EU General Data Protection Regulation, special care applies to data relating to children. We limit the child profile information we store to what is strictly necessary to operate the service, and we do not use it for marketing, profiling, or any purpose other than delivering the story service to the account holder.
| Category | Examples | Why we collect it |
|---|---|---|
| Account information | Email address, password (hashed) | To create and secure your account |
| Child profiles | Display name, age group, avatar | To personalise stories appropriately |
| Story inputs | Answers to the five story questions (hero, adventure, etc.) | To generate your story |
| Saved stories | Story text, illustration URL, audio URL | To populate your story library |
| Support messages | Emails to support@story-maker.io | To respond to your enquiry |
| Category | Examples | Why |
|---|---|---|
| Usage data | Story generation count, plan type, timestamp | To enforce free tier limits and improve the service |
| Authentication tokens | Session tokens (via Supabase Auth) | To keep you logged in securely |
| Payment status | Subscription plan, renewal date (not card details) | To unlock premium features |
We do not collect your IP address for profiling purposes, use advertising trackers, or track you across other websites.
We use your information to:
Legal bases (GDPR): We process your data on the basis of contractual necessity (to provide the service you signed up for), legitimate interests (security, fraud prevention, service improvement), legal obligation, and — for marketing communications — your explicit consent.
We share data only with the following service providers, each under appropriate data processing agreements:
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, profiles, stories, audio and illustration files | supabase.com/privacy |
| Stripe | Payment processing | Email address, subscription status. Card details are held by Stripe — we never see them. | stripe.com/privacy |
| Anthropic | AI story generation | Story inputs (five questions) and the prompt we build from them. No account data. | anthropic.com/privacy |
| ElevenLabs | Voice narration | Story text (to convert to audio). No account data. | elevenlabs.io/privacy |
| Prodia | Story illustrations | Image generation prompts derived from the story. No account data. | prodia.com/privacy |
| Resend | Transactional email | Your email address and story content (when you email a story) | resend.com/privacy |
We may also disclose data if required by law, court order, or to protect the rights and safety of users or the public.
Payments are processed by Stripe, Inc. We never receive, store, or have access to your full payment card details. Stripe handles all card data and is PCI-DSS Level 1 compliant.
We receive from Stripe only:
By purchasing a Premium subscription you agree to Stripe's Privacy Policy and Services Agreement.
We retain your data for as long as your account is active. Specifically:
When you delete your account, we delete all personal data within 30 days, except where we are legally required to retain it (e.g. payment records).
Depending on where you live, you have the following rights over your personal data:
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate data |
| Erasure | Ask us to delete your data ("right to be forgotten") |
| Restriction | Ask us to stop processing your data in certain ways |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Where processing is based on consent, withdraw it at any time |
California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of sale (we do not sell data). To exercise these rights, contact us at support@story-maker.io.
To exercise any of these rights, email us at support@story-maker.io. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
We use a minimal number of cookies, all strictly necessary to operate the service:
We do not use advertising cookies, analytics cookies, or third-party tracking cookies. We do not use Google Analytics or Meta Pixel.
We take reasonable technical and organisational measures to protect your data, including:
No method of transmission over the internet is 100% secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and relevant authorities as required by law.
Story Maker's infrastructure is primarily hosted in the United States (Supabase, Vercel). If you are located in the UK or EU, your data may be transferred to and processed in the United States. Such transfers are governed by appropriate safeguards including Supabase's Standard Contractual Clauses and Stripe's EU–US Data Privacy Framework certification.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (at the address on your account) and update the "Last updated" date at the top of this page. Continued use of Story Maker after changes take effect constitutes acceptance of the updated policy.
For privacy questions, data requests, or complaints:
We aim to respond to all privacy enquiries within 5 business days and to fulfil data requests within 30 days.