Privacy Policy

This Privacy Policy explains what AI Story Kit ("we", "us" or "our") collects when you use aistorykit.app (the "Service"), why we collect it, who we share it with, how long we keep it and the choices you have. It applies to visitors, people who use the Service without an account, and account holders.

The Service is operated by [Operator legal name], [Registered address]. We are responsible for the personal information described here. If you do not agree with this policy, please do not use the Service. Questions go to [email protected].

The short version

• We use your prompts and settings to write the stories, illustrations, narration and videos you ask for.
• We do not use your stories, prompts or images to train AI models.
• To create that output, we send your prompts to third-party AI providers that work for us.
• Items in your library are deleted after 7 days on a free account and after 180 days on a paid account. You can delete them sooner.
• We do not sell your personal information.
• Card details are entered on Stripe's checkout page and never reach our servers.
• To stop the free allowance being abused, we use cookies, a browser identifier and your IP address.

Information we collect

Your prompts and what we create from them

When you use the Service, we collect what you type and choose: your story idea or prompt, character names and descriptions, and settings such as genre, length, audience and art style. We also keep any edits you make, and any request to continue or rewrite a story.

We then store what the Service creates for you: story text, illustrations, character images, narration audio and videos. We also record each job: what kind of job it was, the credits it used, when it ran and whether it succeeded.

Account information

Accounts are created by signing in with Google. Google shares your email address, your name and your profile picture with us. We use them to create your account, show you who is signed in and answer support requests. We never receive your Google password.

Using the Service without an account

You can write a limited number of stories each day without an account. To count those free stories, we use a cookie, a browser identifier and your IP address, as described below. Stories written without an account are not saved to a library.

Payment information

Plans and credit packs are paid on a checkout page hosted by Stripe. Stripe collects your card or wallet details. We receive only what we need to run your purchase: a Stripe customer reference, the product you bought, the amount, the currency, the payment status and the dates of your billing period.

Device, usage and anti-abuse data

We collect some information automatically when you use the Service:

• Technical data: IP address, browser type and version, operating system, and the pages and requests your browser makes. These are recorded in our server logs.
• Browser identifier: an identifier calculated in your browser from its configuration by an open-source library. It is stored in a cookie for 30 days and sent to us so that the same browser cannot keep opening new accounts for extra free stories or credits. Nothing is sent to the library's maker.
• Security checks: if we see unusual activity, we may ask you to complete a Cloudflare Turnstile check. It collects signals from your browser to tell people from bots.
• Analytics: Google Analytics records how pages are used (pages viewed, time on page, approximate location, device and referring site) and whether key steps, such as a purchase, happened.

Messages you send us

If you email us, we keep your email address, the message and any attachments so that we can reply and keep a record of the request.

Writing about children and real people

Many people write stories for or about a child, for example a bedtime story with your child as the hero. Please share only what the story needs. A first name or a nickname is enough. Do not put a child's full name, home address, school or other identifying details into a prompt.

The same applies to other real people. Only include personal details about someone if you have the right to share them.

How we use your information

• To write stories and create illustrations, narration and videos from your prompts
• To create your account, keep you signed in and keep your library available until items are deleted
• To give out and meter credits and daily free stories
• To check prompts and output against our content rules
• To process payments, renew or cancel plans, and handle refunds and chargebacks
• To prevent abuse of the free allowance, fraud and attacks on the Service
• To answer support requests and send messages about your account or purchases
• To understand how the Service is used and fix problems, using analytics and error logs
• To meet legal, tax and accounting obligations and enforce our Terms of Service

We do not use your stories, prompts or images to train AI models.

Your prompts and output are checked by automated content filters. People do not read them as part of normal operation. Staff look at a specific item only when you ask for help with it, when we need to investigate abuse or a complaint, or when the law requires it.

Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Performance of a contract: creating your stories and media, running your account, metering credits and handling payments.
• Legitimate interests: preventing abuse and fraud, enforcing our content rules, keeping the Service secure, and understanding how it is used so we can improve it. We weigh these interests against your rights.
• Legal obligation: keeping payment and tax records and responding to lawful requests.
• Consent: where the law requires it for cookies or similar technologies. You can withdraw consent at any time.

Cookies and similar technologies

• Session cookie: keeps you signed in. Strictly necessary.
• Visitor ID cookie: holds the browser identifier described above for 30 days. Used only to count free use and prevent abuse.
• Local storage: keeps a copy of the same visitor ID in your browser.
• Google Analytics cookies: measure visits and usage. See how Google uses this data at policies.google.com/technologies/partner-sites.
• Google sign-in, Cloudflare Turnstile and Stripe checkout: these services may set their own cookies when you use them.

You can block or delete cookies in your browser settings. If you block the session cookie, you will not be able to sign in. If you block the visitor ID cookie, free use without an account may not work. You can opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout.

How we share information

We do not sell, rent or trade your personal information. We do not share it for cross-context behavioral advertising. We share it only in these cases:

• Third-party AI providers. We send your prompts and settings, and images the Service has already made for you, to AI providers that generate text, images, speech and video for us. They process this data to return the output to us.
• Other service providers that work on our behalf under contract and only on our instructions: cloud hosting, Cloudflare (content delivery, file storage and Turnstile), Stripe (payments) and Google (sign-in and analytics).
• Legal requirements: when we must comply with a law, court order or valid request from a public authority.
• Safety and rights: to investigate fraud or abuse, or to protect the rights, property or safety of our users, the public or us. Content that sexualizes minors is reported to the relevant authorities.
• Business transfers: as part of a merger, acquisition or sale of assets. This policy continues to apply to your information in that case.
• With your consent for any other purpose we tell you about first.

We do not publish your stories or show them to other users. Content only becomes visible to others if you share it yourself.

How long we keep information

• Stories, illustrations, narration and videos in your library: deleted 7 days after they are created on a free account, and 180 days after they are created on an account with a plan or a credit pack. You can delete an item from your library at any time, which removes its files straight away.
• Stories written without an account: not saved to a library. Copies on our servers are deleted within 7 days.
• Job records (job type, credits, status, no story text or media): kept while your account exists, so your credit balance and purchases can be checked.
• Account information: kept until you ask us to delete your account.
• Payment and invoice records: kept for as long as tax and accounting law requires, even after the account is deleted.
• Anti-abuse data: IP-based counters expire within a day. Browser-identifier counters expire within 30 days.
• Server logs and support emails: kept only as long as needed for security, troubleshooting and handling your request.

A deleted file can stay in content delivery caches for a short time afterwards. Download anything you want to keep before it expires.

How we protect information

All traffic to the Service uses HTTPS. Files are stored under random names that cannot be guessed, and the Service shows their links only to the account that created them. Anyone you pass a link to can open the file, so share links with care.

Access to production systems is limited to the people who need it. Payment notifications from Stripe are verified with signatures.

No method of sending or storing data is completely secure, so we cannot guarantee absolute security. We will notify you and the relevant authorities of a breach where the law requires it.

Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your information and your account
• Receive a copy of your information in a portable format
• Object to or ask us to restrict certain processing
• Withdraw consent where we rely on it
• Complain to your local data protection authority

You can delete items in your library yourself. For everything else, email [email protected] from the address on your account. We may need to confirm your identity before acting, and we will reply within 30 days. We will not treat you differently for exercising these rights.

California residents have these rights under the CCPA. We do not sell or share personal information as those terms are defined there.

Age requirement

The Service is for people who are at least 18 years old. Stories for children are meant to be created by a parent, guardian, teacher or other adult, who then reads or shares them with the child. Children should not use the Service themselves.

We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a minor has used the Service, please contact [email protected].

International data transfers

We and our service providers, including our AI providers, process information in several countries. These may include the United States and other countries outside the one you live in, and their data protection laws may differ from yours.

When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

Third-party links and services

The Service links to other websites and uses Google sign-in and Stripe checkout. Those companies handle the data you give them under their own privacy policies, which we encourage you to read. We are not responsible for their practices.

Changes to this Privacy Policy

We may update this policy as the Service or the law changes. We will post the new version on this page and change the "Last updated" date. If a change materially affects how we use your personal information, we will also tell account holders by email or on the Service before it takes effect.

Contact us

For questions about this policy or to exercise your rights, email [email protected]. You can also read our Terms of Service and Refund Policy.

[Operator legal name] [Registered address]