Privacy
Last updated November 5, 2026
Who is responsible
Storienna is run by its founders, Çağrı Aslan and Barış Özistek, individuals resident in Türkiye. Together they are the controllers of your personal data. Write to them at hello@storienna.com about anything on this page.
What we collect
- What you bring for a book — the story seed you write, and any drawings or photos you choose to upload.
- About the child — the first name and age (2 to 8) you give us, so the story is written for them.
- Account details — your name and email address, and your password or Google sign-in.
- The books we make for you — the stories, illustrations and PDFs of the books in your library.
- Purchases — your plan, order and receipt details from Polar. Polar collects your card details; we never see them.
- Technical data — IP address, browser and device details in our server logs and in the bot check at sign-up.
- Sign-up campaign record — the campaign tags of the link that brought you (such as utm_source or a referral code), the page you arrived on and the time; Meta's click and browser IDs only with your advertising consent.
- Analytics and advertising consent records — your choices, and when you made them.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Writing, illustrating and delivering your book | Story seed, uploads, child's first name and age | Contract (we can't make the book without them) |
| Running your account and library | Account details, books | Contract |
| Payments, receipts, refunds and tax records | Purchases | Contract; legal obligation |
| Service emails (welcome, "your book is ready") | Name, email | Contract |
| Keeping the service secure and stopping abuse | Technical data, account details | Legitimate interests |
| Learning which plans people want | Plan-interest records (below) | Legitimate interests |
| Knowing which links bring new accounts | Sign-up campaign record (below) | Legitimate interests |
| Optional product analytics | Analytics events (below) | Consent |
| Advertising measurement | Home-page visits, plans views and begin-a-book clicks; sign-up, checkout, book and purchase events with a hashed email address and Meta's click and browser IDs (below) | Consent, asked separately and off by default; nothing is sent without it |
We do not sell your information, and we do not use your family's photos, drawings, or stories to train AI models.
Interest in upcoming plans
When you choose a paid option that is not yet available, we record the chosen option, displayed price, language, and time to understand which options people want. If you are signed in, we associate this with your account ID; otherwise the click is anonymous. This record contains no child names, photos, stories, or payment details. It is not a purchase, subscription, or permission to send marketing email. We do not use advertising trackers or cross-site identifiers for this measurement. Account-linked plan-interest records are removed when you delete your account.
Optional product analytics
If you allow analytics, we use PostHog to understand visits, campaign sources, account registration, book-creation and plan-purchase steps. A few of these steps (a confirmed sign-up, a book sent and finished, a checkout opened, a plan bought) are reported by our servers rather than your browser, and only while the analytics choice saved with your account allows it. We store an analytics identifier, your preference, campaign tags and event-deduplication markers on your device. When you sign in, we link these events to your account ID; we do not send your email address. We exclude children’s names, ages, photos, drawings, prompts and story text, and do not record sessions or automatically capture what you type or click. Campaign tags are kept for up to 90 days. You can decline or withdraw permission through “Privacy choices”; withdrawal stops future tracking and clears the analytics state on this device. It does not erase events already sent. Contact us to request deletion of those events. You can use Storienna without optional analytics.
Advertising measurement
Advertising measurement is a separate choice, off unless you turn it on. With it on, Meta's code (the Meta pixel, which sets Meta's browser cookie) runs on the storienna.com home page only, never inside the app where books are made and read. There it reports a visit, the plans section coming into view and a click to begin a book. Our servers also tell Meta about a few account events: signing up, starting a checkout, sending a book to be made and buying a plan (with its price). With each event goes what Meta needs to match it to an ad click: its click ID and browser ID, your email address and account ID in hashed form (scrambled one way before they leave us), and the browser type and IP address of the request. We use this only to see whether our ads work. We never send children's names, ages, photos, drawings, prompts or story text. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a no to advertising measurement. You can turn it off at any time in “Privacy choices”: we then stop sending these events and delete the Meta identifiers saved with your account. Events already sent are handled under Meta's own privacy policy.
Which links bring new accounts
When you create an account, we save with it the campaign tags of the link that brought you (such as utm_source or a referral code), the page you arrived on and the time. These tags travel in the link itself; we do not store them on your device for this. We use the record to learn which channels bring new families, whether or not you allow analytics. It is deleted with your account.
Children
Storienna is a service for adults — parents, guardians, and gift-givers aged 18 or over. We do not knowingly collect personal information directly from children. Anything about a child (a first name, an age, a photo, a drawing) reaches us only through the adult who makes the book, and is used only to make that family's books. Only share a child's details and pictures if you are their parent or guardian or have their parent's permission.
Who processes it for us
These providers handle personal data to run Storienna. Most act only on our instructions, under data processing terms. Polar (as merchant of record), Google (for sign-in) and Meta also use it under their own privacy policies.
| Provider | What they do | Where |
|---|---|---|
| OpenAI | Writes and illustrates the book from your seed, uploads and the child's first name and age. OpenAI does not use this data to train its models. | US |
| Supabase | Accounts, database and file storage for your library | EU (Germany) |
| Render | Runs our servers and book generation | EU (Germany) |
| Resend | Sends account and book emails | US |
| Polar Software, Inc. | Merchant of record: checkout, payments, receipts, refunds, sales tax and VAT | US |
| PostHog | Optional product analytics, only with your consent | US |
| Cloudflare | Bot check (Turnstile) when you sign up or sign in | Global network |
| Google sign-in, if you choose it; web fonts on our home page | US | |
| Zoho | Our hello@storienna.com inbox, for emails you send us | EU |
| Advertising platforms (Meta) | Measure whether our ads lead to visits, sign-ups and purchases, only with your separate advertising consent | US |
International transfers
Our database, files and servers are in the EU. Some providers above are in the US, and we, the controllers, are in Türkiye. When your data leaves the UK or EEA, we rely on safeguards recognised under UK and EU law: the UK–US data bridge or EU–US Data Privacy Framework where the provider is certified, and otherwise standard contractual clauses (with the UK addendum) in the provider's data processing terms.
How long we keep it
- Books, uploads and child details — until you delete them or your account. Deleting your account in the app removes your library, uploads and profile at once; routine backups roll over after that.
- Purchase records — as long as tax and accounting law requires. Polar keeps its own records as merchant of record.
- Subscription consent records (which renewal terms you were shown, and when) — 3 years after the purchase.
- Campaign tags — up to 90 days. Other analytics events stay until you ask us to delete them.
- Sign-up campaign record — as long as your account exists. Meta identifiers in it are deleted when you turn advertising measurement off.
- Analytics and advertising consent records — as long as your account exists. Deleting your account deletes them with your profile.
- Server logs — kept briefly for security and debugging, then discarded by our hosting provider.
- Emails you send us — as long as we need them to help you.
Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and you can withdraw consent at any time (for analytics and advertising, through "Privacy choices"). Email hello@storienna.com; we answer within one month. If you are in the UK and unhappy with our answer, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. In the EU, you can complain to your local data protection authority.
Security
We use industry-standard safeguards to protect what you share with us in transit and at rest.
Changes
If this policy changes in a way that matters, we will say so here and update the date above.
Contact
Questions about privacy: hello@storienna.com