Privacy Policy

StoryBook exists to hold memories of people and moments that matter — often at a difficult, time-sensitive point in someone’s life. This policy explains, in plain language, what information we collect when a family uses StoryBook, how it’s stored, and what control the family has over it at every stage.

[Draft] Our home jurisdiction is New Zealand, and we hold ourselves to the New Zealand Privacy Act 2020. Because contributors to a StoryBook can be anywhere in the world, we aim for GDPR-grade behaviour as our default posture, not just the local minimum.

[Draft] We keep different kinds of information in different places, by design:

• Account and StoryBook details — who owns a StoryBook, its settings, memory captions and context, and access roles — held in our database.
• Original photos and videos — stored in private cloud storage, organised per StoryBook, accessed only through short-lived, signed links, never a public folder.
• Sign-in details — handled by our identity provider; we don’t store passwords, because there aren’t any (sign-in is by one-time code, or Google or Apple).
• Usage events — things like page loads and button clicks, so we can keep the product fast and reliable. This never includes the content of your memories.

[Draft] The person who creates a StoryBook is its Owner. Only the Owner and anyone they choose to make an Admin can change who is allowed to contribute, who is allowed to view or download, and whether outside access expires automatically. Nothing about visibility is decided by us.

[Draft] Each StoryBook has its own AI assistance setting, chosen by the Owner during setup and changeable at any time. When it’s on, AI may suggest things like album groupings, draft captions, or a date and place for a memory — always as a suggestion an organiser reviews and accepts, never applied silently. When it’s off, StoryBook works exactly the same way, just without those suggestions, and any existing AI suggestions can be cleared on request.

[Draft] AI providers we use are contractually required not to train their models on anything you upload, and requests are routed through infrastructure configured for zero data retention.

[Draft] Deleting a StoryBook is a genuine, permanent deletion — of the memories themselves, any versions we generated from them, any AI suggestions, and copies held in backups once their normal backup cycle completes. Because deletion can’t be undone once it’s final, there’s a 30-day grace window after you ask, in case it was a mistake.

[Draft] When someone contributes a photo, video or story, they’re asked to confirm they have the right to share it, and to grant the StoryBook’s Owner (and us, so we can operate the service) a licence to store, copy and reuse it as part of that StoryBook. Full wording of the Contributor Grant will be finalised alongside our Terms of Service.

[Draft] Under the New Zealand Privacy Act 2020, and the broader rights we extend to contributors worldwide, you can ask what information we hold about you, ask us to correct it, and ask us to delete it. Contact details for making that request are below.

[Draft] Many StoryBooks naturally include photos and stories about children, as part of a family’s history. We don’t knowingly allow children to create their own accounts, and access to a StoryBook containing children’s images is controlled entirely by the adult Owner, the same as any other memory.

[Draft] If this policy changes in a way that matters, we’ll let StoryBook Owners know before it takes effect, not bury it in a changelog.

[Draft] Questions about this policy, or a request about your information, can be sent to privacy@thestorybook.io (placeholder address, to be confirmed before launch).