Privacy Policy

The Story Book exists to hold memories of people and moments that matter, often at a difficult, time-sensitive point in someone’s life. This policy explains, in plain language, what information we collect when you use The Story Book, how it’s stored, and what control you have over it at every stage.

The Story Book is operated from New Zealand and we hold ourselves to the New Zealand Privacy Act 2020. Because contributors to a Story Book can be anywhere in the world, we aim for GDPR-grade behaviour as our default, not just the local minimum.

We keep different kinds of information in different places, by design:

• Account and Story Book details: who owns a Story Book, its settings, memory captions and context, and access roles, held in a managed Postgres database hosted in Australia.
• Original photos and videos: stored in private object storage in Cloudflare’s Oceania region (Australia and New Zealand), as far as Cloudflare lets us choose, organised per Story Book. They are never placed in a public folder and are never given a public address. They are reached only through short-lived signed links issued after we check that the person asking is allowed to see them.
• Sign-in details: handled by our identity provider. We never see or store a password, because there aren’t any: you sign in with a one-time email code, or with Google or Apple.
• Contributor sessions: when someone contributes without an account, we store their name, the email address they verified, and a session token. Tokens are stored only as a hash, so a copy of our database cannot be used to impersonate anyone.
• People an organiser adds memories for: an organiser can add memories on someone else’s behalf, giving that person’s name and, optionally, their email address. We store those with the memories so they are credited to the right person. We never email that person because of it. If they later visit the Story Book and confirm the same email address, they can see, change and add to those memories themselves.
• Versions and fingerprints of files: from each original we make smaller versions for viewing (thumbnails, display copies, a still frame from a video, and a standard copy of an iPhone HEIC photo), on our own processing servers. We also keep a short fingerprint of each file, a checksum and a tiny summary of how it looks, so that when two people share the same photo it can be shown once, credited to both. A fingerprint is not the photo and cannot be turned back into it.
• Uploads in progress: while files are uploading, including a ZIP you have dropped in, your browser keeps them in its own storage on your device, so an upload can carry on if the page is reloaded. They are cleared from your device once they have arrived.
• Usage events: things like page loads and button clicks, linked to your user profile details, so we can keep the product fast and reliable and help you if something goes wrong. This never includes the content of your memories: no captions, no stories, no file names, no images.

We do not look at what is inside a Story Book, except when its Owner asks us for help with something specific, when the law requires it, or to deal with a report of abuse or a security problem, and then only as far as that needs.

We do not sell personal information, and we do not use your memories to advertise anything to you or to anyone else.

When you choose to sign in with Google, Google shares a limited set of information with us: your name, your email address, your profile picture, and a Google account identifier. We request nothing beyond that basic profile. We do not ask for, and cannot see, your Gmail, your Google Drive, your Google Photos, your contacts or your calendar.

We use that information to identify you when you return, so a Story Book knows which memories are yours, and to help you if something goes wrong. We do not sell it, share it for advertising, or use it to train any model. It is deleted when you delete your account, on the same terms as everything else described below.

The Story Book’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of well-established providers to run The Story Book. Each one is bound by a data-processing agreement, and each is given only what it needs to do its job. Some of them process information outside New Zealand and Australia, as noted below; we choose providers that protect it to a standard comparable to New Zealand’s Privacy Act.

• Cloudflare: private storage for original photos and videos (Oceania region), and inbound and outbound email, malware scanning and making viewing copies, which run on Cloudflare’s worldwide network.
• Neon: the managed Postgres database holding Story Book records, captions and context, in Sydney, Australia.
• Clerk: sign-in and account identity, in the United States.
• Vercel: hosting for the website and the application itself, with the application running in Sydney, Australia.
• PostHog: product analytics, limited to actions and user profile details, and never memory content, in the European Union.

The Map view draws its streets and coastlines from OpenFreeMap, a free service built on OpenStreetMap. While someone looks at the map, their browser fetches map squares from it directly, so it sees their internet address and roughly which area they are looking at. It never receives memories, names, or which Story Book the map belongs to, and it sets no cookies.

Photos and videos travel from your device straight to private storage. They do not pass through our application servers on the way. Everything is encrypted in transit and at rest.

Every uploaded file is checked for malware before it can appear in a Story Book. Anything that fails is held back rather than published, and an organiser is told. Files larger than our scanner can check (over 2 GB) are held back until an organiser chooses to trust the person who sent them. We also confirm that an uploaded file really is the kind of photo or video it claims to be, rather than trusting what the browser tells us.

The person who creates a Story Book is its Owner. Only the Owner, and anyone they choose to make an Admin, can change who is allowed to contribute, who is allowed to view or download, and whether outside access expires automatically. Nothing about visibility is decided by us.

An Owner can issue a personal contribution link for one named person and withdraw it later without affecting anyone else, and can close a Story Book to new contributions at any time.

No AI looks at the photos, videos or stories in a Story Book today. If The Story Book ever adds features where AI reads what people have contributed, a Story Book’s Owner would have to switch them on, and each contributor would be asked for their consent first. Anything such a feature produced would be a suggestion that an organiser accepts or discards.

We do not use facial recognition. Your memories are never used to train AI models, by us or by anyone else, and any provider we ever used for such a feature would have to be contractually barred from keeping or training on anything we sent it.

Reading the date and place already recorded inside a photo or video file is not AI. It happens on our own processing servers. When a memory has no date or place yet, we fill them in from the file, and anyone who can edit the memory can change them. A place is named to the nearest suburb or town, never a street, and the exact position is never shown. Place names come from GeoNames, used under the Creative Commons Attribution 4.0 licence.

Deleting a Story Book is a genuine, permanent deletion: of the memories themselves, any versions and fingerprints we made from them, and copies held in backups. Because deletion cannot be undone once it is final, there is a 30-day grace window after you ask, in case it was a mistake. At the end of it, photos and videos are deleted from our storage and its backup copy at once, and the last database backups holding captions and other details expire within five weeks after that.

A contributor can ask for something they shared to be removed. While a Story Book is still accepting contributions they can remove their own memories themselves. Anyone who appears in a memory, or owns a photo someone else shared, can ask its organisers or write to us to have it taken down.

When someone contributes a photo, video or story, they confirm they have the right to share it, and grant the Story Book’s Owner and Admins, and us so that we can run the service, a licence to store, copy and show it as part of that Story Book, including in a printed book or other keepsake made from it. It does not allow anyone to sell it or make money from it, or to change it beyond what is reasonably needed, such as resizing or cropping. The full wording sits in our Terms of Service.

Under the New Zealand Privacy Act 2020, and the broader rights we extend to contributors worldwide, you can ask what information we hold about you, ask us to correct it, and ask us to delete it. You can also ask for a copy of what you have contributed. Write to the address below and we will respond within 20 working days.

Many Story Books naturally include photos and stories about children, as part of a family’s history. The Story Book is not intended for use by children: we do not knowingly allow anyone under 16 to create an account, and access to a Story Book containing children’s images is controlled entirely by the adult Owner, the same as any other memory. If you believe a child has created an account, write to us and we will remove it.

If this policy changes in a way that matters, we will tell Story Book Owners before it takes effect, rather than burying it in a changelog. The date at the top of this page always shows when it last changed.

Questions about this policy, or a request about your information, can be sent to privacy@thestorybook.io.