Privacy Policy
YourStory: Your Romance
Effective date: [EFFECTIVE DATE]
Last updated: [EFFECTIVE DATE]
This Privacy Policy explains how StoryForge Consulting Ltd (“StoryForge”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use the “YourStory: Your Romance” mobile application, the website at example.com, share links and related services (together, the “Service”). It also explains your rights and how to exercise them.
Please read this Policy together with our Terms of Use and our Cookie Policy. Capitalised terms not defined here have the meaning given in the Terms of Use.
1. Summary
| Topic | In short |
|---|---|
| Who is responsible | StoryForge Consulting Ltd, Cyprus (HE 494506), is the data controller. |
| What we collect | Account details, your story preferences and questionnaire answers, character descriptions, your fantasy prompt, optional profile photo, the stories we generate for you, reading activity, purchase status, device and usage data. |
| Sensitive information | Some of your answers may reveal information about your romantic or sexual preferences. We treat this as special category data and process it only with your explicit consent, which you can withdraw at any time. |
| Why | To create and deliver your personalised stories, run your account and subscription, enable sharing and the public library, keep the Service safe, comply with the law and improve the Service. |
| AI | Your inputs are sent to AI model providers to generate text, images and video. We do not allow them to use your data to train their general models where we can contractually prevent it. |
| Selling data | We do not sell your personal data. |
| Your rights | Access, correction, deletion, portability, objection, restriction and withdrawal of consent. You can complain to the Cyprus Commissioner for Personal Data Protection or your local authority. |
| Age | The Service is for adults aged 18 and over only. |
| Contact | privacy@example.com or our Data Protection Officer at dpo@example.com. |
2. Who we are
The data controller responsible for your personal data is:
StoryForge Consulting Ltd
Registration number HE 494506, Republic of Cyprus
Registered office: [REGISTERED OFFICE ADDRESS, CYPRUS]
Email: privacy@example.com
Data Protection Officer: [DPO NAME OR SERVICE PROVIDER], dpo@example.com
We process personal data in accordance with the EU General Data Protection Regulation 2016/679 (“GDPR”), the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018), the Cyprus law on electronic communications, and, where applicable, the UK GDPR, the laws of the United States and other applicable data protection laws.
3. The personal data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Account data | Email address, password (stored in hashed form by our authentication provider), display name, language, account settings, and your name and email if you use Sign in with Apple or Google. If you use Apple’s “Hide My Email”, we receive a relay address. |
| Personalisation data | Preferred genres, favourite authors, reading preferences, answers to the relationship and personality questionnaire (including slider values), zodiac sign, your hero’s gender, age and description, your love interest’s gender, age and description, your fantasy prompt, and your answers when creating additional stories. |
| Profile photo | A photo you choose to upload (optional). |
| Content data | The stories, chapters, titles, summaries, story “bible” (continuity notes), prompts assembled from your inputs, images, covers, video highlights and share cards generated for you. |
| Reading data | Reading progress, chapters opened and completed, bookmarks, search queries within the reader, font and theme settings, preferred reading time. |
| Social data | Books and chapters you share, share links you create, whether sharing is active, books you publish or unpublish, books you save from Explore, chapter ratings, book reviews and ratings. |
| Referral data | Partner codes you enter at registration, the share link through which you arrived, and (if you are a Partner) your partner code, status and the aggregated performance of your referrals. |
| Support and feedback data | Messages, issue reports, content reports, complaints, appeals, feedback, screenshots or files you attach, and our replies. |
| Consent and preference records | Your consents (for example to special category processing, notifications and cookies), your acceptance of the Terms of Use, and marketing preferences. |
3.2 Data we collect automatically
| Category | Examples |
|---|---|
| Device and technical data | IP address, approximate location derived from IP (country or city level), device model, operating system and version, app version, language, time zone, screen settings, and device and app instance identifiers. |
| Usage and event data | Screens viewed, features used, onboarding progress, chapters generated, unlocked and read, paywall views, purchase attempts, generation failures and retries, session length, and similar in-app events with timestamps. |
| Diagnostics | Crash reports, performance data, error logs and generation job logs. |
| Notification data | Push notification token and notification settings. |
| Deep link data | The share link or referral code used to open or install the app, so that the correct book, chapter or partner attribution can be restored after installation. |
| Cookies and similar technologies | See our Cookie Policy. |
3.3 Data from third parties
| Source | Data |
|---|---|
| Apple and Google sign-in | Name, email address (or relay address) and a unique identifier. |
| Apple App Store and Google Play | Transaction and subscription status, product purchased, price, currency, country, trial status, renewals, cancellations and refunds. We do not receive your full card details. |
| Our payment processor (web purchases) | Transaction details, billing country, payment status and the last four digits and type of your card. Full card details are handled directly by the payment processor. |
| Subscription management provider | Entitlement status and purchase history associated with your account identifier. |
| Other users | Information arising when another user shares a book with you, or when you save or review another user’s published book. |
3.4 Special category data (sensitive information)
Some of the information you give us, in particular the gender you choose for your love interest, your relationship and personality questionnaire answers and your fantasy prompt, may reveal or allow inferences about your sexual orientation or your preferences relating to romance and intimacy. Under the GDPR this may be “special category data” relating to a person’s sex life or sexual orientation.
We process this information only on the basis of your explicit consent (Article 9(2)(a) GDPR), which we ask for during onboarding before you submit these answers. We use it only to generate and personalise your stories and to operate the related features you request. We do not use it for advertising, we do not sell it, and we do not use it to build a profile of your sexual orientation.
You may withdraw your consent at any time in Settings > Privacy or by contacting privacy@example.com. If you withdraw consent, we will stop processing this information for future generation and delete it from your profile. Because personalised story generation depends on this information, you may no longer be able to create new personalised stories, but withdrawal does not affect the lawfulness of processing before withdrawal.
Please do not include in your inputs other sensitive information, such as information about your health, religion, political opinions or ethnic origin, or any information about other identifiable people. If you do, we will process it only as part of generating your story on the basis of your explicit consent.
3.5 Profile photos
If you upload a profile photo, we use it to display your profile and, where the feature is available, to create illustrations or video featuring a stylised character inspired by your general appearance. We do not use your photo to identify or authenticate you, to perform facial recognition, or to create a biometric template, and we do not process it to uniquely identify you. You can delete or replace your photo at any time in Settings.
4. How and why we use your personal data
We use personal data only where we have a legal basis to do so. The table below sets out our purposes and legal bases.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your account, verifying your email, authentication and security of your login | Account, device, technical data | Performance of our contract with you (Art. 6(1)(b)) |
| Generating personalised stories, chapters, covers, images and video, and maintaining story continuity | Personalisation data, profile photo, content data | Contract (Art. 6(1)(b)); explicit consent for special category data (Art. 9(2)(a)) |
| Providing the reader, bookmarks, progress sync, library and notifications you enable | Reading data, notification data, content data | Contract (Art. 6(1)(b)) |
| Sharing, share cards, deep links, Shared With Me, Explore, reviews and ratings | Social data, content data, deep link data, display name | Contract (Art. 6(1)(b)) |
| Managing free access, trials, subscriptions, chapter allowances, one-time purchases, renewals and refunds | Purchase data, account data, usage data | Contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)) |
| Operating the Partner Programme and referral attribution, including calculating Partner performance and compensation | Referral data, usage and purchase events of referred users | Legitimate interests in operating and measuring our referral programme and paying Partners accurately (Art. 6(1)(f)); contract with Partners (Art. 6(1)(b)) |
| Content safety and moderation, including automated filtering of prompts and outputs, handling reports, notices, complaints and appeals | Personalisation, content, social, support data | Legitimate interests in keeping the Service safe and lawful (Art. 6(1)(f)); legal obligations, including under the EU Digital Services Act (Art. 6(1)(c)) |
| Preventing fraud, abuse of free trials and referral benefits, multiple accounts, chargebacks, and security incidents | Account, device, technical, purchase, usage data | Legitimate interests in protecting our business and users (Art. 6(1)(f)) |
| Customer support | Support data, account data, relevant technical and content data | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Service communications (verification, receipts, renewal reminders, changes to terms, moderation notices) | Account data | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Marketing emails and promotional push notifications | Account data, preferences | Consent (Art. 6(1)(a)), or, where permitted, legitimate interests for similar products to existing customers, always with an easy opt-out |
| Analytics, diagnostics and product improvement, including improving our prompts, safety systems, generation quality and features | Usage, event, diagnostics data; content and personalisation data in pseudonymised or de-identified form where possible | Legitimate interests in understanding and improving the Service (Art. 6(1)(f)); consent where required for non-essential cookies or SDKs (see Cookie Policy); explicit consent for any special category data |
| Complying with legal obligations, responding to lawful requests from authorities, and establishing, exercising or defending legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)); Art. 9(2)(f) for special category data where necessary for legal claims |
| Business transactions such as a merger, acquisition or financing | Any relevant data | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing test and you have the right to object (see Section 10).
5. Artificial intelligence and automated processing
5.1 How generation works. When you create a story or unlock a chapter, our servers combine your personalisation data, the current state of your story and our own instructions into a prompt, and send it to third-party AI model providers that generate text, images or video and return the result to us. We then store the result in your account.
5.2 AI providers. Our AI providers currently include OpenAI (text generation) and Google (image generation), and [VIDEO GENERATION PROVIDER] (video generation). They act as our processors or service providers. We use their business or API offerings, under which, where we are able to secure this contractually, they do not use your data to train their general-purpose models and retain it only for limited periods for abuse monitoring or as required by law. We may change AI providers from time to time and will update this Policy accordingly.
5.3 Improving the Service. We may review prompts, outputs, ratings and reports to improve our prompts, story quality and safety systems, and to investigate generation failures. Where practicable, we do this using pseudonymised or de-identified data and limit access to authorised personnel. We do not use your personal data to train third-party foundation models.
5.4 Automated decisions. We use automated systems to filter prompts and outputs for safety, to detect fraud and abuse, and to calculate allowances, rankings and ratings. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Where an automated safety system restricts your content or account, you can request human review through the complaint process described in our Terms of Use.
5.5 AI labelling. Content generated by the Service is AI-generated and may carry labels, watermarks or metadata indicating this.
6. Who we share your personal data with
We do not sell your personal data. We share it only as described below.
6.1 Service providers (processors). We use trusted providers who process personal data on our behalf under written contracts that require them to protect it and use it only on our instructions:
| Provider (category) | Purpose | Location of processing |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd / Google LLC) | Authentication, database, file storage, cloud functions, push messaging, analytics, crash reporting | EU and United States |
| [HOSTING PROVIDER FOR NODE.JS SERVICES] | Hosting of our AI orchestration servers | [LOCATION] |
| RevenueCat, Inc. | Subscription and entitlement management | United States |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | AI text generation and, where used, safety moderation | United States and other locations |
| Google (Gemini API) | AI image generation | United States and other locations |
| [VIDEO GENERATION PROVIDER] | AI video generation | [LOCATION] |
| [PAYMENT PROCESSOR, e.g. Stripe] | Web payments and fraud prevention | EU and United States |
| [EMAIL PROVIDER] | Transactional and marketing emails | [LOCATION] |
| [SUPPORT / ADMIN TOOLING PROVIDER] | Customer support and admin tools | [LOCATION] |
| [DEEP LINK / ATTRIBUTION PROVIDER, if any] | Deep linking, deferred deep linking and install attribution | [LOCATION] |
6.2 Independent controllers. Apple and Google process your data as independent controllers when you download the app, sign in with their services or purchase through their stores, under their own privacy policies. Social media and messaging platforms you use to share content process data under their own policies.
6.3 Other users and the public. When you share a book or chapter, recipients (and anyone with the link) can see the shared content, including the title, cover, chapters, character names and any details from your inputs that appear in the story, and share previews may appear on third-party platforms. When you publish a story to Explore, all users can see it together with your display name, and your reviews and ratings are visible to other users. Please think carefully before sharing or publishing, especially if your story contains your real name or illustrations inspired by your photo.
6.4 Partners. If you register using a Partner’s code or link, the Partner may receive aggregated reports about the performance of their referrals (for example, numbers of registrations, subscriptions and revenue). We do not share your name, email address, personalisation data or stories with Partners.
6.5 Professional advisers and auditors. Lawyers, accountants, auditors and insurers, under confidentiality obligations.
6.6 Authorities and legal requirements. Law enforcement, regulators, courts and other public authorities where we are required to do so by law or where we believe in good faith that disclosure is necessary to comply with a legal obligation, to protect the safety of any person (including by reporting suspected child sexual exploitation), to prevent fraud, or to establish, exercise or defend legal claims.
6.7 Corporate transactions. A buyer, investor or successor (and their advisers) in connection with an actual or proposed merger, acquisition, financing, reorganisation or sale of all or part of our business or assets, subject to confidentiality and to this Policy.
6.8 With your consent. Any other third party where you have given your consent.
7. International data transfers
Some of our service providers are located, or process data, outside the European Economic Area (“EEA”), including in the United States. When we transfer personal data outside the EEA, we ensure an adequate level of protection by relying on: (a) an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it; or (b) the Standard Contractual Clauses approved by the European Commission, together with supplementary measures where appropriate. You can request a copy of the relevant safeguards by contacting privacy@example.com.
8. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this Policy, and then delete or anonymise it.
| Data | Retention period |
|---|---|
| Account, personalisation data, profile photo, stories, content and reading data | For as long as your account is active. Deleted within 30 days after you delete your account, except backups, which are overwritten within a further 60 days. |
| Special category data | Until you withdraw consent or delete your account, whichever is earlier. |
| Prompt payloads and generation logs | Up to 90 days after generation for retry, debugging and quality purposes, unless linked to a safety investigation or legal claim, then for as long as necessary. |
| Content shared or published | Until you revoke sharing, unpublish, or delete your account. Copies made by others or by third-party platforms are outside our control. |
| Reviews and ratings | For as long as the reviewed book is available or until you delete them or your account. Aggregated ratings may be retained in anonymised form. |
| Purchase, billing and tax records | For the period required by applicable tax, accounting and company laws. |
| Referral attribution records | For the duration of the Partner relationship plus the period needed to calculate and settle compensation and meet accounting requirements. |
| Support, reports, notices, complaints and moderation records | Up to 3 years after closure, or longer where needed for legal claims or required by law. |
| Records concerning suspected illegal content or child safety | As required by law or by the competent authorities. |
| Analytics and diagnostic data | Up to 14 months in identifiable form, then aggregated or anonymised. |
| Consent records | For as long as the processing continues and for up to 3 years afterwards, as evidence of compliance. |
| Inactive accounts | We may delete accounts that have been inactive for more than 24 months, after giving you notice. |
9. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest provided by our cloud providers, access controls based on least privilege, authentication for administrative access, logging and monitoring, and contractual safeguards with our providers. No system is completely secure, and we cannot guarantee the absolute security of your data. You are responsible for keeping your password confidential. If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent authority as required by law.
10. Your rights
Depending on where you live, you have some or all of the following rights:
| Right | What it means |
|---|---|
| Access | Obtain confirmation of whether we process your personal data and a copy of it. |
| Rectification | Have inaccurate or incomplete data corrected. You can edit most profile data in Settings. |
| Erasure | Have your data deleted, subject to legal exceptions. You can delete your account in Settings. |
| Restriction | Ask us to restrict processing in certain circumstances. |
| Portability | Receive data you provided to us, which we process by consent or contract by automated means, in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible. |
| Objection | Object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time, without giving reasons, to direct marketing. |
| Withdraw consent | Withdraw any consent you have given, at any time, without affecting the lawfulness of processing before withdrawal. |
| Automated decisions | Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, and to obtain human review. |
| Complaint | Lodge a complaint with a supervisory authority. |
How to exercise your rights. Use the options in Settings or email privacy@example.com from the email address associated with your account. We may need to verify your identity before acting on your request. We will respond within one month, which may be extended by two further months for complex or numerous requests, in which case we will tell you. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints. We would like the chance to address your concern first, so please contact us. You also have the right to lodge a complaint with our lead supervisory authority, the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy), or with the supervisory authority in the EU or EEA country where you live or work or where an alleged infringement took place. If you are in the UK, you may contact the Information Commissioner’s Office (ico.org.uk).
11. Additional information for residents of the United States
11.1 Scope. This Section supplements the rest of this Policy for residents of US states with comprehensive consumer privacy laws, such as California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others, to the extent those laws apply to us.
11.2 Categories collected. In the last 12 months we have collected the following categories of personal information, as defined under California law: identifiers (such as email address, account ID, IP address, device identifiers); customer records (such as name and email); commercial information (such as subscriptions and purchases); internet or other electronic network activity (such as app usage and interactions); approximate geolocation (from IP address); audio-visual information (your optional profile photo); inferences drawn to personalise your stories; and sensitive personal information (account login credentials, and information that may reveal your sexual orientation or sex life, as described in Section 3.4). The sources, purposes and recipients of each category are described in Sections 3, 4 and 6, and retention in Section 8.
11.3 No sale. We do not sell personal information and have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 18.
11.4 Sharing for targeted advertising. We do not share personal information for cross-context behavioural advertising or process it for targeted advertising, except where we use advertising or install-attribution partners as described in our Cookie Policy. If we do, you may opt out at any time using the “Do Not Sell or Share My Personal Information” / “Your Privacy Choices” link in Settings or on our website, and we honour Global Privacy Control (GPC) signals in browsers that send them.
11.5 Sensitive personal information. We use sensitive personal information only for the purposes permitted by applicable law, such as providing the Service you request, and not to infer characteristics about you. Where state law requires consent to process sensitive data, we obtain it.
11.6 Your rights. Subject to applicable law, you have the right to: know and access the personal information we have collected about you; correct inaccurate information; delete personal information; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising and profiling in furtherance of decisions producing legal or similarly significant effects; and not be discriminated against for exercising your rights. You may exercise these rights by emailing privacy@example.com. An authorised agent may submit a request on your behalf with proof of authorisation. We will verify your identity by matching information you provide with information in our records. If we deny your request, you may appeal by replying to our decision with the subject line “Privacy Appeal”; if you are not satisfied with the outcome of your appeal, you may contact your state Attorney General.
11.7 Notice of financial incentive. Where we offer a benefit for applying a partner code or referring others (such as additional free chapters), the benefit is connected to the personal information associated with registration and attribution described in Section 3. You opt in by applying the code and may withdraw at any time by deleting your account. We reasonably estimate the value of this data to be equivalent to the value of the benefit offered, based on our costs of providing it.
12. Children
The Service is intended only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18, we will delete it and close the account. If you believe a minor has provided us with personal data, please contact safety@example.com.
13. Your choices
- Notifications: manage push notifications in Settings and in your device settings.
- Marketing: unsubscribe using the link in any marketing email or in Settings.
- Cookies and tracking: manage your preferences through our cookie banner, the “Privacy Choices” option in Settings, and your device settings (for example, “Allow Apps to Request to Track” on iOS or “Delete advertising ID” on Android).
- Profile photo: add, replace or delete it in Settings.
- Sharing and publishing: turn off sharing or unpublish a story at any time.
- Special category data consent: withdraw it in Settings > Privacy.
- Account deletion: delete your account in Settings > Account. Remember to cancel app store subscriptions separately.
14. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will notify you by email or in-app notice before the changes take effect and, where required by law, ask for your consent. The “Last updated” date at the top shows when this Policy was last revised.
15. Contact us
StoryForge Consulting Ltd
Registered office: [REGISTERED OFFICE ADDRESS, CYPRUS]
Privacy enquiries: privacy@example.com
Data Protection Officer: dpo@example.com