Legal

Privacy Policy

Your story is yours. This page explains exactly what we collect, why, who we share it with, and what control you have. No dark patterns, no buried clauses.

Last updated: 11 June 2026

1. The short version

  • We collect what we need to run the Service for you, and nothing else.
  • We do not sell your data. We do not run ads. We do not use your story to train third-party AI models.
  • You can export your stories at any time. You can delete your account at any time.
  • If you want to know exactly what we hold about you, write to [email protected] and we will tell you.

2. Who is responsible for your data

StoryStepper Limited, a company incorporated in Hong Kong with its registered office at Room 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong, is the data controller for personal data processed through the Service. You can reach us at [email protected].

3. What we collect

You give us

  • Account info: your email address, your chosen display name, and (if you use a password) a hashed password. If you sign in with Apple or Google, we receive the email address and account identifier the provider chooses to share.
  • Your story inputs: the kind of story you want, the protagonist's name, the genre and tone you pick, and the choices you make at each chapter.
  • Reading-circle info: the email addresses you invite to a circle, and the messages you send through the Service. If you invite someone, we use their email address only to deliver and manage the invitation; the invitation explains who invited them and links to this policy, and if they do not accept, we delete their address within 30 days.
  • Support messages: anything you write to us when you ask for help.

We generate from your inputs

  • The chapters of your story, the optional character poster, and any other generated artefacts.
  • Your ember balance and history of how you spent embers.

We collect automatically

  • Reading activity: which chapter you read last, when you opened it, whether you reweaved a choice, whether you lit an episode. We use this to deliver chapters at the right time and to keep continuity.
  • Device and log data: approximate IP address (for security and abuse prevention), browser or mobile platform, app version, and crash diagnostics.
  • Cookies and similar: session cookies so you stay logged in, preference storage for things like language, and product analytics storage to understand app usage. Where applicable law requires consent for analytics storage, we ask for it. We do not use third-party advertising cookies.

4. Why we use it (and the legal basis)

  • To write your story and run the Service — contract.
  • To send the morning chapter, billing receipts, account notifications — contract.
  • To prevent abuse, fraud, and keep the Service secure — legitimate interest.
  • To improve the Service — legitimate interest, using aggregate and de-identified data only.
  • To measure how the app is used (analytics cookies and storage) — your consent where applicable law requires it; otherwise legitimate interest, using privacy-respecting tools.
  • To send occasional product news — your consent. You can opt out from any email or in settings.
  • To comply with law — legal obligation.

5. Who we share it with

We share personal data only with the small set of vendors who help us run the Service. Each one is bound by a written contract that limits what they can do with the data.

  • Cloud hosting and storage — for running the application and storing your stories.
  • Language-model provider(s) — your story prompts and the rolling context of your story are sent to a third-party large-language-model API to generate the next chapter. We use providers who contractually agree not to retain your inputs or use them to train their models.
  • Image-generation provider — used only when you ask for a character poster, under the same no-training terms.
  • Payment processors — Apple, Google, or Stripe handle your payment details depending on where you subscribed. We never see your full card number.
  • Email and notification delivery — to send the morning chapter and account emails.
  • Analytics and crash reporting — privacy-respecting tools such as PostHog, configured for product analytics rather than advertising.

We do not sell, rent, or share your personal data with advertisers. We do not share with anyone for cross-context behavioural advertising.

6. Where your data is stored, and international transfers

StoryStepper Limited is incorporated in Hong Kong, but we do not store your personal data in Hong Kong: our servers and data storage are located in the European Economic Area and the United States. The privacy law that primarily governs us is the Hong Kong Personal Data (Privacy) Ordinance (PDPO); we have no establishment in the European Union or the United Kingdom, but we welcome readers from the EU, the UK, and elsewhere, and we aim to follow GDPR principles as good practice for everyone. Depending on where you live, your data may therefore be processed outside your own country. When personal data moves between regions — for example, between the EEA and the United States — we take reasonable steps to keep it protected, including contractual safeguards with our vendors (such as the EU Standard Contractual Clauses where appropriate).

7. How long we keep it

  • Account data: for as long as your account is open.
  • Stories, chapters, posters: until you delete them, or until you delete your account.
  • Reweave history: declined chapters are deleted when the reweave is committed, in line with how the feature is designed.
  • Backups: retained for up to 30 days after deletion, after which they are purged.
  • Billing records: retained for as long as required by tax and accounting law (typically 6–7 years).
  • Security logs: typically 90 days, longer where needed for an open investigation.

8. Your rights

Depending on where you live, you have some or all of the following rights:

  • Access — get a copy of what we hold about you.
  • Correct — fix anything that is wrong.
  • Delete — close your account and have us erase your personal data.
  • Export — download your stories and account data in a portable format.
  • Object — tell us to stop using your data for a specific legitimate-interest purpose.
  • Withdraw consent — where we asked for it, you can change your mind at any time.
  • Complain — to your local data-protection authority (in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD); in the UK, the ICO; in the EU, your national authority; in California, the California Privacy Protection Agency or the Attorney General).

To use any of these rights, write to [email protected]. We aim to respond within 30 days.

9. Children

StoryStepper is an 18+ service. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, write to us and we will delete it.

10. Security

We protect your data with industry-standard measures: encryption in transit (TLS) and at rest, restricted internal access, separate environments for development and production, regular dependency review. No system is perfectly secure; if a breach affects you, we will tell you without undue delay and explain what to do.

11. Changes to this policy

When we change this policy, we update the "Last updated" date at the top. If the change is material, we will tell you by email and inside the app at least 30 days before it takes effect.

12. Contact

For privacy questions: [email protected].
For everything else: [email protected].