Privacy Rights

The US Children's Online Privacy Protection Act (COPPA) governs how online services may collect data from children under 13. StoryTelly is designed for parents to create stories for their own children, not for direct use by children. Accounts must be held by adults.

To minimize children's data collection, StoryTelly tokenizes any child name you enter before any prompt leaves your device. Our servers receive only the tokenized form ([CHILD]) — never your child's real name.

Parental rights under COPPA:

• Right to review. Email [email protected] with the subject "COPPA review request" and we will provide a copy of all data we hold about your account within 30 days.
• Right to refuse further use. Delete your account at any time from your account settings; we will remove all stored data within 30 days.
• Right to revoke consent. Same as above. There is no separate consent flag to revoke — account deletion is the revocation mechanism.

If you are in the European Union, the United Kingdom, or another GDPR-aligned jurisdiction, the General Data Protection Regulation grants you the following rights over your personal data:

• Right of access. You can ask what data we hold about you. Email [email protected] with "GDPR access request" and we will respond within 30 days.
• Right to rectification. If any data is incorrect, you can correct it from your account settings or by emailing us.
• Right to erasure ("right to be forgotten"). Delete your account from account settings; we will remove stored data within 30 days.
• Right to data portability. Email us with "GDPR portability request" and we will provide your account data in a machine-readable format (JSON).
• Right to restrict processing. You can request that we temporarily stop processing your data while a dispute is resolved.
• Right to object. You can object to certain processing, including direct marketing. We do not send direct marketing without your consent.
• Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint. If you believe we have mishandled your data, you may complain to your local data protection authority.

Our lawful basis for processing under GDPR is contract performance (delivering the StoryTelly service you signed up for) and legitimate interests (basic analytics; security; fraud prevention).

If you are a California resident, the California Consumer Privacy Act and its amendment (CPRA) grant you the following rights:

• Right to know. You can request a list of the personal data we collect, the sources, the purposes, and the categories of third parties with whom we share it. Email us with "CCPA know request".
• Right to delete. Delete your account from account settings; we will remove stored data within 30 days.
• Right to correct. Correct inaccurate personal data from your account settings or by emailing us.
• Right to opt out of sale or sharing. We do not sell or share your personal data with third parties for cross-context behavioral advertising. There is nothing to opt out of.
• Right to non-discrimination. We will not deny you service or charge you a different price for exercising any of these rights.

The fastest path for most rights:

1. Delete — go to your account settings → Delete account. All stored data is removed within 30 days.
2. Correct — your account settings let you change email, name, and most preferences directly.
3. Access / portability / other requests — email [email protected] from the email address on your account, with the subject line indicating which right you want to exercise. We will respond within 30 days.

If we cannot verify your identity from the email address alone (rare), we may ask for additional verification before fulfilling a request. We never charge for exercising any of these rights.

California residents may use an authorized agent to submit a CCPA request on their behalf. EU/UK residents may use a representative under GDPR. In either case, we will require written proof of authorization and may also require direct verification from you before fulfilling the request.

Privacy questions and rights requests: [email protected]. For general inquiries see /contact.