Privacy

Who is responsible

Edward Peter Nordby-Graves, operating Storytime from Denmark, is the data controller. For privacy questions or to exercise your rights, email privacy@mystorytime.org.

What we use and why

• Account data: your email address, password hash, session information, and password-reset token hashes, to create and secure your account.
• Book data: family memories, names, ages, relationships, descriptions, and the finished story and illustrations, to create, show, refine, and store your book.
• Reference photos: if you provide them, we use them to create a character reference for that book. Before upload, you must confirm that you are a parent, guardian, or otherwise authorised to provide the photo.
• Service and security data: limited records of requests, estimated AI usage and cost, and security-related information needed to run, protect, and troubleshoot the service.

We use data needed to provide the service you request and take steps at your request before providing it. We also rely on legitimate interests to keep Storytime secure, prevent abuse, and operate the service. We do not sell personal data or use it for advertising.

AI providers and other processors

The story text and illustrations in your book are generated by AI, from what you tell us.

Storytime uses Anthropic to help write the story; OpenAI’s GPT model, run by Microsoft Azure in Europe and reached through OpenRouter, to lay the story out into pages and write the instructions each picture is drawn from; OpenRouter to create illustrations, using a model run by BytePlus, ByteDance’s cloud service; Google Cloud / Gemini to describe reference photos and finished illustrations, such as a character’s hair and skin tone, or where the people in a picture are; Postmark to send transactional email; and Hetzner to host the service and encrypted backups. We use paid services for the AI processing.

To create an illustration, OpenRouter and BytePlus receive the descriptions, names and ages for that picture, any reference photos, and the illustrations being made or changed. OpenRouter does not use them to train models and does not keep images beyond passing them on, except where it needs them for abuse detection, security, billing or legal compliance; we have its request logging turned off. It sends our requests only to providers it lists as keeping no data, which BytePlus is.

To lay out the book and plan its pictures, OpenRouter and Microsoft Azure receive the story, the names and ages of the people in it, and what they wear in it; when you refine a page, they also receive the change you asked for. They never receive photographs. Azure processes them in Europe and keeps nothing; OpenRouter sends these requests only to that service, never to another, and does not use them to train models.

To help a character look the same on every page, Google receives that character’s reference photos once, together, and describes only the stable features needed to draw the same person again: hair, skin tone, eye colour, face shape, and visible features such as freckles or glasses. It is not asked about gender, ethnicity, nationality, age, personality or clothing, and anything like that in its answer is removed. We keep the description only while the book’s pictures are being made, then delete it.

Anthropic, Google, OpenRouter and Postmark may process data outside the EEA, under their data-processing terms with Storytime, which use transfer safeguards such as EU standard contractual clauses or recognised transfer frameworks. BytePlus has no contract with Storytime: it receives our requests from OpenRouter, under its own agreement with OpenRouter, and does not publish where it processes them. Microsoft has no contract with Storytime either: it receives our requests from OpenRouter, under its own agreement with OpenRouter, and processes them in Europe.

We do not enable Postmark open or link tracking. Reference photos are sent only to OpenRouter, BytePlus and Google, never to Anthropic or Microsoft, which help write and lay out the story.

How long we keep data

• We keep your account and books saved to your Library until you delete them or delete your account.
• We delete a book not saved to a Library after 30 days without activity.
• We delete uploaded reference photos after the character reference has been created. The resulting book illustration may remain with the book until you delete it.
• Password-reset links expire after one hour and sessions expire after 30 days.
• Encrypted backups can retain deleted book data for up to seven daily backup cycles before it is removed from the backup repository.
• When you delete an account, we remove the account and its books. Aggregated usage and cost records remain without the account identifier or book content.

Your choices and rights

You can delete books and your account in Storytime. You may also ask us for access, correction, deletion, restriction, objection, or portability where these rights apply. Email privacy@mystorytime.org. We will normally respond within one month.

If you are unhappy with our handling of your data, you can complain to the Danish Data Protection Agency (Datatilsynet), or to your local EEA supervisory authority.

Changes to this notice

We may update this notice as Storytime changes. We will post the revised version here and update the date above.