Privacy Policy

The short version

Last updated: 15 June 2026

We collect what we need to run Storybench: your email and name, the stories and images you make, and payment status (Stripe handles your card, we never see it). To create your illustrations, your prompts and uploaded images are sent to Google’s AI, and your story text may be sent to Anthropic or OpenAI. We don’t sell your data and we use only essential cookies. There’s no self-service account-delete button yet — email us and we’ll do it by hand.

This summary is for convenience. The detail below is what applies.

2. What we collect

Account information.

• Your email address and your name.
• If you sign in with Google: your Google account identifier and profile picture URL. We request only basic openid/email/profile scopes, and we do not store your Google password or long-lived Google tokens.
• An optional “organization” field, your sign-up intent, and your theme preference.
• We do not use or store passwords — sign-in is by magic link or Google.

Content you create.

• Your stories and your page/book text.
• Your cast, world, and character definitions.
• Reference images you upload, and images the service generates for you.
• Any text-to-speech text and audio.
• Text is stored in our database; images and audio are stored in private cloud storage and served through short-lived expiring links.

Payments.

• Payments are handled by Stripe. We do not store your card details.
• We store your Stripe customer ID, your subscription status / period / plan, and Stripe event identifiers.

Technical information.

• When you log in, we store session information including your IP address and browser/user-agent with that session.
• We keep server logs and use your IP transiently for rate-limiting and bot protection.
• If you join the waitlist, we store your email, the page you signed up from, and the referring URL.

4. How we use your data

We use your data to provide and run the service, generate your books, sign you in, take payment, provide support, keep the service secure and prevent abuse, and improve it.

For EU / UK users, the legal bases we rely on are: performance of our contract with you; our legitimate interests (such as securing and improving the service); your consent where required; and compliance with legal obligations.

We don’t use your data to make automated decisions that produce legal or similarly significant effects about you.

6. International transfers

Most of these providers are based in the United States, so your data is processed outside New Zealand. We rely on those providers’ contractual safeguards and standard data-protection terms to protect it.

8. Your rights

You can ask us to access, correct, delete, or provide a copy of your data, and (under the GDPR) to object to or restrict certain processing. To make a request, email [email protected].

You can also complain to the New Zealand Office of the Privacy Commissioner, or to your local data-protection authority (EU/UK), or to the California Attorney General (California).

10. Security

We protect your data with measures including: encryption in transit, signed HttpOnly session cookies, login tokens stored only as hashes, and private files served through expiring links. No system is 100% secure, but we work to keep your data safe.

12. Changes to this policy

We may update this policy from time to time. When we do, we’ll update this page and the “Last updated” date above, and we’ll notify you of material changes.