Privacy Policy

1. Scope and roles

This policy covers the Storyable service. It does not cover third-party sites you reach by following a link.

For residents of California this page is also our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). See the California section below.

Storyable is operated as a North American beta, and the service and its data are hosted in the United States.

2. Information we collect

Account information: your email address, display name, public handle, profile text, profile image, and — if you sign in with Google — the stable Google account identifier. If you set a password we store only a hash of it, never the password itself.

Age verification: the date of birth you submit and the time we recorded the check. We keep this even when the check fails, because otherwise a failed check could simply be repeated with a different date.

Consent records: the date and time you accepted the Terms of Service.

Content you create: stories, characters, prompts, story configuration, uploaded images and audio, and imported source documents and transcripts.

Play data: the messages you send during a play session, the model responses, which model was used, and the tokens and credits each turn consumed.

Usage and device data: IP address, user agent, request paths, timestamps, and error diagnostics. Our network provider derives an approximate country and region from your IP address; we use that only to apply regional restrictions on adult content.

Beta access data: an invite code you redeem, or the email address you give us to join the waiting list.

3. Where the information comes from

Directly from you, when you sign up, create content, or play a story.

Automatically, from your device and our servers as you use the service.

From Google, if you choose to sign in with Google. We receive your Google account identifier, your email address, whether Google has verified that address, and your name. We do not receive your Google password.

4. How we use it

To create and run your account and to authenticate you.

To operate the service: to store your drafts, publish what you publish, and generate story turns and images.

To meter usage and enforce credit limits.

To enforce our Content Policy and Terms, to investigate reports, and to prevent abuse and fraud.

To restrict adult content by age and by region, which is why we collect a date of birth and an approximate region.

To fix problems, measure reliability, and improve the service.

To contact you about your account and about changes to the service.

To comply with the law and respond to lawful requests.

We do not use your personal information for advertising, and we do not run third-party advertising trackers.

5. Third-party AI processing

Generating a story turn, an image, or a transcript requires sending content to a model provider. This is the most consequential disclosure in this policy, so it has its own section.

What we send: the story or character configuration, the recent conversation in that session, the message you just sent, and any persona or note you attached to the session. For transcription we send the audio you uploaded.

Who receives it, depending on the feature and the model selected:

• Anthropic (Claude models) — creation assistance and play turns;
• Moonshot AI (Kimi models) — creation assistance, where configured as the creation model;
• Amazon Web Services (Amazon Bedrock) — play turns on the 19+ model, which is an xAI Grok model served through Bedrock, and the input safety filter applied to those turns;
• Google (Gemini) — image generation;
• OpenAI, or an OpenAI-compatible transcription endpoint we configure — speech to text for audio you import.

We do not send your email address, password hash, or date of birth to model providers.

Each provider processes the content under its own terms and privacy policy. We choose providers that offer business terms, but we cannot control their internal practices, and this is a real transfer of your content to another company. If that is not acceptable to you, do not put that content into Storyable.

We do not train our own models on your content.

6. Who else we share information with

Model and media providers, as described in the previous section.

Hosting and infrastructure providers, who run our servers, database, and object storage in North America.

Content delivery and network security providers, who terminate connections and give us the approximate country and region of a request.

Email delivery providers, for account email such as sign-in and account recovery.

Error monitoring and product analytics providers, where enabled, with personal data scrubbing on.

Law enforcement and other authorities, when we are legally required to respond, or where content involving the sexual exploitation of minors requires a report.

A successor entity, if Storyable is acquired or merged. We will say so before your information becomes subject to a different policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. How long we keep it

Account information: while your account exists. After you ask us to delete it we remove or anonymise it within 30 days, except where the law requires us to keep something longer.

Content and play data: while your account exists, or until you delete the item. Deleting a published work removes it from the service; other users may still hold transcripts of sessions they already played.

Age verification and consent records: for the life of the account and for up to two years after deletion. These are the records that show we applied the age gate and obtained agreement.

Server and access logs: up to 90 days.

Database backups: up to 7 days, after which deleted data ages out of the backup set as well.

Waiting list emails: until the beta ends, or until you ask us to remove yours, whichever comes first.

8. Cookies and local storage

We use the following, all first-party and all necessary to run the service:

• acs-locale — the display language you chose;
• acs-authed — whether a session exists, so the page can render the right navigation;
• acs_oauth_state — a short-lived value that protects the Google sign-in round trip;
• your theme preference and your session token, kept in your browser's local storage rather than in a cookie.

We use no advertising or cross-site tracking cookies. Because of that we have no advertising signal to honour and no advertising opt-out to offer.

9. Security

Passwords are stored as Argon2 hashes. Sessions use signed tokens. Traffic is served over TLS in production, and our database is not exposed to the public internet.

No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant authorities as the law requires.

If you find a vulnerability, please tell us at support@brnd.company before disclosing it publicly.

10. Children

Storyable is not directed to children. You must be at least 13 years old to hold an account, and we do not knowingly collect personal information from anyone under 13, consistent with the Children's Online Privacy Protection Act (COPPA).

If we learn that we hold information from a child under 13, we delete the account and the information.

Content rated 19+ is additionally restricted to age-verified adults aged 19 or older, and to regions where we can serve it.

A parent or guardian who believes a child under 13 has given us information should write to support@brnd.company and we will delete it.

11. California privacy rights (CCPA/CPRA)

This section applies to California residents and is our notice at collection.

Categories of personal information collected in the last 12 months, using the statutory categories:

• Identifiers — email address, display name, handle, account identifier, Google account identifier, IP address;
• Personal information under Cal. Civ. Code 1798.80 — the same account details;
• Characteristics of protected classifications — date of birth, collected only for age verification;
• Commercial information — credit balance and consumption records;
• Internet or network activity — request logs, pages visited, feature usage;
• Geolocation data — approximate country and region derived from IP address, not precise location;
• Audio and visual information — images and audio you upload;
• Other information you provide — the story, character, and play content you create.

Purposes: to provide and secure the service, to meter usage, to enforce age and content rules, to fix problems, and to comply with the law. Every category above is collected for those purposes.

Sensitive personal information: we do not collect it in order to infer characteristics. Date of birth is used only to decide whether you meet the age threshold, so there is nothing to limit under the right to limit the use of sensitive personal information.

Sale and sharing: we have not sold personal information and have not shared it for cross-context behavioural advertising in the last 12 months, and we do not do so today.

Your rights: to know what we collect and why, to access a copy, to correct inaccurate information, to delete it, and not to be discriminated against for exercising any of these.

How to exercise them: email support@brnd.company from the address on your account, or write from another address and tell us which account you mean. We verify you by confirming control of the account email, and for deletion we may ask you to confirm twice. We respond within 45 days and may extend once by a further 45 days, telling you why.

Authorised agents: an agent may submit a request with written permission signed by you. We may still verify you directly.

Retention: see the section on how long we keep information, above.

12. Your rights elsewhere

Wherever you live, you may ask us for a copy of your personal information, to correct it, to delete it, or to stop a particular use. In Korea these correspond to the rights under the Personal Information Protection Act; in the EEA and the United Kingdom, to the rights under the GDPR.

You can also edit your profile and delete your content directly in the product.

If you think we have handled your information badly, tell us first at support@brnd.company. You may also complain to your local data protection authority.

13. Making a request

Send access, correction, export, and deletion requests to support@brnd.company.

Tell us what you want and which account it concerns. Write from the account email if you can — it is the fastest way for us to verify you.

Deletion removes your account, your drafts, and your published works. It cannot recall copies other users already downloaded or exported, and residual copies age out of backups within 7 days.

We acknowledge requests promptly and complete them within 30 days, or within 45 days for CCPA requests as described above.

14. International transfers

Storyable runs in the United States. If you use it from another country your information is transferred to and processed in the United States, and by the model providers listed above, which may process it in other countries.

Those countries may not protect personal information the way your own does. Where a transfer from the EEA, the United Kingdom, or Korea requires a legal mechanism, we rely on standard contractual clauses or the equivalent instrument offered by the provider.

15. Changes to this policy

We update this policy when our practices change. The date at the top of this page always reflects the current version.

For material changes — a new category of data, or a new kind of recipient — we give notice in the product before the change takes effect.

16. Contact

Privacy questions, data requests, and California requests: support@brnd.company

Other legal matters: support@brnd.company